# Flog Txt Version 1 # Analyzer Version: 3.1.2 # Analyzer Build Date: Oct 28 2019 11:51:53 # Log Creation Date: 01.01.2020 00:21:39.750 Process: id = "1" image_name = "01.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\01.exe" page_root = "0x4fbbe000" os_pid = "0x920" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x924 [0024.330] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76c20000 [0024.331] GetProcAddress (hModule=0x76c20000, lpProcName="WritePrivateProfileStringA") returned 0x76c57048 [0024.331] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0024.331] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointer") returned 0x76c317d1 [0024.331] GetProcAddress (hModule=0x76c20000, lpProcName="SetEndOfFile") returned 0x76c4ce2e [0024.331] GetProcAddress (hModule=0x76c20000, lpProcName="ReadFile") returned 0x76c33ed3 [0024.332] GetProcAddress (hModule=0x76c20000, lpProcName="MoveFileA") returned 0x76cad911 [0024.332] GetProcAddress (hModule=0x76c20000, lpProcName="LockResource") returned 0x76c35959 [0024.332] GetProcAddress (hModule=0x76c20000, lpProcName="LoadResource") returned 0x76c3594c [0024.332] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryA") returned 0x76c349d7 [0024.332] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0024.332] GetProcAddress (hModule=0x76c20000, lpProcName="GetPrivateProfileIntA") returned 0x76c5cdd7 [0024.332] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleA") returned 0x76c31245 [0024.332] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameA") returned 0x76c314b1 [0024.332] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0024.332] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileSize") returned 0x76c3196e [0024.332] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileAttributesA") returned 0x76c35414 [0024.332] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineA") returned 0x76c351a1 [0024.332] GetProcAddress (hModule=0x76c20000, lpProcName="FreeResource") returned 0x76c4d3db [0024.332] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibrary") returned 0x76c334c8 [0024.332] GetProcAddress (hModule=0x76c20000, lpProcName="FormatMessageA") returned 0x76c55fbd [0024.333] GetProcAddress (hModule=0x76c20000, lpProcName="FindResourceA") returned 0x76c4e9bb [0024.333] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileA") returned 0x76c5d53e [0024.333] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileA") returned 0x76c3e2ce [0024.333] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0024.333] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileA") returned 0x76c35444 [0024.333] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileA") returned 0x76c353c6 [0024.333] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0024.333] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76c20000 [0024.333] GetProcAddress (hModule=0x76c20000, lpProcName="TlsSetValue") returned 0x76c314fb [0024.333] GetProcAddress (hModule=0x76c20000, lpProcName="TlsGetValue") returned 0x76c311e0 [0024.333] GetProcAddress (hModule=0x76c20000, lpProcName="LocalAlloc") returned 0x76c3168c [0024.333] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleA") returned 0x76c31245 [0024.333] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameA") returned 0x76c314b1 [0024.333] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76c20000 [0024.333] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThreadId") returned 0x76c31450 [0024.334] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0024.334] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0024.334] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0024.334] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSection") returned 0x77162c42 [0024.334] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0024.334] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0024.334] GetProcAddress (hModule=0x76c20000, lpProcName="LocalFree") returned 0x76c32d3c [0024.334] GetProcAddress (hModule=0x76c20000, lpProcName="LocalAlloc") returned 0x76c3168c [0024.334] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualQuery") returned 0x76c3445a [0024.334] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenA") returned 0x76c35a4b [0024.334] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpyA") returned 0x76c52a9d [0024.334] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryExA") returned 0x76c34913 [0024.334] GetProcAddress (hModule=0x76c20000, lpProcName="GetThreadLocale") returned 0x76c335cf [0024.334] GetProcAddress (hModule=0x76c20000, lpProcName="GetStartupInfoA") returned 0x76c30e00 [0024.334] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameA") returned 0x76c314b1 [0024.335] GetProcAddress (hModule=0x76c20000, lpProcName="GetLocaleInfoA") returned 0x76c4d5e5 [0024.335] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0024.335] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineA") returned 0x76c351a1 [0024.335] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibrary") returned 0x76c334c8 [0024.335] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0024.335] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0024.335] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointer") returned 0x76c317d1 [0024.335] GetProcAddress (hModule=0x76c20000, lpProcName="SetEndOfFile") returned 0x76c4ce2e [0024.335] GetProcAddress (hModule=0x76c20000, lpProcName="RtlUnwind") returned 0x76c5d1c3 [0024.335] GetProcAddress (hModule=0x76c20000, lpProcName="ReadFile") returned 0x76c33ed3 [0024.335] GetProcAddress (hModule=0x76c20000, lpProcName="RaiseException") returned 0x76c358a6 [0024.335] GetProcAddress (hModule=0x76c20000, lpProcName="GetStdHandle") returned 0x76c351b3 [0024.335] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileSize") returned 0x76c3196e [0024.335] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTime") returned 0x76c35a96 [0024.335] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileType") returned 0x76c33531 [0024.336] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileA") returned 0x76c353c6 [0024.336] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0024.336] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0024.336] GetProcAddress (hModule=0x74d40000, lpProcName="RegSetValueExA") returned 0x74d514b3 [0024.336] GetProcAddress (hModule=0x74d40000, lpProcName="RegQueryValueExA") returned 0x74d548ef [0024.336] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExA") returned 0x74d54907 [0024.336] GetProcAddress (hModule=0x74d40000, lpProcName="RegCreateKeyExA") returned 0x74d51469 [0024.336] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0024.336] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0024.336] GetProcAddress (hModule=0x74d40000, lpProcName="RegQueryValueExA") returned 0x74d548ef [0024.336] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExA") returned 0x74d54907 [0024.336] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0024.336] LoadLibraryA (lpLibFileName="comctl32.dll") returned 0x74ae0000 [0024.336] GetProcAddress (hModule=0x74ae0000, lpProcName="InitCommonControls") returned 0x74ae1739 [0024.336] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x75ad0000 [0024.337] GetProcAddress (hModule=0x75ad0000, lpProcName="StretchDIBits") returned 0x75ae7435 [0024.337] GetProcAddress (hModule=0x75ad0000, lpProcName="SetWindowOrgEx") returned 0x75aeaf0a [0024.337] GetProcAddress (hModule=0x75ad0000, lpProcName="SetTextColor") returned 0x75ae522d [0024.337] GetProcAddress (hModule=0x75ad0000, lpProcName="SetROP2") returned 0x75aebc54 [0024.337] GetProcAddress (hModule=0x75ad0000, lpProcName="SetBrushOrgEx") returned 0x75ae9541 [0024.337] GetProcAddress (hModule=0x75ad0000, lpProcName="SetBkMode") returned 0x75ae51a2 [0024.337] GetProcAddress (hModule=0x75ad0000, lpProcName="SetBkColor") returned 0x75ae52d8 [0024.337] GetProcAddress (hModule=0x75ad0000, lpProcName="SelectObject") returned 0x75ae4f70 [0024.337] GetProcAddress (hModule=0x75ad0000, lpProcName="SelectClipRgn") returned 0x75ae8916 [0024.337] GetProcAddress (hModule=0x75ad0000, lpProcName="SaveDC") returned 0x75ae6e05 [0024.337] GetProcAddress (hModule=0x75ad0000, lpProcName="RestoreDC") returned 0x75ae6ead [0024.337] GetProcAddress (hModule=0x75ad0000, lpProcName="MoveToEx") returned 0x75ae8ee6 [0024.337] GetProcAddress (hModule=0x75ad0000, lpProcName="IntersectClipRect") returned 0x75ae7dc4 [0024.337] GetProcAddress (hModule=0x75ad0000, lpProcName="GetWindowOrgEx") returned 0x75aee310 [0024.337] GetProcAddress (hModule=0x75ad0000, lpProcName="GetStockObject") returned 0x75ae4eb8 [0024.338] GetProcAddress (hModule=0x75ad0000, lpProcName="GetObjectA") returned 0x75ae85d4 [0024.338] GetProcAddress (hModule=0x75ad0000, lpProcName="GetDeviceCaps") returned 0x75ae4de0 [0024.338] GetProcAddress (hModule=0x75ad0000, lpProcName="ExcludeClipRect") returned 0x75aea066 [0024.338] GetProcAddress (hModule=0x75ad0000, lpProcName="DeleteObject") returned 0x75ae5689 [0024.338] GetProcAddress (hModule=0x75ad0000, lpProcName="DeleteDC") returned 0x75ae58b3 [0024.338] GetProcAddress (hModule=0x75ad0000, lpProcName="CreateSolidBrush") returned 0x75ae4f17 [0024.338] GetProcAddress (hModule=0x75ad0000, lpProcName="CreateRectRgnIndirect") returned 0x75aea764 [0024.338] GetProcAddress (hModule=0x75ad0000, lpProcName="CreateRectRgn") returned 0x75ae77cf [0024.338] GetProcAddress (hModule=0x75ad0000, lpProcName="CreateFontIndirectA") returned 0x75aecffd [0024.338] GetProcAddress (hModule=0x75ad0000, lpProcName="CreateDIBSection") returned 0x75aeac46 [0024.338] GetProcAddress (hModule=0x75ad0000, lpProcName="CreateCompatibleDC") returned 0x75ae54f4 [0024.338] GetProcAddress (hModule=0x75ad0000, lpProcName="CreateCompatibleBitmap") returned 0x75ae5f49 [0024.338] GetProcAddress (hModule=0x75ad0000, lpProcName="CombineRgn") returned 0x75aea903 [0024.338] GetProcAddress (hModule=0x75ad0000, lpProcName="BitBlt") returned 0x75ae5ea6 [0024.338] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x75220000 [0024.339] GetProcAddress (hModule=0x75220000, lpProcName="VariantCopyInd") returned 0x7523e86c [0024.339] GetProcAddress (hModule=0x75220000, lpProcName="VariantClear") returned 0x75223eae [0024.339] GetProcAddress (hModule=0x75220000, lpProcName="SysFreeString") returned 0x75223e59 [0024.339] GetProcAddress (hModule=0x75220000, lpProcName="SysReAllocStringLen") returned 0x75227810 [0024.339] GetProcAddress (hModule=0x75220000, lpProcName="SysAllocStringLen") returned 0x752245d2 [0024.339] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x75fd0000 [0024.339] GetProcAddress (hModule=0x75fd0000, lpProcName="SHFileOperationA") returned 0x7622addd [0024.339] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0024.339] GetProcAddress (hModule=0x74f40000, lpProcName="WaitMessage") returned 0x74f7f5a9 [0024.339] GetProcAddress (hModule=0x74f40000, lpProcName="ValidateRect") returned 0x74f67849 [0024.339] GetProcAddress (hModule=0x74f40000, lpProcName="UpdateWindow") returned 0x74f63559 [0024.339] GetProcAddress (hModule=0x74f40000, lpProcName="TranslateMessage") returned 0x74f57809 [0024.339] GetProcAddress (hModule=0x74f40000, lpProcName="ShowWindow") returned 0x74f60dfb [0024.339] GetProcAddress (hModule=0x74f40000, lpProcName="SetWindowTextA") returned 0x74f67aee [0024.339] GetProcAddress (hModule=0x74f40000, lpProcName="SetWindowPos") returned 0x74f58e4e [0024.340] GetProcAddress (hModule=0x74f40000, lpProcName="SetWindowLongA") returned 0x74f66110 [0024.340] GetProcAddress (hModule=0x74f40000, lpProcName="SetTimer") returned 0x74f579fb [0024.340] GetProcAddress (hModule=0x74f40000, lpProcName="SetPropA") returned 0x74f6822c [0024.340] GetProcAddress (hModule=0x74f40000, lpProcName="SetFocus") returned 0x74f62175 [0024.340] GetProcAddress (hModule=0x74f40000, lpProcName="SetCursor") returned 0x74f641f6 [0024.340] GetProcAddress (hModule=0x74f40000, lpProcName="SetCapture") returned 0x74f7ed56 [0024.340] GetProcAddress (hModule=0x74f40000, lpProcName="SendMessageA") returned 0x74f6612e [0024.340] GetProcAddress (hModule=0x74f40000, lpProcName="ScreenToClient") returned 0x74f6227d [0024.340] GetProcAddress (hModule=0x74f40000, lpProcName="RemovePropA") returned 0x74f68284 [0024.340] GetProcAddress (hModule=0x74f40000, lpProcName="ReleaseDC") returned 0x74f57446 [0024.340] GetProcAddress (hModule=0x74f40000, lpProcName="ReleaseCapture") returned 0x74f7ed49 [0024.340] GetProcAddress (hModule=0x74f40000, lpProcName="RegisterWindowMessageA") returned 0x74f60afa [0024.340] GetProcAddress (hModule=0x74f40000, lpProcName="RegisterClassA") returned 0x74f6434b [0024.340] GetProcAddress (hModule=0x74f40000, lpProcName="PostQuitMessage") returned 0x74f59abb [0024.340] GetProcAddress (hModule=0x74f40000, lpProcName="PostMessageA") returned 0x74f63baa [0024.340] GetProcAddress (hModule=0x74f40000, lpProcName="PeekMessageA") returned 0x74f65f74 [0024.341] GetProcAddress (hModule=0x74f40000, lpProcName="OffsetRect") returned 0x74f60bbd [0024.341] GetProcAddress (hModule=0x74f40000, lpProcName="MoveWindow") returned 0x74f63698 [0024.341] GetProcAddress (hModule=0x74f40000, lpProcName="MessageBoxA") returned 0x74fafd1e [0024.341] GetProcAddress (hModule=0x74f40000, lpProcName="LoadIconA") returned 0x74f5dafb [0024.341] GetProcAddress (hModule=0x74f40000, lpProcName="LoadCursorA") returned 0x74f5dad5 [0024.341] GetProcAddress (hModule=0x74f40000, lpProcName="KillTimer") returned 0x74f579db [0024.341] GetProcAddress (hModule=0x74f40000, lpProcName="IsZoomed") returned 0x74f63332 [0024.341] GetProcAddress (hModule=0x74f40000, lpProcName="IsWindowVisible") returned 0x74f6112d [0024.341] GetProcAddress (hModule=0x74f40000, lpProcName="IsWindowEnabled") returned 0x74f62c1b [0024.341] GetProcAddress (hModule=0x74f40000, lpProcName="IsWindow") returned 0x74f57136 [0024.341] GetProcAddress (hModule=0x74f40000, lpProcName="IsIconic") returned 0x74f632a9 [0024.341] GetProcAddress (hModule=0x74f40000, lpProcName="InvalidateRgn") returned 0x74f66604 [0024.341] GetProcAddress (hModule=0x74f40000, lpProcName="InvalidateRect") returned 0x74f61381 [0024.341] GetProcAddress (hModule=0x74f40000, lpProcName="InflateRect") returned 0x74f63309 [0024.341] GetProcAddress (hModule=0x74f40000, lpProcName="GetWindowRect") returned 0x74f57f34 [0024.342] GetProcAddress (hModule=0x74f40000, lpProcName="GetWindowLongA") returned 0x74f5d156 [0024.342] GetProcAddress (hModule=0x74f40000, lpProcName="GetWindowDC") returned 0x74f58048 [0024.342] GetProcAddress (hModule=0x74f40000, lpProcName="GetUpdateRgn") returned 0x74f66222 [0024.342] GetProcAddress (hModule=0x74f40000, lpProcName="GetUpdateRect") returned 0x74f7d41f [0024.342] GetProcAddress (hModule=0x74f40000, lpProcName="GetSystemMenu") returned 0x74f66ea6 [0024.342] GetProcAddress (hModule=0x74f40000, lpProcName="GetSysColor") returned 0x74f56c3c [0024.342] GetProcAddress (hModule=0x74f40000, lpProcName="GetPropA") returned 0x74f67b5a [0024.342] GetProcAddress (hModule=0x74f40000, lpProcName="GetParent") returned 0x74f60f68 [0024.342] GetProcAddress (hModule=0x74f40000, lpProcName="GetWindow") returned 0x74f5926e [0024.342] GetProcAddress (hModule=0x74f40000, lpProcName="GetKeyState") returned 0x74f6291f [0024.342] GetProcAddress (hModule=0x74f40000, lpProcName="GetFocus") returned 0x74f60dee [0024.342] GetProcAddress (hModule=0x74f40000, lpProcName="GetDC") returned 0x74f572c4 [0024.342] GetProcAddress (hModule=0x74f40000, lpProcName="GetCursorPos") returned 0x74f61218 [0024.342] GetProcAddress (hModule=0x74f40000, lpProcName="GetClientRect") returned 0x74f60c62 [0024.342] GetProcAddress (hModule=0x74f40000, lpProcName="GetClassLongA") returned 0x74f686f9 [0024.343] GetProcAddress (hModule=0x74f40000, lpProcName="GetClassInfoA") returned 0x74f66ade [0024.343] GetProcAddress (hModule=0x74f40000, lpProcName="GetCapture") returned 0x74f62aac [0024.343] GetProcAddress (hModule=0x74f40000, lpProcName="GetAsyncKeyState") returned 0x74f7eb96 [0024.343] GetProcAddress (hModule=0x74f40000, lpProcName="FillRect") returned 0x74f60eb6 [0024.343] GetProcAddress (hModule=0x74f40000, lpProcName="EndPaint") returned 0x74f61341 [0024.343] GetProcAddress (hModule=0x74f40000, lpProcName="EnableWindow") returned 0x74f62da4 [0024.343] GetProcAddress (hModule=0x74f40000, lpProcName="EnableMenuItem") returned 0x74f66f50 [0024.343] GetProcAddress (hModule=0x74f40000, lpProcName="DispatchMessageA") returned 0x74f57bbb [0024.343] GetProcAddress (hModule=0x74f40000, lpProcName="DestroyWindow") returned 0x74f59a55 [0024.343] GetProcAddress (hModule=0x74f40000, lpProcName="DestroyIcon") returned 0x74f649b2 [0024.343] GetProcAddress (hModule=0x74f40000, lpProcName="DestroyAcceleratorTable") returned 0x74f63db6 [0024.343] GetProcAddress (hModule=0x74f40000, lpProcName="DeleteMenu") returned 0x74f66d2a [0024.343] GetProcAddress (hModule=0x74f40000, lpProcName="DefWindowProcA") returned 0x771724e0 [0024.343] GetProcAddress (hModule=0x74f40000, lpProcName="CreateWindowExA") returned 0x74f5d22e [0024.343] GetProcAddress (hModule=0x74f40000, lpProcName="CopyImage") returned 0x74f64a09 [0024.344] GetProcAddress (hModule=0x74f40000, lpProcName="ClientToScreen") returned 0x74f62606 [0024.344] GetProcAddress (hModule=0x74f40000, lpProcName="CallWindowProcA") returned 0x74f6792f [0024.344] GetProcAddress (hModule=0x74f40000, lpProcName="BeginPaint") returned 0x74f61361 [0024.344] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0024.344] GetProcAddress (hModule=0x74f40000, lpProcName="GetKeyboardType") returned 0x74f99ac4 [0024.344] GetProcAddress (hModule=0x74f40000, lpProcName="MessageBoxA") returned 0x74fafd1e [0024.344] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0024.349] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0024.349] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0024.349] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x18fe5c, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\01.exe")) returned 0x2c [0024.349] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x18fd37, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\01.exe")) returned 0x2c [0024.349] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf003f, phkResult=0x18fe4c | out: phkResult=0x18fe4c*=0x0) returned 0x2 [0024.350] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Delphi\\Locales", ulOptions=0x0, samDesired=0xf003f, phkResult=0x18fe4c | out: phkResult=0x18fe4c*=0x0) returned 0x2 [0024.350] lstrcpyA (in: lpString1=0x18fd37, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01.exe" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01.exe" [0024.350] GetThreadLocale () returned 0x409 [0024.350] GetLocaleInfoA (in: Locale=0x409, LCType=0x3, lpLCData=0x18fe47, cchData=5 | out: lpLCData="ENU") returned 4 [0024.351] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01.exe") returned 44 [0024.351] lstrcpyA (in: lpString1=0x18fd60, lpString2="ENU" | out: lpString1="ENU") returned="ENU" [0024.351] LoadLibraryExA (lpLibFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01.ENU", hFile=0x0, dwFlags=0x2) returned 0x0 [0024.351] lstrcpyA (in: lpString1=0x18fd60, lpString2="EN" | out: lpString1="EN") returned="EN" [0024.351] LoadLibraryExA (lpLibFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01.EN", hFile=0x0, dwFlags=0x2) returned 0x0 [0024.351] GetKeyboardType (nTypeFlag=0) returned 4 [0024.351] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01.exe\" " [0024.351] GetStartupInfoA (in: lpStartupInfo=0x18fef0 | out: lpStartupInfo=0x18fef0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0024.351] GetCurrentThreadId () returned 0x924 [0024.351] InitCommonControls () [0024.351] LoadLibraryA (lpLibFileName="comctl32.dll") returned 0x74ae0000 [0024.352] GetProcAddress (hModule=0x74ae0000, lpProcName="InitCommonControlsEx") returned 0x74ae6be6 [0024.352] InitCommonControlsEx (picce=0x18ff34) returned 1 [0024.354] LocalAlloc (uFlags=0x0, uBytes=0xff8) returned 0x2d58e8 [0024.354] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x1) returned 0x1c20000 [0024.354] LocalAlloc (uFlags=0x0, uBytes=0x644) returned 0x2d68e8 [0024.354] VirtualAlloc (lpAddress=0x1c20000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c20000 [0024.354] RegisterClipboardFormatA (lpszFormat="inner message") returned 0xc13f [0024.354] GetSystemTime (in: lpSystemTime=0x18ff2c | out: lpSystemTime=0x18ff2c*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x3, wDay=0x1, wHour=0x0, wMinute=0x16, wSecond=0x1, wMilliseconds=0x0)) [0024.355] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01.exe\" " [0024.355] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0024.355] GetClassInfoA (in: hInstance=0x400000, lpClassName="App", lpWndClass=0x18fe9c | out: lpWndClass=0x18fe9c) returned 0 [0024.355] GetClassInfoA (in: hInstance=0x400000, lpClassName="obj_App", lpWndClass=0x18fe04 | out: lpWndClass=0x18fe04) returned 0 [0024.355] RegisterClassA (lpWndClass=0x18fe9c) returned 0x1ac13d [0024.355] CreateWindowExA (dwExStyle=0x40000, lpClassName="obj_App", lpWindowName="Form", dwStyle=0x80ca0000, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x301e4 [0024.609] SetPropA (hWnd=0x301e4, lpString="SELF_", hData=0x1c203a4) returned 1 [0024.609] NtdllDefWindowProc_A (hWnd=0x301e4, Msg=0x81, wParam=0x0, lParam=0x18fa4c) returned 0x1 [0024.610] GetPropA (hWnd=0x301e4, lpString="SELF_") returned 0x1c203a4 [0024.610] NtdllDefWindowProc_A (hWnd=0x301e4, Msg=0x83, wParam=0x0, lParam=0x18fa38) returned 0x0 [0024.704] GetPropA (hWnd=0x301e4, lpString="SELF_") returned 0x1c203a4 [0024.704] NtdllDefWindowProc_A (hWnd=0x301e4, Msg=0x1, wParam=0x0, lParam=0x18fa4c) returned 0x0 [0024.704] GetPropA (hWnd=0x301e4, lpString="SELF_") returned 0x1c203a4 [0024.704] NtdllDefWindowProc_A (hWnd=0x301e4, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0024.704] GetPropA (hWnd=0x301e4, lpString="SELF_") returned 0x1c203a4 [0024.704] NtdllDefWindowProc_A (hWnd=0x301e4, Msg=0x3, wParam=0x0, lParam=0x190003) returned 0x0 [0024.706] SendMessageA (hWnd=0x301e4, Msg=0x128, wParam=0x10002, lParam=0x0) returned 0x0 [0024.706] GetPropA (hWnd=0x301e4, lpString="SELF_") returned 0x1c203a4 [0024.706] NtdllDefWindowProc_A (hWnd=0x301e4, Msg=0x128, wParam=0x10002, lParam=0x0) returned 0x0 [0024.706] GetPropA (hWnd=0x301e4, lpString="SELF_") returned 0x1c203a4 [0024.706] LoadIconA (hInstance=0x400000, lpIconName="MAINICON") returned 0x0 [0024.707] SendMessageA (hWnd=0x301e4, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x0 [0024.707] GetPropA (hWnd=0x301e4, lpString="SELF_") returned 0x1c203a4 [0024.707] NtdllDefWindowProc_A (hWnd=0x301e4, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x0 [0024.717] GetPropA (hWnd=0x301e4, lpString="SELF_") returned 0x1c203a4 [0024.717] NtdllDefWindowProc_A (hWnd=0x301e4, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0024.717] GetPropA (hWnd=0x301e4, lpString="SELF_") returned 0x1c203a4 [0024.717] NtdllDefWindowProc_A (hWnd=0x301e4, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0024.717] GetPropA (hWnd=0x301e4, lpString="SELF_") returned 0x1c203a4 [0024.717] NtdllDefWindowProc_A (hWnd=0x301e4, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0024.719] GetSystemMenu (hWnd=0x301e4, bRevert=0) returned 0x501c3 [0024.722] EnableMenuItem (hMenu=0x501c3, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0024.722] DeleteMenu (hMenu=0x501c3, uPosition=0xf000, uFlags=0x0) returned 1 [0024.722] DeleteMenu (hMenu=0x501c3, uPosition=0xf010, uFlags=0x0) returned 1 [0024.722] DeleteMenu (hMenu=0x501c3, uPosition=0xf030, uFlags=0x0) returned 1 [0024.722] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0024.722] GetClassInfoA (in: hInstance=0x400000, lpClassName="Form", lpWndClass=0x18fe18 | out: lpWndClass=0x18fe18) returned 0 [0024.722] GetClassInfoA (in: hInstance=0x400000, lpClassName="obj_Form", lpWndClass=0x18fd80 | out: lpWndClass=0x18fd80) returned 0 [0024.722] RegisterClassA (lpWndClass=0x18fe18) returned 0xc13e [0024.722] CreateWindowExA (dwExStyle=0x10000, lpClassName="obj_Form", lpWindowName="Form", dwStyle=0x6cf0000, X=-2147483648, Y=-2147483648, nWidth=64, nHeight=64, hWndParent=0x301e4, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x30160 [0024.722] SetPropA (hWnd=0x30160, lpString="SELF_", hData=0x1c209f4) returned 1 [0024.722] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x24, wParam=0x0, lParam=0x18f9d4) returned 0x0 [0024.722] GetPropA (hWnd=0x30160, lpString="SELF_") returned 0x1c209f4 [0024.722] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x81, wParam=0x0, lParam=0x18f9c8) returned 0x1 [0024.722] GetPropA (hWnd=0x30160, lpString="SELF_") returned 0x1c209f4 [0024.723] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x83, wParam=0x0, lParam=0x18f9b4) returned 0x0 [0024.723] GetPropA (hWnd=0x30160, lpString="SELF_") returned 0x1c209f4 [0024.723] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x1, wParam=0x0, lParam=0x18f9c8) returned 0x0 [0024.723] SendMessageA (hWnd=0x30160, Msg=0x128, wParam=0x10002, lParam=0x0) returned 0x0 [0024.723] GetPropA (hWnd=0x30160, lpString="SELF_") returned 0x1c209f4 [0024.723] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x128, wParam=0x10002, lParam=0x0) returned 0x0 [0024.723] GetPropA (hWnd=0x30160, lpString="SELF_") returned 0x1c209f4 [0024.723] LoadIconA (hInstance=0x400000, lpIconName="MAINICON") returned 0x0 [0024.723] SendMessageA (hWnd=0x30160, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x0 [0024.723] GetPropA (hWnd=0x30160, lpString="SELF_") returned 0x1c209f4 [0024.723] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x0 [0024.724] GetPropA (hWnd=0x30160, lpString="SELF_") returned 0x1c209f4 [0024.724] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0024.724] GetPropA (hWnd=0x30160, lpString="SELF_") returned 0x1c209f4 [0024.724] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0024.724] GetPropA (hWnd=0x30160, lpString="SELF_") returned 0x1c209f4 [0024.724] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0024.725] LoadIconA (hInstance=0x400000, lpIconName="ICON0") returned 0x601c1 [0024.725] SendMessageA (hWnd=0x301e4, Msg=0x80, wParam=0x1, lParam=0x601c1) returned 0x0 [0024.725] GetPropA (hWnd=0x301e4, lpString="SELF_") returned 0x1c203a4 [0024.725] NtdllDefWindowProc_A (hWnd=0x301e4, Msg=0x80, wParam=0x1, lParam=0x601c1) returned 0x0 [0024.727] GetPropA (hWnd=0x301e4, lpString="SELF_") returned 0x1c203a4 [0024.727] NtdllDefWindowProc_A (hWnd=0x301e4, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x801b9 [0024.727] SendMessageA (hWnd=0x30160, Msg=0x80, wParam=0x1, lParam=0x601c1) returned 0x0 [0024.727] GetPropA (hWnd=0x30160, lpString="SELF_") returned 0x1c209f4 [0024.727] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x80, wParam=0x1, lParam=0x601c1) returned 0x0 [0024.728] GetPropA (hWnd=0x30160, lpString="SELF_") returned 0x1c209f4 [0024.728] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x120195 [0024.728] InvalidateRect (hWnd=0x30160, lpRect=0x0, bErase=1) returned 1 [0024.728] GetWindowRect (in: hWnd=0x30160, lpRect=0x18febc | out: lpRect=0x18febc) returned 1 [0024.728] GetWindowRect (in: hWnd=0x30160, lpRect=0x18fea0 | out: lpRect=0x18fea0) returned 1 [0024.728] SetWindowPos (hWnd=0x30160, hWndInsertAfter=0x0, X=0, Y=150, cx=132, cy=64, uFlags=0x14) returned 1 [0024.728] GetPropA (hWnd=0x30160, lpString="SELF_") returned 0x1c209f4 [0024.728] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x46, wParam=0x0, lParam=0x18fe4c) returned 0x0 [0024.728] GetPropA (hWnd=0x30160, lpString="SELF_") returned 0x1c209f4 [0024.728] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x24, wParam=0x0, lParam=0x18fb74) returned 0x0 [0024.729] GetPropA (hWnd=0x30160, lpString="SELF_") returned 0x1c209f4 [0024.729] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x47, wParam=0x0, lParam=0x18fe4c) returned 0x0 [0024.729] GetPropA (hWnd=0x30160, lpString="SELF_") returned 0x1c209f4 [0024.729] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x3, wParam=0x0, lParam=0xb40008) returned 0x0 [0024.730] GetPropA (hWnd=0x30160, lpString="SELF_") returned 0x1c209f4 [0024.730] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x83, wParam=0x1, lParam=0x18fa30) returned 0x0 [0024.730] GetWindowRect (in: hWnd=0x30160, lpRect=0x18feb8 | out: lpRect=0x18feb8) returned 1 [0024.730] GetWindowRect (in: hWnd=0x30160, lpRect=0x18fea0 | out: lpRect=0x18fea0) returned 1 [0024.730] SetWindowPos (hWnd=0x30160, hWndInsertAfter=0x0, X=0, Y=0, cx=132, cy=64, uFlags=0x14) returned 1 [0024.730] GetPropA (hWnd=0x30160, lpString="SELF_") returned 0x1c209f4 [0024.730] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x46, wParam=0x0, lParam=0x18fe4c) returned 0x0 [0024.730] GetPropA (hWnd=0x30160, lpString="SELF_") returned 0x1c209f4 [0024.730] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x24, wParam=0x0, lParam=0x18fb74) returned 0x0 [0024.731] GetPropA (hWnd=0x30160, lpString="SELF_") returned 0x1c209f4 [0024.731] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x47, wParam=0x0, lParam=0x18fe4c) returned 0x0 [0024.731] GetPropA (hWnd=0x30160, lpString="SELF_") returned 0x1c209f4 [0024.731] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x3, wParam=0x0, lParam=0x1e0008) returned 0x0 [0024.731] GetWindowRect (in: hWnd=0x30160, lpRect=0x18fecc | out: lpRect=0x18fecc) returned 1 [0024.731] GetWindowRect (in: hWnd=0x30160, lpRect=0x18feb0 | out: lpRect=0x18feb0) returned 1 [0024.731] SetWindowPos (hWnd=0x30160, hWndInsertAfter=0x0, X=0, Y=0, cx=500, cy=242, uFlags=0x14) returned 1 [0024.731] GetPropA (hWnd=0x30160, lpString="SELF_") returned 0x1c209f4 [0024.731] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x46, wParam=0x0, lParam=0x18fe5c) returned 0x0 [0024.731] GetPropA (hWnd=0x30160, lpString="SELF_") returned 0x1c209f4 [0024.731] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x24, wParam=0x0, lParam=0x18fb84) returned 0x0 [0024.731] GetPropA (hWnd=0x30160, lpString="SELF_") returned 0x1c209f4 [0024.731] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x83, wParam=0x1, lParam=0x18fe34) returned 0x0 [0024.732] GetPropA (hWnd=0x30160, lpString="SELF_") returned 0x1c209f4 [0024.732] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x47, wParam=0x0, lParam=0x18fe5c) returned 0x0 [0024.732] GetPropA (hWnd=0x30160, lpString="SELF_") returned 0x1c209f4 [0024.732] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x5, wParam=0x0, lParam=0xcc01e4) returned 0x0 [0024.732] GetPropA (hWnd=0x30160, lpString="SELF_") returned 0x1c209f4 [0024.732] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x83, wParam=0x1, lParam=0x18fa40) returned 0x0 [0024.733] GetWindowLongA (hWnd=0x30160, nIndex=-16) returned 114229248 [0024.733] GetWindowLongA (hWnd=0x30160, nIndex=-20) returned 65792 [0024.733] GetClassLongA (hWnd=0x30160, nIndex=-26) returned 0x8 [0024.733] IsWindowEnabled (hWnd=0x30160) returned 1 [0024.733] LoadCursorA (hInstance=0x0, lpCursorName=0x0) returned 0x0 [0024.733] CreateFontIndirectA (lplf=0x1c2112d) returned 0x90a0873 [0024.733] SendMessageA (hWnd=0x30160, Msg=0x30, wParam=0x90a0873, lParam=0xffff) returned 0x0 [0024.733] GetPropA (hWnd=0x30160, lpString="SELF_") returned 0x1c209f4 [0024.733] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x30, wParam=0x90a0873, lParam=0xffff) returned 0x0 [0024.733] InvalidateRect (hWnd=0x30160, lpRect=0x0, bErase=1) returned 1 [0024.733] GetDC (hWnd=0x0) returned 0x1c010840 [0024.733] GetDeviceCaps (hdc=0x1c010840, index=90) returned 96 [0024.733] ReleaseDC (hWnd=0x0, hDC=0x1c010840) returned 1 [0024.733] CreateFontIndirectA (lplf=0x1c2112d) returned 0x20a0870 [0024.733] SendMessageA (hWnd=0x30160, Msg=0x30, wParam=0x20a0870, lParam=0xffff) returned 0x0 [0024.733] GetPropA (hWnd=0x30160, lpString="SELF_") returned 0x1c209f4 [0024.734] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x30, wParam=0x20a0870, lParam=0xffff) returned 0x0 [0024.734] InvalidateRect (hWnd=0x30160, lpRect=0x0, bErase=1) returned 1 [0024.734] DeleteObject (ho=0x90a0873) returned 1 [0024.734] SendMessageA (hWnd=0x30160, Msg=0x30, wParam=0x20a0870, lParam=0xffff) returned 0x0 [0024.734] GetPropA (hWnd=0x30160, lpString="SELF_") returned 0x1c209f4 [0024.734] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x30, wParam=0x20a0870, lParam=0xffff) returned 0x0 [0024.734] InvalidateRect (hWnd=0x30160, lpRect=0x0, bErase=1) returned 1 [0024.734] SetWindowPos (hWnd=0x30160, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x293) returned 1 [0024.734] GetPropA (hWnd=0x30160, lpString="SELF_") returned 0x1c209f4 [0024.734] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x46, wParam=0x0, lParam=0x18fe98) returned 0x0 [0024.734] ShowWindow (hWnd=0x30160, nCmdShow=0) returned 0 [0024.734] GetClientRect (in: hWnd=0x301e4, lpRect=0x18feb8 | out: lpRect=0x18feb8) returned 1 [0024.734] FindResourceA (hModule=0x400000, lpName="Str1", lpType=0x64) returned 0x41f150 [0024.734] LoadResource (hModule=0x400000, hResInfo=0x41f150) returned 0x41ccc0 [0024.734] LockResource (hResData=0x41ccc0) returned 0x41ccc0 [0024.734] FreeResource (hResData=0x41ccc0) returned 0 [0024.734] ShowWindow (hWnd=0x301e4, nCmdShow=0) returned 0 [0024.734] GetSystemTime (in: lpSystemTime=0x18fe7c | out: lpSystemTime=0x18fe7c*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x3, wDay=0x1, wHour=0x0, wMinute=0x16, wSecond=0x1, wMilliseconds=0x4e)) [0024.734] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0024.734] GetClassInfoA (in: hInstance=0x400000, lpClassName="", lpWndClass=0x18fe60 | out: lpWndClass=0x18fe60) returned 0 [0024.734] GetClassInfoA (in: hInstance=0x400000, lpClassName="obj_", lpWndClass=0x18fdc8 | out: lpWndClass=0x18fdc8) returned 0 [0024.734] RegisterClassA (lpWndClass=0x18fe60) returned 0x3ec13b [0024.734] CreateWindowExA (dwExStyle=0x10000, lpClassName="obj_", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x40120 [0024.734] SetPropA (hWnd=0x40120, lpString="SELF_", hData=0x1c2240c) returned 1 [0024.735] NtdllDefWindowProc_A (hWnd=0x40120, Msg=0x24, wParam=0x0, lParam=0x18fa1c) returned 0x0 [0024.735] GetPropA (hWnd=0x40120, lpString="SELF_") returned 0x1c2240c [0024.735] NtdllDefWindowProc_A (hWnd=0x40120, Msg=0x81, wParam=0x0, lParam=0x18fa10) returned 0x1 [0024.735] GetPropA (hWnd=0x40120, lpString="SELF_") returned 0x1c2240c [0024.735] NtdllDefWindowProc_A (hWnd=0x40120, Msg=0x83, wParam=0x0, lParam=0x18f9fc) returned 0x0 [0024.735] GetPropA (hWnd=0x40120, lpString="SELF_") returned 0x1c2240c [0024.735] NtdllDefWindowProc_A (hWnd=0x40120, Msg=0x1, wParam=0x0, lParam=0x18fa10) returned 0x0 [0024.735] SendMessageA (hWnd=0x40120, Msg=0x128, wParam=0x10002, lParam=0x0) returned 0x0 [0024.735] GetPropA (hWnd=0x40120, lpString="SELF_") returned 0x1c2240c [0024.735] NtdllDefWindowProc_A (hWnd=0x40120, Msg=0x128, wParam=0x10002, lParam=0x0) returned 0x0 [0024.735] GetPropA (hWnd=0x40120, lpString="SELF_") returned 0x1c2240c [0024.735] SetTimer (hWnd=0x40120, nIDEvent=0x1c21d14, uElapse=0x1388, lpTimerFunc=0x408ecc) returned 0x1c21d14 [0024.735] SetTimer (hWnd=0x40120, nIDEvent=0x1c21ddc, uElapse=0x2328, lpTimerFunc=0x408ecc) returned 0x1c21ddc [0024.735] ShowWindow (hWnd=0x30160, nCmdShow=0) returned 0 [0024.735] GetClientRect (in: hWnd=0x301e4, lpRect=0x18ff24 | out: lpRect=0x18ff24) returned 1 [0024.735] WaitMessage () returned 1 [0030.009] PeekMessageA (in: lpMsg=0x18ff34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18ff34) returned 1 [0030.009] TranslateMessage (lpMsg=0x18ff34) returned 0 [0030.009] DispatchMessageA (lpMsg=0x18ff34) returned 0x0 [0030.009] GetSystemTime (in: lpSystemTime=0x18fd94 | out: lpSystemTime=0x18fd94*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x3, wDay=0x1, wHour=0x0, wMinute=0x16, wSecond=0x6, wMilliseconds=0x56)) [0030.009] KillTimer (hWnd=0x40120, uIDEvent=0x1c21d14) returned 1 [0030.010] PeekMessageA (in: lpMsg=0x18ff34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18ff34) returned 0 [0030.010] WaitMessage () returned 1 [0034.003] PeekMessageA (in: lpMsg=0x18ff34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18ff34) returned 1 [0034.003] TranslateMessage (lpMsg=0x18ff34) returned 0 [0034.003] DispatchMessageA (lpMsg=0x18ff34) [0034.003] FindFirstFileA (in: lpFileName="C:\\Users\\*.*", lpFindFileData=0x18fc60 | out: lpFindFileData=0x18fc60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74f56ce9, dwReserved1=0x74f56d91, cFileName=".", cAlternateFileName="")) returned 0x2d9af8 [0034.005] FindNextFileA (in: hFindFile=0x2d9af8, lpFindFileData=0x18fc60 | out: lpFindFileData=0x18fc60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74f56ce9, dwReserved1=0x74f56d91, cFileName="..", cAlternateFileName="")) returned 1 [0034.005] FindNextFileA (in: hFindFile=0x2d9af8, lpFindFileData=0x18fc60 | out: lpFindFileData=0x18fc60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74f56ce9, dwReserved1=0x74f56d91, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 1 [0034.005] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*.*", lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f800, dwReserved1=0x2c019c, cFileName=".", cAlternateFileName="")) returned 0x2dab90 [0034.005] FindNextFileA (in: hFindFile=0x2dab90, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f800, dwReserved1=0x2c019c, cFileName="..", cAlternateFileName="")) returned 1 [0034.005] FindNextFileA (in: hFindFile=0x2dab90, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f800, dwReserved1=0x2c019c, cFileName="AppData", cAlternateFileName="")) returned 1 [0034.005] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dafe8, dwReserved1=0x2c0000, cFileName=".", cAlternateFileName="")) returned 0x2dab40 [0034.006] FindNextFileA (in: hFindFile=0x2dab40, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dafe8, dwReserved1=0x2c0000, cFileName="..", cAlternateFileName="")) returned 1 [0034.006] FindNextFileA (in: hFindFile=0x2dab40, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dafe8, dwReserved1=0x2c0000, cFileName="Local", cAlternateFileName="")) returned 1 [0034.006] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f2a4, dwReserved1=0x77163c74, cFileName=".", cAlternateFileName="")) returned 0x2dcc48 [0034.006] FindNextFileA (in: hFindFile=0x2dcc48, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f2a4, dwReserved1=0x77163c74, cFileName="..", cAlternateFileName="")) returned 1 [0034.006] FindNextFileA (in: hFindFile=0x2dcc48, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f2a4, dwReserved1=0x77163c74, cFileName="Adobe", cAlternateFileName="")) returned 1 [0034.006] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcfe8, dwReserved1=0x2c0000, cFileName=".", cAlternateFileName="")) returned 0x2dcbe0 [0034.006] FindNextFileA (in: hFindFile=0x2dcbe0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcfe8, dwReserved1=0x2c0000, cFileName="..", cAlternateFileName="")) returned 1 [0034.006] FindNextFileA (in: hFindFile=0x2dcbe0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcfe8, dwReserved1=0x2c0000, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0034.006] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x77163c74, cFileName=".", cAlternateFileName="")) returned 0x2ded20 [0034.007] FindNextFileA (in: hFindFile=0x2ded20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x77163c74, cFileName="..", cAlternateFileName="")) returned 1 [0034.007] FindNextFileA (in: hFindFile=0x2ded20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x77163c74, cFileName="10.0", cAlternateFileName="")) returned 1 [0034.007] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2defe8, dwReserved1=0x2c0000, cFileName=".", cAlternateFileName="")) returned 0x2dec98 [0034.008] FindNextFileA (in: hFindFile=0x2dec98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2defe8, dwReserved1=0x2c0000, cFileName="..", cAlternateFileName="")) returned 1 [0034.008] FindNextFileA (in: hFindFile=0x2dec98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x892c, dwReserved0=0x2defe8, dwReserved1=0x2c0000, cFileName="AdobeCMapFnt10.lst", cAlternateFileName="ADOBEC~1.LST")) returned 1 [0034.008] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0034.009] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0034.010] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x892c [0034.010] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0034.011] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0034.057] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x892c, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x892c, lpOverlapped=0x0) returned 1 [0034.059] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x8930, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x8930, lpOverlapped=0x0) returned 1 [0034.061] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0034.082] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0034.092] CloseHandle (hObject=0xe4) returned 1 [0034.092] CloseHandle (hObject=0xe8) returned 1 [0034.094] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst.dvodltmf")) returned 0 [0034.095] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst.dvodltmf")) returned 0x2020 [0034.095] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x892c, dwReserved0=0x2e0e30, dwReserved1=0x18ebec, cFileName="AdobeCMapFnt10.lst", cAlternateFileName="ADOBEC~1.LST")) returned 0x2decd8 [0034.095] FindNextFileA (in: hFindFile=0x2decd8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x892c, dwReserved0=0x2e0e30, dwReserved1=0x18ebec, cFileName="AdobeCMapFnt10.lst", cAlternateFileName="ADOBEC~1.LST")) returned 0 [0034.095] FindClose (in: hFindFile=0x2decd8 | out: hFindFile=0x2decd8) returned 1 [0034.095] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst")) returned 1 [0034.098] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst")) returned 0xffffffff [0034.098] FindNextFileA (in: hFindFile=0x2dec98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xd9c071a0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x21cdb, dwReserved0=0x2e0d68, dwReserved1=0x18eb84, cFileName="AdobeSysFnt10.lst", cAlternateFileName="ADOBES~1.LST")) returned 1 [0034.098] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0034.101] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0034.102] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x21cdb [0034.102] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0034.102] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0034.130] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x21cdb, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x21cdb, lpOverlapped=0x0) returned 1 [0034.133] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x21ce0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x21ce0, lpOverlapped=0x0) returned 1 [0034.136] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0034.136] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0034.137] CloseHandle (hObject=0xe8) returned 1 [0034.137] CloseHandle (hObject=0xe4) returned 1 [0034.139] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst.dvodltmf")) returned 0 [0034.139] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst.dvodltmf")) returned 0x2020 [0034.139] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xd9c071a0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x21cdb, dwReserved0=0x2e0e30, dwReserved1=0x18ebec, cFileName="AdobeSysFnt10.lst", cAlternateFileName="ADOBES~1.LST")) returned 0x2decd8 [0034.139] FindNextFileA (in: hFindFile=0x2decd8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xd9c071a0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x21cdb, dwReserved0=0x2e0e30, dwReserved1=0x18ebec, cFileName="AdobeSysFnt10.lst", cAlternateFileName="ADOBES~1.LST")) returned 0 [0034.139] FindClose (in: hFindFile=0x2decd8 | out: hFindFile=0x2decd8) returned 1 [0034.139] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst")) returned 1 [0034.141] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst")) returned 0xffffffff [0034.141] FindNextFileA (in: hFindFile=0x2dec98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0d68, dwReserved1=0x18eb84, cFileName="Cache", cAlternateFileName="")) returned 1 [0034.141] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2decd8 [0034.141] FindNextFileA (in: hFindFile=0x2decd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.141] FindNextFileA (in: hFindFile=0x2decd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="AcroFnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 1 [0034.141] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0034.142] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0034.142] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcfc4 [0034.142] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0034.142] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0034.168] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xcfc4, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0xcfc4, lpOverlapped=0x0) returned 1 [0034.171] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xcfd0, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0xcfd0, lpOverlapped=0x0) returned 1 [0034.172] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0034.173] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0034.173] CloseHandle (hObject=0xe8) returned 1 [0034.173] CloseHandle (hObject=0xec) returned 1 [0034.174] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst.dvodltmf")) returned 0 [0034.175] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst.dvodltmf")) returned 0x2020 [0034.175] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0x2e1e38, dwReserved1=0x18e984, cFileName="AcroFnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 0x2e1e28 [0034.175] FindNextFileA (in: hFindFile=0x2e1e28, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0x2e1e38, dwReserved1=0x18e984, cFileName="AcroFnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 0 [0034.175] FindClose (in: hFindFile=0x2e1e28 | out: hFindFile=0x2e1e28) returned 1 [0034.175] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst")) returned 1 [0034.176] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst")) returned 0xffffffff [0034.176] FindNextFileA (in: hFindFile=0x2decd8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="AcroFnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 0 [0034.176] FindClose (in: hFindFile=0x2decd8 | out: hFindFile=0x2decd8) returned 1 [0034.176] FindNextFileA (in: hFindFile=0x2dec98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xee0c3750, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x2e7473, dwReserved1=0x18eb84, cFileName="SharedDataEvents", cAlternateFileName="SHARED~1")) returned 1 [0034.176] FindNextFileA (in: hFindFile=0x2dec98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x2e7473, dwReserved1=0x18eb84, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 1 [0034.176] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\usercache.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0034.177] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\usercache.bin.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0034.177] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12ea5 [0034.177] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0034.177] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0034.203] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x12ea5, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x12ea5, lpOverlapped=0x0) returned 1 [0034.206] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x12eb0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x12eb0, lpOverlapped=0x0) returned 1 [0034.208] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0034.209] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0034.209] CloseHandle (hObject=0xe4) returned 1 [0034.209] CloseHandle (hObject=0xec) returned 1 [0034.211] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\usercache.bin"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\usercache.bin.dvodltmf")) returned 0 [0034.211] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\usercache.bin.dvodltmf")) returned 0x2020 [0034.211] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x2e0e28, dwReserved1=0x18ebec, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 0x2decd8 [0034.211] FindNextFileA (in: hFindFile=0x2decd8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x2e0e28, dwReserved1=0x18ebec, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 0 [0034.211] FindClose (in: hFindFile=0x2decd8 | out: hFindFile=0x2decd8) returned 1 [0034.211] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\usercache.bin")) returned 1 [0034.213] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\usercache.bin")) returned 0xffffffff [0034.213] FindNextFileA (in: hFindFile=0x2dec98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x2e7473, dwReserved1=0x18eb84, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 0 [0034.213] FindClose (in: hFindFile=0x2dec98 | out: hFindFile=0x2dec98) returned 1 [0034.213] FindNextFileA (in: hFindFile=0x2ded20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x77163c74, cFileName="10.0", cAlternateFileName="")) returned 0 [0034.213] FindClose (in: hFindFile=0x2ded20 | out: hFindFile=0x2ded20) returned 1 [0034.213] FindNextFileA (in: hFindFile=0x2dcbe0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcfe8, dwReserved1=0x2c0000, cFileName="Color", cAlternateFileName="")) returned 1 [0034.213] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e6e69, dwReserved1=0x77747473, cFileName=".", cAlternateFileName="")) returned 0x2dec98 [0034.213] FindNextFileA (in: hFindFile=0x2dec98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e6e69, dwReserved1=0x77747473, cFileName="..", cAlternateFileName="")) returned 1 [0034.213] FindNextFileA (in: hFindFile=0x2dec98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce719dc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x49c, dwReserved0=0x746e6e69, dwReserved1=0x77747473, cFileName="ACECache11.lst", cAlternateFileName="ACECAC~1.LST")) returned 1 [0034.213] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0034.213] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0034.214] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x49c [0034.214] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0034.214] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0034.513] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x49c, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x49c, lpOverlapped=0x0) returned 1 [0034.515] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x4a0, lpOverlapped=0x0) returned 1 [0034.516] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0034.517] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0034.517] CloseHandle (hObject=0xe0) returned 1 [0034.517] CloseHandle (hObject=0xec) returned 1 [0034.518] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst.dvodltmf")) returned 0 [0034.518] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst.dvodltmf")) returned 0x2020 [0034.518] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce719dc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x49c, dwReserved0=0x2dfd88, dwReserved1=0x18ee54, cFileName="ACECache11.lst", cAlternateFileName="ACECAC~1.LST")) returned 0x2dfd78 [0034.518] FindNextFileA (in: hFindFile=0x2dfd78, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce719dc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x49c, dwReserved0=0x2dfd88, dwReserved1=0x18ee54, cFileName="ACECache11.lst", cAlternateFileName="ACECAC~1.LST")) returned 0 [0034.519] FindClose (in: hFindFile=0x2dfd78 | out: hFindFile=0x2dfd78) returned 1 [0034.519] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst")) returned 1 [0034.520] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst")) returned 0xffffffff [0034.520] FindNextFileA (in: hFindFile=0x2dec98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dfcd8, dwReserved1=0x18edec, cFileName="Profiles", cAlternateFileName="")) returned 1 [0034.520] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2dfd78 [0034.521] FindNextFileA (in: hFindFile=0x2dfd78, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.521] FindNextFileA (in: hFindFile=0x2dfd78, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x102a0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="wscRGB.icc", cAlternateFileName="")) returned 1 [0034.521] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0034.521] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0034.521] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x102a0 [0034.521] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0034.521] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0034.573] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x102a0, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x102a0, lpOverlapped=0x0) returned 1 [0034.575] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x102b0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x102b0, lpOverlapped=0x0) returned 1 [0034.577] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0034.578] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0034.578] CloseHandle (hObject=0xe0) returned 1 [0034.578] CloseHandle (hObject=0xe4) returned 1 [0034.581] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc.dvodltmf")) returned 0 [0034.582] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc.dvodltmf")) returned 0x2020 [0034.582] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x102a0, dwReserved0=0x2e1490, dwReserved1=0x18ebec, cFileName="wscRGB.icc", cAlternateFileName="")) returned 0x2dfd18 [0034.582] FindNextFileA (in: hFindFile=0x2dfd18, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x102a0, dwReserved0=0x2e1490, dwReserved1=0x18ebec, cFileName="wscRGB.icc", cAlternateFileName="")) returned 0 [0034.582] FindClose (in: hFindFile=0x2dfd18 | out: hFindFile=0x2dfd18) returned 1 [0034.582] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc")) returned 1 [0034.583] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc")) returned 0xffffffff [0034.583] FindNextFileA (in: hFindFile=0x2dfd78, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="wsRGB.icc", cAlternateFileName="")) returned 1 [0034.583] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0034.584] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0034.584] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa74 [0034.584] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0034.584] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0034.611] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa74, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xa74, lpOverlapped=0x0) returned 1 [0034.612] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xa80, lpOverlapped=0x0) returned 1 [0034.613] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0034.614] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0034.614] CloseHandle (hObject=0xe4) returned 1 [0034.614] CloseHandle (hObject=0xe0) returned 1 [0034.616] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc.dvodltmf")) returned 0 [0034.616] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc.dvodltmf")) returned 0x2020 [0034.616] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x2e1488, dwReserved1=0x18ebec, cFileName="wsRGB.icc", cAlternateFileName="")) returned 0x2dfd18 [0034.616] FindNextFileA (in: hFindFile=0x2dfd18, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x2e1488, dwReserved1=0x18ebec, cFileName="wsRGB.icc", cAlternateFileName="")) returned 0 [0034.616] FindClose (in: hFindFile=0x2dfd18 | out: hFindFile=0x2dfd18) returned 1 [0034.616] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc")) returned 1 [0034.617] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc")) returned 0xffffffff [0034.617] FindNextFileA (in: hFindFile=0x2dfd78, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="wsRGB.icc", cAlternateFileName="")) returned 0 [0034.617] FindClose (in: hFindFile=0x2dfd78 | out: hFindFile=0x2dfd78) returned 1 [0034.617] FindNextFileA (in: hFindFile=0x2dec98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dfcd8, dwReserved1=0x18edec, cFileName="Profiles", cAlternateFileName="")) returned 0 [0034.617] FindClose (in: hFindFile=0x2dec98 | out: hFindFile=0x2dec98) returned 1 [0034.617] FindNextFileA (in: hFindFile=0x2dcbe0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcfe8, dwReserved1=0x2c0000, cFileName="Color", cAlternateFileName="")) returned 0 [0034.617] FindClose (in: hFindFile=0x2dcbe0 | out: hFindFile=0x2dcbe0) returned 1 [0034.617] FindNextFileA (in: hFindFile=0x2dcc48, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77163c74, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0034.617] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcfe8, dwReserved1=0x2c0000, cFileName="Color", cAlternateFileName="HÌ-")) returned 0xffffffff [0034.618] FindNextFileA (in: hFindFile=0x2dcc48, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77163c74, cFileName="Apps", cAlternateFileName="")) returned 1 [0034.618] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74736c, dwReserved1=0x2c0000, cFileName=".", cAlternateFileName="")) returned 0x2dcbe0 [0034.618] FindNextFileA (in: hFindFile=0x2dcbe0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74736c, dwReserved1=0x2c0000, cFileName="..", cAlternateFileName="")) returned 1 [0034.618] FindNextFileA (in: hFindFile=0x2dcbe0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74736c, dwReserved1=0x2c0000, cFileName="2.0", cAlternateFileName="")) returned 1 [0034.618] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dfcd8, dwReserved1=0x18edec, cFileName=".", cAlternateFileName="")) returned 0x2e0d20 [0034.619] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dfcd8, dwReserved1=0x18edec, cFileName="..", cAlternateFileName="")) returned 1 [0034.619] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dfcd8, dwReserved1=0x18edec, cFileName="Data", cAlternateFileName="")) returned 1 [0034.619] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x77163c74, cFileName=".", cAlternateFileName="")) returned 0x2e0d60 [0034.619] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x77163c74, cFileName="..", cAlternateFileName="")) returned 1 [0034.619] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x77163c74, cFileName="CJW3O3KP.BX7", cAlternateFileName="")) returned 1 [0034.620] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x77163c74, cFileName=".", cAlternateFileName="")) returned 0x2e2480 [0034.620] FindNextFileA (in: hFindFile=0x2e2480, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x77163c74, cFileName="..", cAlternateFileName="")) returned 1 [0034.620] FindNextFileA (in: hFindFile=0x2e2480, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x77163c74, cFileName="6NG60CXZ.9GJ", cAlternateFileName="")) returned 1 [0034.620] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e69c, dwReserved1=0x77163c74, cFileName=".", cAlternateFileName="")) returned 0x2dfca0 [0034.620] FindNextFileA (in: hFindFile=0x2dfca0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e69c, dwReserved1=0x77163c74, cFileName="..", cAlternateFileName="")) returned 1 [0034.620] FindNextFileA (in: hFindFile=0x2dfca0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e69c, dwReserved1=0x77163c74, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 1 [0034.620] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e2fe8, dwReserved1=0x2c0000, cFileName=".", cAlternateFileName="")) returned 0x2e23e0 [0034.621] FindNextFileA (in: hFindFile=0x2e23e0, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e2fe8, dwReserved1=0x2c0000, cFileName="..", cAlternateFileName="")) returned 1 [0034.621] FindNextFileA (in: hFindFile=0x2e23e0, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e2fe8, dwReserved1=0x2c0000, cFileName="Data", cAlternateFileName="")) returned 1 [0034.621] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e1cc, dwReserved1=0x77163c74, cFileName=".", cAlternateFileName="")) returned 0x2e2420 [0034.621] FindNextFileA (in: hFindFile=0x2e2420, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e1cc, dwReserved1=0x77163c74, cFileName="..", cAlternateFileName="")) returned 1 [0034.621] FindNextFileA (in: hFindFile=0x2e2420, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e1cc, dwReserved1=0x77163c74, cFileName="..", cAlternateFileName="")) returned 0 [0034.621] FindClose (in: hFindFile=0x2e2420 | out: hFindFile=0x2e2420) returned 1 [0034.621] FindNextFileA (in: hFindFile=0x2e23e0, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e2fe8, dwReserved1=0x2c0000, cFileName="Data", cAlternateFileName="")) returned 0 [0034.621] FindClose (in: hFindFile=0x2e23e0 | out: hFindFile=0x2e23e0) returned 1 [0034.622] FindNextFileA (in: hFindFile=0x2dfca0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e69c, dwReserved1=0x77163c74, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 0 [0034.622] FindClose (in: hFindFile=0x2dfca0 | out: hFindFile=0x2dfca0) returned 1 [0034.622] FindNextFileA (in: hFindFile=0x2e2480, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x77163c74, cFileName="6NG60CXZ.9GJ", cAlternateFileName="")) returned 0 [0034.622] FindClose (in: hFindFile=0x2e2480 | out: hFindFile=0x2e2480) returned 1 [0034.622] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x77163c74, cFileName="CJW3O3KP.BX7", cAlternateFileName="")) returned 0 [0034.622] FindClose (in: hFindFile=0x2e0d60 | out: hFindFile=0x2e0d60) returned 1 [0034.622] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dfc37, dwReserved1=0x18edec, cFileName="DQQ19BCJ.JAX", cAlternateFileName="")) returned 1 [0034.622] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb4a, dwReserved1=0x77163c74, cFileName=".", cAlternateFileName="")) returned 0x2e0d60 [0034.622] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb4a, dwReserved1=0x77163c74, cFileName="..", cAlternateFileName="")) returned 1 [0034.622] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb4a, dwReserved1=0x77163c74, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 1 [0034.622] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38616162, dwReserved1=0x61333130, cFileName=".", cAlternateFileName="")) returned 0x2ded48 [0034.623] FindNextFileA (in: hFindFile=0x2ded48, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38616162, dwReserved1=0x61333130, cFileName="..", cAlternateFileName="")) returned 1 [0034.624] FindNextFileA (in: hFindFile=0x2ded48, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38616162, dwReserved1=0x61333130, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715", cAlternateFileName="CLICEX~1.000")) returned 1 [0034.624] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e69c, dwReserved1=0x77163c74, cFileName=".", cAlternateFileName="")) returned 0x2dec98 [0034.624] FindNextFileA (in: hFindFile=0x2dec98, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e69c, dwReserved1=0x77163c74, cFileName="..", cAlternateFileName="")) returned 1 [0034.624] FindNextFileA (in: hFindFile=0x2dec98, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x18e69c, dwReserved1=0x77163c74, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="GOOGLE~1.EXE")) returned 1 [0034.624] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\googleupdatesetup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0034.625] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\googleupdatesetup.exe.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0034.628] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x113f58 [0034.628] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0034.628] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0034.655] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x113f58, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x113f58, lpOverlapped=0x0) returned 1 [0034.678] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x113f60, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x113f60, lpOverlapped=0x0) returned 1 [0034.699] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0034.700] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0034.700] CloseHandle (hObject=0xe8) returned 1 [0034.700] CloseHandle (hObject=0xf0) returned 1 [0034.712] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\googleupdatesetup.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\googleupdatesetup.exe.dvodltmf")) returned 0 [0034.713] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\googleupdatesetup.exe.dvodltmf")) returned 0x2020 [0034.713] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x2deee8, dwReserved1=0x18e71c, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="GOOGLE~1.EXE")) returned 0x2decd8 [0034.713] FindNextFileA (in: hFindFile=0x2decd8, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x2deee8, dwReserved1=0x18e71c, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="GOOGLE~1.EXE")) returned 0 [0034.713] FindClose (in: hFindFile=0x2decd8 | out: hFindFile=0x2decd8) returned 1 [0034.713] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\googleupdatesetup.exe")) returned 1 [0034.713] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\googleupdatesetup.exe")) returned 0xffffffff [0034.713] FindNextFileA (in: hFindFile=0x2dec98, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x18e69c, dwReserved1=0x77163c74, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="GOOGLE~1.EXE")) returned 0 [0034.713] FindClose (in: hFindFile=0x2dec98 | out: hFindFile=0x2dec98) returned 1 [0034.713] FindNextFileA (in: hFindFile=0x2ded48, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74655365, dwReserved1=0x652e7075, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 1 [0034.713] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded80, dwReserved1=0x18e6b4, cFileName=".", cAlternateFileName="")) returned 0x2dec98 [0034.715] FindNextFileA (in: hFindFile=0x2dec98, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded80, dwReserved1=0x18e6b4, cFileName="..", cAlternateFileName="")) returned 1 [0034.715] FindNextFileA (in: hFindFile=0x2dec98, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a307ea0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3c50, dwReserved0=0x2ded80, dwReserved1=0x18e6b4, cFileName="clickonce_bootstrap.exe", cAlternateFileName="CLICKO~1.EXE")) returned 1 [0034.716] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0034.716] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0034.716] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3c50 [0034.716] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0034.716] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0034.744] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3c50, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x3c50, lpOverlapped=0x0) returned 1 [0034.746] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3c60, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x3c60, lpOverlapped=0x0) returned 1 [0034.747] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0034.747] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0034.748] CloseHandle (hObject=0xf0) returned 1 [0034.748] CloseHandle (hObject=0xe8) returned 1 [0034.749] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.dvodltmf")) returned 0 [0034.749] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.dvodltmf")) returned 0x2020 [0034.749] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a307ea0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3c50, dwReserved0=0x2deee0, dwReserved1=0x18e71c, cFileName="clickonce_bootstrap.exe", cAlternateFileName="CLICKO~1.EXE")) returned 0x2decd8 [0034.749] FindNextFileA (in: hFindFile=0x2decd8, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a307ea0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3c50, dwReserved0=0x2deee0, dwReserved1=0x18e71c, cFileName="clickonce_bootstrap.exe", cAlternateFileName="CLICKO~1.EXE")) returned 0 [0034.749] FindClose (in: hFindFile=0x2decd8 | out: hFindFile=0x2decd8) returned 1 [0034.749] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe")) returned 1 [0034.750] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe")) returned 0xffffffff [0034.750] FindNextFileA (in: hFindFile=0x2dec98, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x42d0, dwReserved0=0x2ded80, dwReserved1=0x18e6b4, cFileName="clickonce_bootstrap.exe.cdf-ms", cAlternateFileName="")) returned 1 [0034.750] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0034.751] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0034.751] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x42d0 [0034.751] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0034.751] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0034.790] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x42d0, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x42d0, lpOverlapped=0x0) returned 1 [0034.792] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x42e0, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x42e0, lpOverlapped=0x0) returned 1 [0034.794] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0034.794] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0034.794] CloseHandle (hObject=0xe8) returned 1 [0034.795] CloseHandle (hObject=0xf0) returned 1 [0034.796] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms.dvodltmf")) returned 0 [0034.796] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms.dvodltmf")) returned 0x2020 [0034.797] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x42d0, dwReserved0=0x2deef0, dwReserved1=0x18e71c, cFileName="clickonce_bootstrap.exe.cdf-ms", cAlternateFileName="")) returned 0x2decd8 [0034.797] FindNextFileA (in: hFindFile=0x2decd8, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x42d0, dwReserved0=0x2deef0, dwReserved1=0x18e71c, cFileName="clickonce_bootstrap.exe.cdf-ms", cAlternateFileName="")) returned 0 [0034.797] FindClose (in: hFindFile=0x2decd8 | out: hFindFile=0x2decd8) returned 1 [0034.797] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms")) returned 1 [0034.797] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms")) returned 0xffffffff [0034.797] FindNextFileA (in: hFindFile=0x2dec98, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x354b, dwReserved0=0x2ded80, dwReserved1=0x18e6b4, cFileName="clickonce_bootstrap.exe.manifest", cAlternateFileName="")) returned 1 [0034.797] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0034.798] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0034.798] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x354b [0034.799] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0034.799] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0034.850] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x354b, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x354b, lpOverlapped=0x0) returned 1 [0034.851] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3550, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x3550, lpOverlapped=0x0) returned 1 [0034.853] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0034.853] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0034.853] CloseHandle (hObject=0xf0) returned 1 [0034.853] CloseHandle (hObject=0xe8) returned 1 [0034.856] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest.dvodltmf")) returned 0 [0034.856] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest.dvodltmf")) returned 0x2020 [0034.856] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x354b, dwReserved0=0x2deef0, dwReserved1=0x18e71c, cFileName="clickonce_bootstrap.exe.manifest", cAlternateFileName="")) returned 0x2decd8 [0034.856] FindNextFileA (in: hFindFile=0x2decd8, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x354b, dwReserved0=0x2deef0, dwReserved1=0x18e71c, cFileName="clickonce_bootstrap.exe.manifest", cAlternateFileName="")) returned 0 [0034.856] FindClose (in: hFindFile=0x2decd8 | out: hFindFile=0x2decd8) returned 1 [0034.856] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest")) returned 1 [0034.857] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest")) returned 0xffffffff [0034.857] FindNextFileA (in: hFindFile=0x2dec98, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee0, dwReserved0=0x2ded80, dwReserved1=0x18e6b4, cFileName="clickonce_bootstrap_unsigned.cdf-ms", cAlternateFileName="CLICKO~1.CDF")) returned 1 [0034.857] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0034.857] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0034.857] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xee0 [0034.857] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0034.858] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0034.885] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xee0, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0xee0, lpOverlapped=0x0) returned 1 [0034.887] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xef0, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0xef0, lpOverlapped=0x0) returned 1 [0034.888] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0034.888] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0034.888] CloseHandle (hObject=0xe8) returned 1 [0034.888] CloseHandle (hObject=0xf0) returned 1 [0034.890] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms.dvodltmf")) returned 0 [0034.891] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms.dvodltmf")) returned 0x2020 [0034.891] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee0, dwReserved0=0x2deef8, dwReserved1=0x18e71c, cFileName="clickonce_bootstrap_unsigned.cdf-ms", cAlternateFileName="CLICKO~1.CDF")) returned 0x2decd8 [0034.891] FindNextFileA (in: hFindFile=0x2decd8, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee0, dwReserved0=0x2deef8, dwReserved1=0x18e71c, cFileName="clickonce_bootstrap_unsigned.cdf-ms", cAlternateFileName="CLICKO~1.CDF")) returned 0 [0034.891] FindClose (in: hFindFile=0x2decd8 | out: hFindFile=0x2decd8) returned 1 [0034.891] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms")) returned 1 [0034.892] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms")) returned 0xffffffff [0034.892] FindNextFileA (in: hFindFile=0x2dec98, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x560, dwReserved0=0x2ded80, dwReserved1=0x18e6b4, cFileName="clickonce_bootstrap_unsigned.manifest", cAlternateFileName="CLICKO~1.MAN")) returned 1 [0034.892] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0034.892] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0034.893] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x560 [0034.893] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0034.893] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0034.921] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x560, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x560, lpOverlapped=0x0) returned 1 [0034.923] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x570, lpOverlapped=0x0) returned 1 [0034.924] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0034.924] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0034.924] CloseHandle (hObject=0xf0) returned 1 [0034.924] CloseHandle (hObject=0xe8) returned 1 [0034.926] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest.dvodltmf")) returned 0 [0034.926] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest.dvodltmf")) returned 0x2020 [0034.926] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x560, dwReserved0=0x2def00, dwReserved1=0x18e71c, cFileName="clickonce_bootstrap_unsigned.manifest", cAlternateFileName="CLICKO~1.MAN")) returned 0x2decd8 [0034.926] FindNextFileA (in: hFindFile=0x2decd8, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x560, dwReserved0=0x2def00, dwReserved1=0x18e71c, cFileName="clickonce_bootstrap_unsigned.manifest", cAlternateFileName="CLICKO~1.MAN")) returned 0 [0034.926] FindClose (in: hFindFile=0x2decd8 | out: hFindFile=0x2decd8) returned 1 [0034.926] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest")) returned 1 [0034.927] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest")) returned 0xffffffff [0034.927] FindNextFileA (in: hFindFile=0x2dec98, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x2ded80, dwReserved1=0x18e6b4, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="")) returned 1 [0034.927] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\googleupdatesetup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0034.927] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\googleupdatesetup.exe.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0034.928] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x113f58 [0034.928] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0034.928] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0034.956] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x113f58, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x113f58, lpOverlapped=0x0) returned 1 [0034.968] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x113f60, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x113f60, lpOverlapped=0x0) returned 1 [0034.987] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0034.988] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0034.988] CloseHandle (hObject=0xe8) returned 1 [0034.988] CloseHandle (hObject=0xf0) returned 1 [0034.999] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\googleupdatesetup.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\googleupdatesetup.exe.dvodltmf")) returned 0 [0034.999] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\googleupdatesetup.exe.dvodltmf")) returned 0x2020 [0035.000] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x2deee0, dwReserved1=0x18e71c, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="")) returned 0x2decd8 [0035.000] FindNextFileA (in: hFindFile=0x2decd8, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x2deee0, dwReserved1=0x18e71c, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="")) returned 0 [0035.000] FindClose (in: hFindFile=0x2decd8 | out: hFindFile=0x2decd8) returned 1 [0035.000] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\googleupdatesetup.exe")) returned 1 [0035.009] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\googleupdatesetup.exe")) returned 0xffffffff [0035.009] FindNextFileA (in: hFindFile=0x2dec98, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x2ded80, dwReserved1=0x18e6b4, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="")) returned 0 [0035.009] FindClose (in: hFindFile=0x2dec98 | out: hFindFile=0x2dec98) returned 1 [0035.009] FindNextFileA (in: hFindFile=0x2ded48, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74655365, dwReserved1=0x652e7075, cFileName="manifests", cAlternateFileName="MANIFE~1")) returned 1 [0035.009] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded80, dwReserved1=0x18e6b4, cFileName=".", cAlternateFileName="")) returned 0x2dec98 [0035.011] FindNextFileA (in: hFindFile=0x2dec98, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded80, dwReserved1=0x18e6b4, cFileName="..", cAlternateFileName="")) returned 1 [0035.011] FindNextFileA (in: hFindFile=0x2dec98, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x42d0, dwReserved0=0x2ded80, dwReserved1=0x18e6b4, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms", cAlternateFileName="CLICEX~1.CDF")) returned 1 [0035.011] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0035.011] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0035.012] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x42d0 [0035.012] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0035.012] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0035.040] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x42d0, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x42d0, lpOverlapped=0x0) returned 1 [0035.040] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x42e0, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x42e0, lpOverlapped=0x0) returned 1 [0035.041] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0035.042] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0035.042] CloseHandle (hObject=0xf0) returned 1 [0035.042] CloseHandle (hObject=0xe8) returned 1 [0035.043] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms.dvodltmf")) returned 0 [0035.043] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms.dvodltmf")) returned 0x2020 [0035.043] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x42d0, dwReserved0=0x2deee0, dwReserved1=0x18e71c, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms", cAlternateFileName="CLICEX~1.CDF")) returned 0x2decd8 [0035.043] FindNextFileA (in: hFindFile=0x2decd8, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x42d0, dwReserved0=0x2deee0, dwReserved1=0x18e71c, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms", cAlternateFileName="CLICEX~1.CDF")) returned 0 [0035.043] FindClose (in: hFindFile=0x2decd8 | out: hFindFile=0x2decd8) returned 1 [0035.044] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms")) returned 1 [0035.044] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms")) returned 0xffffffff [0035.045] FindNextFileA (in: hFindFile=0x2dec98, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x354b, dwReserved0=0x2ded80, dwReserved1=0x18e6b4, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest", cAlternateFileName="CLICEX~1.MAN")) returned 1 [0035.045] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0035.045] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0035.045] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x354b [0035.045] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0035.045] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0035.072] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x354b, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x354b, lpOverlapped=0x0) returned 1 [0035.072] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3550, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x3550, lpOverlapped=0x0) returned 1 [0035.073] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0035.074] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0035.074] CloseHandle (hObject=0xe8) returned 1 [0035.074] CloseHandle (hObject=0xf0) returned 1 [0035.075] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest.dvodltmf")) returned 0 [0035.075] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest.dvodltmf")) returned 0x2020 [0035.075] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x354b, dwReserved0=0x2deee0, dwReserved1=0x18e71c, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest", cAlternateFileName="CLICEX~1.MAN")) returned 0x2decd8 [0035.076] FindNextFileA (in: hFindFile=0x2decd8, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x354b, dwReserved0=0x2deee0, dwReserved1=0x18e71c, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest", cAlternateFileName="CLICEX~1.MAN")) returned 0 [0035.076] FindClose (in: hFindFile=0x2decd8 | out: hFindFile=0x2decd8) returned 1 [0035.076] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest")) returned 1 [0035.077] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest")) returned 0xffffffff [0035.077] FindNextFileA (in: hFindFile=0x2dec98, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x2ded80, dwReserved1=0x18e6b4, cFileName="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms", cAlternateFileName="GOOGAP~1.CDF")) returned 1 [0035.077] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0035.078] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0035.078] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x38b0 [0035.078] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0035.078] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0035.106] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x38b0, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x38b0, lpOverlapped=0x0) returned 1 [0035.107] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x38c0, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x38c0, lpOverlapped=0x0) returned 1 [0035.108] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0035.109] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0035.109] CloseHandle (hObject=0xf0) returned 1 [0035.109] CloseHandle (hObject=0xe8) returned 1 [0035.110] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms.dvodltmf")) returned 0 [0035.111] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms.dvodltmf")) returned 0x2020 [0035.111] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x2deee0, dwReserved1=0x18e71c, cFileName="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms", cAlternateFileName="GOOGAP~1.CDF")) returned 0x2decd8 [0035.111] FindNextFileA (in: hFindFile=0x2decd8, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x2deee0, dwReserved1=0x18e71c, cFileName="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms", cAlternateFileName="GOOGAP~1.CDF")) returned 0 [0035.111] FindClose (in: hFindFile=0x2decd8 | out: hFindFile=0x2decd8) returned 1 [0035.111] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms")) returned 1 [0035.112] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms")) returned 0xffffffff [0035.112] FindNextFileA (in: hFindFile=0x2dec98, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2e30, dwReserved0=0x2ded80, dwReserved1=0x18e6b4, cFileName="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest", cAlternateFileName="GOOGAP~1.MAN")) returned 1 [0035.112] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0035.112] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0035.113] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2e30 [0035.113] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0035.113] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0035.139] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2e30, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x2e30, lpOverlapped=0x0) returned 1 [0035.141] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2e40, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x2e40, lpOverlapped=0x0) returned 1 [0035.142] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0035.142] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0035.143] CloseHandle (hObject=0xe8) returned 1 [0035.143] CloseHandle (hObject=0xf0) returned 1 [0035.144] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest.dvodltmf")) returned 0 [0035.144] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest.dvodltmf")) returned 0x2020 [0035.144] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2e30, dwReserved0=0x2deee0, dwReserved1=0x18e71c, cFileName="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest", cAlternateFileName="GOOGAP~1.MAN")) returned 0x2decd8 [0035.144] FindNextFileA (in: hFindFile=0x2decd8, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2e30, dwReserved0=0x2deee0, dwReserved1=0x18e71c, cFileName="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest", cAlternateFileName="GOOGAP~1.MAN")) returned 0 [0035.144] FindClose (in: hFindFile=0x2decd8 | out: hFindFile=0x2decd8) returned 1 [0035.144] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest")) returned 1 [0035.145] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest")) returned 0xffffffff [0035.145] FindNextFileA (in: hFindFile=0x2dec98, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2e30, dwReserved0=0x2ded80, dwReserved1=0x18e6b4, cFileName="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest", cAlternateFileName="GOOGAP~1.MAN")) returned 0 [0035.145] FindClose (in: hFindFile=0x2dec98 | out: hFindFile=0x2dec98) returned 1 [0035.145] FindNextFileA (in: hFindFile=0x2ded48, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74655365, dwReserved1=0x652e7075, cFileName="manifests", cAlternateFileName="MANIFE~1")) returned 0 [0035.145] FindClose (in: hFindFile=0x2ded48 | out: hFindFile=0x2ded48) returned 1 [0035.145] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb4a, dwReserved1=0x77163c74, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 0 [0035.145] FindClose (in: hFindFile=0x2e0d60 | out: hFindFile=0x2e0d60) returned 1 [0035.145] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dfc37, dwReserved1=0x18edec, cFileName="DQQ19BCJ.JAX", cAlternateFileName="")) returned 0 [0035.146] FindClose (in: hFindFile=0x2e0d20 | out: hFindFile=0x2e0d20) returned 1 [0035.146] FindNextFileA (in: hFindFile=0x2dcbe0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74736c, dwReserved1=0x2c0000, cFileName="2.0", cAlternateFileName="")) returned 0 [0035.146] FindClose (in: hFindFile=0x2dcbe0 | out: hFindFile=0x2dcbe0) returned 1 [0035.146] FindNextFileA (in: hFindFile=0x2dcc48, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x77163c74, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1 [0035.146] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x747358, dwReserved1=0x2c0000, cFileName=".", cAlternateFileName="")) returned 0x2dcbe0 [0035.146] FindNextFileA (in: hFindFile=0x2dcbe0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x747358, dwReserved1=0x2c0000, cFileName="..", cAlternateFileName="")) returned 1 [0035.146] FindNextFileA (in: hFindFile=0x2dcbe0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x747358, dwReserved1=0x2c0000, cFileName="..", cAlternateFileName="")) returned 0 [0035.146] FindClose (in: hFindFile=0x2dcbe0 | out: hFindFile=0x2dcbe0) returned 1 [0035.146] FindNextFileA (in: hFindFile=0x2dcc48, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66051ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x66051ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9791f220, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x1a918, dwReserved0=0xa0000003, dwReserved1=0x77163c74, cFileName="GDIPFONTCACHEV1.DAT", cAlternateFileName="GDIPFO~1.DAT")) returned 1 [0035.146] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\gdipfontcachev1.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0035.147] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\gdipfontcachev1.dat.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0035.147] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a918 [0035.147] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0035.147] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0035.181] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1a918, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x1a918, lpOverlapped=0x0) returned 1 [0035.183] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1a920, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x1a920, lpOverlapped=0x0) returned 1 [0035.185] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0035.186] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0035.186] CloseHandle (hObject=0xd8) returned 1 [0035.186] CloseHandle (hObject=0xdc) returned 1 [0035.188] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\gdipfontcachev1.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\gdipfontcachev1.dat.dvodltmf")) returned 0 [0035.188] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\gdipfontcachev1.dat.dvodltmf")) returned 0x2020 [0035.188] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66051ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x66051ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9791f220, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x1a918, dwReserved0=0x2dfdb8, dwReserved1=0x18f324, cFileName="GDIPFONTCACHEV1.DAT", cAlternateFileName="GDIPFO~1.DAT")) returned 0x2dcbe0 [0035.188] FindNextFileA (in: hFindFile=0x2dcbe0, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66051ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x66051ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9791f220, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x1a918, dwReserved0=0x2dfdb8, dwReserved1=0x18f324, cFileName="GDIPFONTCACHEV1.DAT", cAlternateFileName="GDIPFO~1.DAT")) returned 0 [0035.188] FindClose (in: hFindFile=0x2dcbe0 | out: hFindFile=0x2dcbe0) returned 1 [0035.188] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\gdipfontcachev1.dat")) returned 1 [0035.190] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\gdipfontcachev1.dat")) returned 0xffffffff [0035.190] FindNextFileA (in: hFindFile=0x2dcc48, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dfd10, dwReserved1=0x18f2bc, cFileName="Google", cAlternateFileName="")) returned 1 [0035.190] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2dcbe0 [0035.190] FindNextFileA (in: hFindFile=0x2dcbe0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.190] FindNextFileA (in: hFindFile=0x2dcbe0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="Chrome", cAlternateFileName="")) returned 1 [0035.190] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x310056, dwReserved1=0x44002e, cFileName=".", cAlternateFileName="")) returned 0x2ddc90 [0035.191] FindNextFileA (in: hFindFile=0x2ddc90, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x310056, dwReserved1=0x44002e, cFileName="..", cAlternateFileName="")) returned 1 [0035.191] FindNextFileA (in: hFindFile=0x2ddc90, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x310056, dwReserved1=0x44002e, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 1 [0035.191] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x77163c74, cFileName=".", cAlternateFileName="")) returned 0x2decd8 [0035.192] FindNextFileA (in: hFindFile=0x2decd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x77163c74, cFileName="..", cAlternateFileName="")) returned 1 [0035.193] FindNextFileA (in: hFindFile=0x2decd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x77163c74, cFileName="CertificateTransparency", cAlternateFileName="CERTIF~1")) returned 1 [0035.193] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x77163c74, cFileName=".", cAlternateFileName="")) returned 0x2e0d20 [0035.194] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x77163c74, cFileName="..", cAlternateFileName="")) returned 1 [0035.194] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x77163c74, cFileName="..", cAlternateFileName="")) returned 0 [0035.194] FindClose (in: hFindFile=0x2e0d20 | out: hFindFile=0x2e0d20) returned 1 [0035.194] FindNextFileA (in: hFindFile=0x2decd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x77163c74, cFileName="Crashpad", cAlternateFileName="")) returned 1 [0035.194] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x77163c74, cFileName=".", cAlternateFileName="")) returned 0x2e0d20 [0035.195] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x77163c74, cFileName="..", cAlternateFileName="")) returned 1 [0035.195] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f5beda0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x77163c74, cFileName="metadata", cAlternateFileName="")) returned 1 [0035.195] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x77163c74, cFileName="reports", cAlternateFileName="")) returned 1 [0035.195] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e69c, dwReserved1=0x77163c74, cFileName=".", cAlternateFileName="")) returned 0x2e0d60 [0035.195] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e69c, dwReserved1=0x77163c74, cFileName="..", cAlternateFileName="")) returned 1 [0035.195] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e69c, dwReserved1=0x77163c74, cFileName="..", cAlternateFileName="")) returned 0 [0035.195] FindClose (in: hFindFile=0x2e0d60 | out: hFindFile=0x2e0d60) returned 1 [0035.195] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3a6374a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x18e904, dwReserved1=0x77163c74, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0035.195] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0035.195] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0035.196] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x28 [0035.196] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0035.196] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0035.224] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x28, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x28, lpOverlapped=0x0) returned 1 [0035.225] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x30, lpOverlapped=0x0) returned 1 [0035.225] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0035.226] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0035.226] CloseHandle (hObject=0xe4) returned 1 [0035.226] CloseHandle (hObject=0xf0) returned 1 [0035.227] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat.dvodltmf")) returned 0 [0035.227] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat.dvodltmf")) returned 0x2020 [0035.227] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3a6374a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x2dede8, dwReserved1=0x18e984, cFileName="settings.dat", cAlternateFileName="")) returned 0x2e0d60 [0035.227] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3a6374a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x2dede8, dwReserved1=0x18e984, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0035.227] FindClose (in: hFindFile=0x2e0d60 | out: hFindFile=0x2e0d60) returned 1 [0035.227] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat")) returned 1 [0035.228] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat")) returned 0xffffffff [0035.228] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3a6374a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x18e904, dwReserved1=0x77163c74, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0035.228] FindClose (in: hFindFile=0x2e0d20 | out: hFindFile=0x2e0d20) returned 1 [0035.229] FindNextFileA (in: hFindFile=0x2decd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb74, dwReserved1=0x77163c74, cFileName="Default", cAlternateFileName="")) returned 1 [0035.229] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e91c, cFileName=".", cAlternateFileName="")) returned 0x2e0d20 [0035.230] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e91c, cFileName="..", cAlternateFileName="")) returned 1 [0035.231] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e91c, cFileName="Cache", cAlternateFileName="")) returned 1 [0035.231] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e0d60 [0035.232] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.232] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0e3de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="data_0", cAlternateFileName="")) returned 1 [0035.232] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0e3de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x42000, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="data_1", cAlternateFileName="")) returned 1 [0035.232] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="data_2", cAlternateFileName="")) returned 1 [0035.232] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0e3de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x402000, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="data_3", cAlternateFileName="")) returned 1 [0035.232] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x80170, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="index", cAlternateFileName="")) returned 1 [0035.232] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x80170, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="index", cAlternateFileName="")) returned 0 [0035.232] FindClose (in: hFindFile=0x2e0d60 | out: hFindFile=0x2e0d60) returned 1 [0035.232] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d406e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d406e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x98d1e730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x2ded10, dwReserved1=0x18e91c, cFileName="Cookies", cAlternateFileName="")) returned 1 [0035.232] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d66840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d66840, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x98d44890, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e91c, cFileName="Cookies-journal", cAlternateFileName="COOKIE~1")) returned 1 [0035.232] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83b08a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83b08a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0b57b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1d6, dwReserved0=0x2ded10, dwReserved1=0x18e91c, cFileName="Current Session", cAlternateFileName="CURREN~1")) returned 1 [0035.232] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c3b6860, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c3b6860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c3b8f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x126, dwReserved0=0x2ded10, dwReserved1=0x18e91c, cFileName="Current Tabs", cAlternateFileName="CURREN~2")) returned 1 [0035.232] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e91c, cFileName="data_reduction_proxy_leveldb", cAlternateFileName="DATA_R~1")) returned 1 [0035.232] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e0d60 [0035.234] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.234] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80916060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="000003.log", cAlternateFileName="")) returned 1 [0035.234] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\000003.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0035.235] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\000003.log.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0035.235] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0035.235] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0035.235] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0035.262] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x10, lpOverlapped=0x0) returned 1 [0035.265] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0035.265] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0035.267] CloseHandle (hObject=0xe4) returned 1 [0035.267] CloseHandle (hObject=0xe8) returned 1 [0035.268] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\000003.log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\000003.log.dvodltmf")) returned 0 [0035.268] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\000003.log.dvodltmf")) returned 0x2020 [0035.268] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80916060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e64f8, dwReserved1=0x18e71c, cFileName="000003.log", cAlternateFileName="")) returned 0x2e63f0 [0035.268] FindNextFileA (in: hFindFile=0x2e63f0, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80916060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e64f8, dwReserved1=0x18e71c, cFileName="000003.log", cAlternateFileName="")) returned 0 [0035.268] FindClose (in: hFindFile=0x2e63f0 | out: hFindFile=0x2e63f0) returned 1 [0035.268] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\000003.log")) returned 1 [0035.269] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\000003.log")) returned 0xffffffff [0035.269] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x804795c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x2c0000, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0035.269] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x802d66a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2c0000, cFileName="LOCK", cAlternateFileName="")) returned 1 [0035.269] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9ab9e110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x0, dwReserved1=0x2c0000, cFileName="LOG", cAlternateFileName="")) returned 1 [0035.269] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x802d66a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x2c0000, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 1 [0035.269] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x802d66a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x2c0000, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0 [0035.269] FindClose (in: hFindFile=0x2e0d60 | out: hFindFile=0x2e0d60) returned 1 [0035.269] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82bed750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31303030, dwReserved1=0x18e91c, cFileName="Extension Rules", cAlternateFileName="EXTENS~3")) returned 1 [0035.269] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82bed750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2c0000, cFileName=".", cAlternateFileName="")) returned 0x2e0d60 [0035.271] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82bed750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2c0000, cFileName="..", cAlternateFileName="")) returned 1 [0035.271] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82bed750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8dae37f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x0, dwReserved1=0x2c0000, cFileName="000003.log", cAlternateFileName="")) returned 1 [0035.271] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0035.272] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0035.272] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x156 [0035.272] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0035.272] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0035.300] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x156, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x156, lpOverlapped=0x0) returned 1 [0035.300] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x160, lpOverlapped=0x0) returned 1 [0035.301] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0035.302] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0035.302] CloseHandle (hObject=0xe8) returned 1 [0035.302] CloseHandle (hObject=0xe4) returned 1 [0035.303] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log.dvodltmf")) returned 0 [0035.303] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log.dvodltmf")) returned 0x2020 [0035.303] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82bed750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8dae37f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x2dee00, dwReserved1=0x18e71c, cFileName="000003.log", cAlternateFileName="")) returned 0x2dedf0 [0035.303] FindNextFileA (in: hFindFile=0x2dedf0, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82bed750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8dae37f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x2dee00, dwReserved1=0x18e71c, cFileName="000003.log", cAlternateFileName="")) returned 0 [0035.303] FindClose (in: hFindFile=0x2dedf0 | out: hFindFile=0x2dedf0) returned 1 [0035.303] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log")) returned 1 [0035.304] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log")) returned 0xffffffff [0035.304] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82adc050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82adc050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82adc050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x2ded10, dwReserved1=0x18e6b4, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0035.304] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82ad9940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ad9940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e6b4, cFileName="LOCK", cAlternateFileName="")) returned 1 [0035.304] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82ad9940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8dae37f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9a, dwReserved0=0x2ded10, dwReserved1=0x18e6b4, cFileName="LOG", cAlternateFileName="")) returned 1 [0035.304] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82ad9940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82adc050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x2ded10, dwReserved1=0x18e6b4, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 1 [0035.304] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82ad9940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82adc050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x2ded10, dwReserved1=0x18e6b4, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0 [0035.304] FindClose (in: hFindFile=0x2e0d60 | out: hFindFile=0x2e0d60) returned 1 [0035.305] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82556720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31303030, dwReserved1=0x18e91c, cFileName="Extension State", cAlternateFileName="EXTENS~2")) returned 1 [0035.305] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82556720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e6b4, cFileName=".", cAlternateFileName="")) returned 0x2e0d60 [0035.307] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82556720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e6b4, cFileName="..", cAlternateFileName="")) returned 1 [0035.307] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82556720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8c6f3fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4ad, dwReserved0=0x2ded10, dwReserved1=0x18e6b4, cFileName="000003.log", cAlternateFileName="")) returned 1 [0035.307] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0035.308] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0035.308] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ad [0035.308] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0035.308] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0035.342] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4ad, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x4ad, lpOverlapped=0x0) returned 1 [0035.344] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x4b0, lpOverlapped=0x0) returned 1 [0035.345] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0035.345] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0035.345] CloseHandle (hObject=0xe4) returned 1 [0035.345] CloseHandle (hObject=0xe8) returned 1 [0035.346] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log.dvodltmf")) returned 0 [0035.346] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log.dvodltmf")) returned 0x2020 [0035.346] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82556720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8c6f3fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4ad, dwReserved0=0x2dee00, dwReserved1=0x18e71c, cFileName="000003.log", cAlternateFileName="")) returned 0x2dedf0 [0035.346] FindNextFileA (in: hFindFile=0x2dedf0, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82556720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8c6f3fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4ad, dwReserved0=0x2dee00, dwReserved1=0x18e71c, cFileName="000003.log", cAlternateFileName="")) returned 0 [0035.346] FindClose (in: hFindFile=0x2dedf0 | out: hFindFile=0x2dedf0) returned 1 [0035.346] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log")) returned 1 [0035.347] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log")) returned 0xffffffff [0035.347] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x824d3190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x2ded10, dwReserved1=0x18e6b4, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0035.347] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x824ad030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e6b4, cFileName="LOCK", cAlternateFileName="")) returned 1 [0035.347] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8c6f3fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9a, dwReserved0=0x2ded10, dwReserved1=0x18e6b4, cFileName="LOG", cAlternateFileName="")) returned 1 [0035.347] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x824ad030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x2ded10, dwReserved1=0x18e6b4, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 1 [0035.348] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x824ad030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x2ded10, dwReserved1=0x18e6b4, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0 [0035.348] FindClose (in: hFindFile=0x2e0d60 | out: hFindFile=0x2e0d60) returned 1 [0035.348] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31303030, dwReserved1=0x18e91c, cFileName="Extensions", cAlternateFileName="EXTENS~1")) returned 1 [0035.348] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e6b4, cFileName=".", cAlternateFileName="")) returned 0x2e0d60 [0035.351] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e6b4, cFileName="..", cAlternateFileName="")) returned 1 [0035.352] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cca3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cf0550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cf0550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e6b4, cFileName="aapocclcgogkmnckokdopfmhonfmgoek", cAlternateFileName="AAPOCC~1")) returned 1 [0035.352] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cca3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cf0550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cf0550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2dee18 [0035.353] FindNextFileA (in: hFindFile=0x2dee18, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cca3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cf0550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cf0550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.353] FindNextFileA (in: hFindFile=0x2dee18, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="0.9_0", cAlternateFileName="")) returned 1 [0035.353] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e1cc, dwReserved1=0x77163c74, cFileName=".", cAlternateFileName="")) returned 0x2ded18 [0035.355] FindNextFileA (in: hFindFile=0x2ded18, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e1cc, dwReserved1=0x77163c74, cFileName="..", cAlternateFileName="")) returned 1 [0035.355] FindNextFileA (in: hFindFile=0x2ded18, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2c, dwReserved0=0x18e1cc, dwReserved1=0x77163c74, cFileName="icon_128.png", cAlternateFileName="")) returned 1 [0035.355] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0035.356] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0035.356] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd2c [0035.356] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0035.356] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0035.383] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd2c, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0xd2c, lpOverlapped=0x0) returned 1 [0035.644] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0xd30, lpOverlapped=0x0) returned 1 [0035.645] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0035.646] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0035.646] CloseHandle (hObject=0xf4) returned 1 [0035.646] CloseHandle (hObject=0xf8) returned 1 [0035.649] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.dvodltmf")) returned 0 [0035.650] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.dvodltmf")) returned 0x2020 [0035.650] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2c, dwReserved0=0x2e8530, dwReserved1=0x18e24c, cFileName="icon_128.png", cAlternateFileName="")) returned 0x2ded58 [0035.650] FindNextFileA (in: hFindFile=0x2ded58, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2c, dwReserved0=0x2e8530, dwReserved1=0x18e24c, cFileName="icon_128.png", cAlternateFileName="")) returned 0 [0035.650] FindClose (in: hFindFile=0x2ded58 | out: hFindFile=0x2ded58) returned 1 [0035.650] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png")) returned 1 [0035.651] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png")) returned 0xffffffff [0035.651] FindNextFileA (in: hFindFile=0x2ded18, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x2dee50, dwReserved1=0x18e1e4, cFileName="icon_16.png", cAlternateFileName="")) returned 1 [0035.651] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0035.651] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0035.651] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa0 [0035.652] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0035.652] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0035.679] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0xa0, lpOverlapped=0x0) returned 1 [0035.680] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0xb0, lpOverlapped=0x0) returned 1 [0035.681] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0035.681] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0035.682] CloseHandle (hObject=0xf8) returned 1 [0035.682] CloseHandle (hObject=0xf4) returned 1 [0035.682] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.dvodltmf")) returned 0 [0035.683] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.dvodltmf")) returned 0x2020 [0035.683] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x2def88, dwReserved1=0x18e24c, cFileName="icon_16.png", cAlternateFileName="")) returned 0x2e8418 [0035.683] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x2def88, dwReserved1=0x18e24c, cFileName="icon_16.png", cAlternateFileName="")) returned 0 [0035.683] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0035.683] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png")) returned 1 [0035.684] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png")) returned 0xffffffff [0035.684] FindNextFileA (in: hFindFile=0x2ded18, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b74730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5c, dwReserved0=0x2dee50, dwReserved1=0x18e1e4, cFileName="main.html", cAlternateFileName="MAIN~1.HTM")) returned 1 [0035.684] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0035.685] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0035.685] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5c [0035.685] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0035.685] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0035.712] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x5c, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0x5c, lpOverlapped=0x0) returned 1 [0035.712] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0x60, lpOverlapped=0x0) returned 1 [0035.713] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0035.714] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0035.714] CloseHandle (hObject=0xf4) returned 1 [0035.714] CloseHandle (hObject=0xf8) returned 1 [0035.715] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.dvodltmf")) returned 0 [0035.715] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.dvodltmf")) returned 0x2020 [0035.715] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b74730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5c, dwReserved0=0x2def88, dwReserved1=0x18e24c, cFileName="main.html", cAlternateFileName="MAIN~1.HTM")) returned 0x2e8418 [0035.715] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b74730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5c, dwReserved0=0x2def88, dwReserved1=0x18e24c, cFileName="main.html", cAlternateFileName="MAIN~1.HTM")) returned 0 [0035.715] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0035.715] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html")) returned 1 [0035.716] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html")) returned 0xffffffff [0035.716] FindNextFileA (in: hFindFile=0x2ded18, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b9b830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5f, dwReserved0=0x2dee50, dwReserved1=0x18e1e4, cFileName="main.js", cAlternateFileName="")) returned 1 [0035.716] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0035.717] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0035.717] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5f [0035.718] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0035.718] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0035.745] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x5f, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0x5f, lpOverlapped=0x0) returned 1 [0035.747] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0x60, lpOverlapped=0x0) returned 1 [0035.747] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0035.748] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0035.748] CloseHandle (hObject=0xf8) returned 1 [0035.748] CloseHandle (hObject=0xf4) returned 1 [0035.749] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.dvodltmf")) returned 0 [0035.749] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.dvodltmf")) returned 0x2020 [0035.749] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b9b830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5f, dwReserved0=0x2def80, dwReserved1=0x18e24c, cFileName="main.js", cAlternateFileName="")) returned 0x2e8418 [0035.749] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b9b830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5f, dwReserved0=0x2def80, dwReserved1=0x18e24c, cFileName="main.js", cAlternateFileName="")) returned 0 [0035.749] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0035.750] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js")) returned 1 [0035.750] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js")) returned 0xffffffff [0035.750] FindNextFileA (in: hFindFile=0x2ded18, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b9b830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d5, dwReserved0=0x2dee50, dwReserved1=0x18e1e4, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0035.750] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0035.751] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0035.751] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d5 [0035.751] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0035.751] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0035.778] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2d5, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0x2d5, lpOverlapped=0x0) returned 1 [0035.884] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0x2e0, lpOverlapped=0x0) returned 1 [0035.893] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0035.893] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0035.894] CloseHandle (hObject=0xf4) returned 1 [0035.894] CloseHandle (hObject=0xf8) returned 1 [0035.895] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.dvodltmf")) returned 0 [0035.895] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.dvodltmf")) returned 0x2020 [0035.895] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b9b830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d5, dwReserved0=0x2def90, dwReserved1=0x18e24c, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 0x2e8418 [0035.895] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b9b830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d5, dwReserved0=0x2def90, dwReserved1=0x18e24c, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 0 [0035.895] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0035.895] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json")) returned 1 [0035.896] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json")) returned 0xffffffff [0035.897] FindNextFileA (in: hFindFile=0x2ded18, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18e1e4, cFileName="_locales", cAlternateFileName="")) returned 1 [0035.897] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0035.899] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.899] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857953d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0035.899] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857953d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18dc54, dwReserved1=0x2e83f8, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0035.899] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857953d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18dc54, dwReserved1=0x2e83f8, cFileName="..", cAlternateFileName="")) returned 1 [0035.900] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x18dc54, dwReserved1=0x2e83f8, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0035.900] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.900] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0035.900] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x101 [0035.900] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0035.900] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0035.928] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x101, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x101, lpOverlapped=0x0) returned 1 [0035.929] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0035.930] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0035.930] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0035.930] CloseHandle (hObject=0xfc) returned 1 [0035.930] CloseHandle (hObject=0x100) returned 1 [0035.931] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.dvodltmf")) returned 0 [0035.931] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.dvodltmf")) returned 0x2020 [0035.932] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0035.932] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0035.932] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0035.932] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json")) returned 1 [0035.933] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json")) returned 0xffffffff [0035.933] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x18dc54, dwReserved1=0x2e83f8, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0035.933] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0035.933] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0035.933] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0035.933] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0035.933] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0035.933] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0035.937] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.937] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x110 [0035.937] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0035.937] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0035.965] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x110, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0035.966] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x120, lpOverlapped=0x0) returned 1 [0035.966] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0035.967] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0035.967] CloseHandle (hObject=0x100) returned 1 [0035.967] CloseHandle (hObject=0xfc) returned 1 [0035.968] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.dvodltmf")) returned 0 [0035.969] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.dvodltmf")) returned 0x2020 [0035.969] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0035.969] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0035.969] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0035.969] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json")) returned 1 [0035.970] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json")) returned 0xffffffff [0035.970] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0035.970] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0035.970] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0035.970] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0035.970] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0035.970] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0035.970] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.970] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0035.971] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe0 [0035.971] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0035.971] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0035.998] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0035.999] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0036.000] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0036.001] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.001] CloseHandle (hObject=0xfc) returned 1 [0036.001] CloseHandle (hObject=0x100) returned 1 [0036.002] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.dvodltmf")) returned 0 [0036.002] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.dvodltmf")) returned 0x2020 [0036.002] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0036.002] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.002] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0036.002] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json")) returned 1 [0036.004] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json")) returned 0xffffffff [0036.004] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.004] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0036.004] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0036.004] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0036.004] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0036.004] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0036.004] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.005] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.005] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe0 [0036.005] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0036.006] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0036.033] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0036.034] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0036.035] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0036.036] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.036] CloseHandle (hObject=0x100) returned 1 [0036.036] CloseHandle (hObject=0xfc) returned 1 [0036.037] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.dvodltmf")) returned 0 [0036.037] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.dvodltmf")) returned 0x2020 [0036.037] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0036.037] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.037] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0036.037] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json")) returned 1 [0036.038] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json")) returned 0xffffffff [0036.038] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.038] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0036.038] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0036.038] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0036.039] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0036.039] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0036.039] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.039] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.039] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe0 [0036.039] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0036.039] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0036.067] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0036.068] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0036.069] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0036.069] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.069] CloseHandle (hObject=0xfc) returned 1 [0036.069] CloseHandle (hObject=0x100) returned 1 [0036.070] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.dvodltmf")) returned 0 [0036.071] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.dvodltmf")) returned 0x2020 [0036.071] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0036.071] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.071] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0036.071] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json")) returned 1 [0036.072] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json")) returned 0xffffffff [0036.072] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.072] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0036.072] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0036.072] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0036.072] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0036.072] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0036.072] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.073] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.073] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xea [0036.073] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0036.074] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0036.101] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xea, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xea, lpOverlapped=0x0) returned 1 [0036.102] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0036.103] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0036.103] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.104] CloseHandle (hObject=0x100) returned 1 [0036.104] CloseHandle (hObject=0xfc) returned 1 [0036.105] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.dvodltmf")) returned 0 [0036.105] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.dvodltmf")) returned 0x2020 [0036.105] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0036.105] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.105] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0036.105] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json")) returned 1 [0036.106] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json")) returned 0xffffffff [0036.106] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.106] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0036.106] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0036.106] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0036.107] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0036.107] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857e35d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0036.107] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.107] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.107] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x112 [0036.107] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0036.107] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0036.142] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x112, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x112, lpOverlapped=0x0) returned 1 [0036.143] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x120, lpOverlapped=0x0) returned 1 [0036.144] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0036.145] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.145] CloseHandle (hObject=0xfc) returned 1 [0036.145] CloseHandle (hObject=0x100) returned 1 [0036.146] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.dvodltmf")) returned 0 [0036.147] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.dvodltmf")) returned 0x2020 [0036.147] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857e35d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0036.147] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857e35d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.147] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0036.147] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json")) returned 1 [0036.148] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json")) returned 0xffffffff [0036.148] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857e35d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.148] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0036.148] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857e1690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0036.148] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857e1690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0036.148] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857e1690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0036.148] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0036.148] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.149] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.150] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd6 [0036.150] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0036.150] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0036.177] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd6, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd6, lpOverlapped=0x0) returned 1 [0036.178] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0036.179] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0036.179] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.180] CloseHandle (hObject=0x100) returned 1 [0036.180] CloseHandle (hObject=0xfc) returned 1 [0036.181] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json.dvodltmf")) returned 0 [0036.181] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json.dvodltmf")) returned 0x2020 [0036.181] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0036.181] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.181] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0036.181] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json")) returned 1 [0036.182] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json")) returned 0xffffffff [0036.182] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.182] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0036.182] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1 [0036.182] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0036.182] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0036.183] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0036.183] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.183] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.184] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd7 [0036.184] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0036.184] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0036.212] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd7, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd7, lpOverlapped=0x0) returned 1 [0036.213] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0036.213] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0036.214] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.214] CloseHandle (hObject=0xfc) returned 1 [0036.214] CloseHandle (hObject=0x100) returned 1 [0036.215] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json.dvodltmf")) returned 0 [0036.216] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json.dvodltmf")) returned 0x2020 [0036.216] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0036.216] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.216] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0036.216] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json")) returned 1 [0036.217] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json")) returned 0xffffffff [0036.217] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.217] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0036.217] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0036.217] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0036.218] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0036.218] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0036.218] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.218] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.218] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdf [0036.218] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0036.219] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0036.246] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xdf, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xdf, lpOverlapped=0x0) returned 1 [0036.247] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0036.248] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0036.248] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.249] CloseHandle (hObject=0x100) returned 1 [0036.249] CloseHandle (hObject=0xfc) returned 1 [0036.250] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.dvodltmf")) returned 0 [0036.250] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.dvodltmf")) returned 0x2020 [0036.250] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0036.250] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.250] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0036.250] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json")) returned 1 [0036.251] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json")) returned 0xffffffff [0036.251] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.251] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0036.251] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="es_419", cAlternateFileName="")) returned 1 [0036.251] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0036.251] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0036.252] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0036.252] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.252] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.252] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0036.252] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0036.252] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0036.280] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xdd, lpOverlapped=0x0) returned 1 [0036.281] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0036.282] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0036.282] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.283] CloseHandle (hObject=0xfc) returned 1 [0036.283] CloseHandle (hObject=0x100) returned 1 [0036.284] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.dvodltmf")) returned 0 [0036.284] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.dvodltmf")) returned 0x2020 [0036.284] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2defb0, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0036.284] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2defb0, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.284] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0036.284] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json")) returned 1 [0036.285] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json")) returned 0xffffffff [0036.285] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.285] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0036.285] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0036.285] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0036.286] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0036.286] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0036.286] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.286] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.287] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd6 [0036.287] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0036.287] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0036.314] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd6, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd6, lpOverlapped=0x0) returned 1 [0036.315] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0036.316] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0036.317] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.317] CloseHandle (hObject=0x100) returned 1 [0036.317] CloseHandle (hObject=0xfc) returned 1 [0036.318] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.dvodltmf")) returned 0 [0036.318] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.dvodltmf")) returned 0x2020 [0036.318] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0036.318] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.318] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0036.318] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json")) returned 1 [0036.319] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json")) returned 0xffffffff [0036.319] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.319] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0036.319] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0036.319] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0036.320] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0036.320] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0036.320] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.320] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.320] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd9 [0036.320] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0036.320] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0036.354] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd9, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd9, lpOverlapped=0x0) returned 1 [0036.355] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0036.356] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0036.356] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.356] CloseHandle (hObject=0xfc) returned 1 [0036.357] CloseHandle (hObject=0x100) returned 1 [0036.357] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.dvodltmf")) returned 0 [0036.358] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.dvodltmf")) returned 0x2020 [0036.358] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0036.358] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.358] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0036.358] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json")) returned 1 [0036.359] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json")) returned 0xffffffff [0036.359] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.359] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0036.359] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0036.359] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0036.360] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0036.360] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0036.360] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.360] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.361] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe0 [0036.361] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0036.361] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0036.388] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0036.389] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0036.390] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0036.390] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.391] CloseHandle (hObject=0x100) returned 1 [0036.391] CloseHandle (hObject=0xfc) returned 1 [0036.391] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.dvodltmf")) returned 0 [0036.392] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.dvodltmf")) returned 0x2020 [0036.392] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0036.392] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.392] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0036.392] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json")) returned 1 [0036.393] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json")) returned 0xffffffff [0036.393] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.393] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0036.393] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0036.393] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0036.393] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0036.393] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0036.393] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.394] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.394] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0036.394] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0036.394] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0036.421] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xde, lpOverlapped=0x0) returned 1 [0036.422] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0036.423] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0036.424] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.424] CloseHandle (hObject=0xfc) returned 1 [0036.424] CloseHandle (hObject=0x100) returned 1 [0036.426] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.dvodltmf")) returned 0 [0036.427] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.dvodltmf")) returned 0x2020 [0036.427] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0036.427] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.427] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0036.427] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json")) returned 1 [0036.428] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json")) returned 0xffffffff [0036.428] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.428] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0036.428] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0036.428] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0036.436] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0036.437] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0036.437] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.437] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.437] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe1 [0036.437] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0036.437] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0036.464] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe1, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xe1, lpOverlapped=0x0) returned 1 [0036.465] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0036.466] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0036.467] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.467] CloseHandle (hObject=0x100) returned 1 [0036.467] CloseHandle (hObject=0xfc) returned 1 [0036.469] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.dvodltmf")) returned 0 [0036.470] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.dvodltmf")) returned 0x2020 [0036.470] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0036.470] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.470] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0036.470] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json")) returned 1 [0036.471] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json")) returned 0xffffffff [0036.471] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.471] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0036.471] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0036.471] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0036.471] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0036.471] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x123, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0036.471] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.472] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.472] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x123 [0036.472] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0036.472] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0036.499] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x123, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x123, lpOverlapped=0x0) returned 1 [0036.500] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x130, lpOverlapped=0x0) returned 1 [0036.501] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0036.502] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.502] CloseHandle (hObject=0xfc) returned 1 [0036.502] CloseHandle (hObject=0x100) returned 1 [0036.503] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.dvodltmf")) returned 0 [0036.504] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.dvodltmf")) returned 0x2020 [0036.504] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x123, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0036.504] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x123, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.504] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0036.504] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json")) returned 1 [0036.505] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json")) returned 0xffffffff [0036.505] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x123, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.505] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0036.505] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0036.505] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0036.506] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0036.506] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0036.506] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.506] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.506] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe6 [0036.506] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0036.507] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0036.534] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe6, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xe6, lpOverlapped=0x0) returned 1 [0036.535] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0036.536] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0036.537] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.537] CloseHandle (hObject=0x100) returned 1 [0036.537] CloseHandle (hObject=0xfc) returned 1 [0036.538] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.dvodltmf")) returned 0 [0036.538] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.dvodltmf")) returned 0x2020 [0036.538] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0036.538] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.538] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0036.538] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json")) returned 1 [0036.539] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json")) returned 0xffffffff [0036.539] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.539] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0036.539] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0036.540] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0036.540] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0036.540] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0036.540] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.540] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.540] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd0 [0036.540] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0036.540] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0036.567] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd0, lpOverlapped=0x0) returned 1 [0036.568] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0036.569] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0036.570] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.570] CloseHandle (hObject=0xfc) returned 1 [0036.570] CloseHandle (hObject=0x100) returned 1 [0036.571] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.dvodltmf")) returned 0 [0036.571] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.dvodltmf")) returned 0x2020 [0036.571] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0036.571] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.571] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0036.571] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json")) returned 1 [0036.572] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json")) returned 0xffffffff [0036.572] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.572] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0036.572] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0036.572] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0036.573] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0036.573] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0036.573] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.573] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.574] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0036.574] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0036.574] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0036.601] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xdd, lpOverlapped=0x0) returned 1 [0036.602] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0036.602] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0036.603] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.603] CloseHandle (hObject=0x100) returned 1 [0036.603] CloseHandle (hObject=0xfc) returned 1 [0036.605] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.dvodltmf")) returned 0 [0036.605] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.dvodltmf")) returned 0x2020 [0036.605] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0036.605] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.605] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0036.605] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json")) returned 1 [0036.606] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json")) returned 0xffffffff [0036.606] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.606] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0036.607] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0036.607] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0036.607] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0036.607] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0036.608] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.608] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.608] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xec [0036.608] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0036.608] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0036.636] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xec, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xec, lpOverlapped=0x0) returned 1 [0036.637] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0036.638] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0036.639] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.639] CloseHandle (hObject=0xfc) returned 1 [0036.639] CloseHandle (hObject=0x100) returned 1 [0036.640] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.dvodltmf")) returned 0 [0036.640] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.dvodltmf")) returned 0x2020 [0036.640] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0036.640] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.640] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0036.640] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json")) returned 1 [0036.641] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json")) returned 0xffffffff [0036.641] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.641] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0036.641] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0036.641] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0036.642] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0036.642] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0036.642] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.642] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.643] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe6 [0036.643] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0036.643] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0036.670] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe6, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xe6, lpOverlapped=0x0) returned 1 [0036.671] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0036.672] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0036.672] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.673] CloseHandle (hObject=0x100) returned 1 [0036.673] CloseHandle (hObject=0xfc) returned 1 [0036.673] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.dvodltmf")) returned 0 [0036.674] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.dvodltmf")) returned 0x2020 [0036.674] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0036.674] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.674] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0036.674] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json")) returned 1 [0036.675] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json")) returned 0xffffffff [0036.675] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.675] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0036.675] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0036.675] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0036.675] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0036.675] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0036.676] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.676] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.676] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe4 [0036.676] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0036.676] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0036.704] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe4, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xe4, lpOverlapped=0x0) returned 1 [0036.705] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0036.706] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0036.706] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.706] CloseHandle (hObject=0xfc) returned 1 [0036.706] CloseHandle (hObject=0x100) returned 1 [0036.707] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.dvodltmf")) returned 0 [0036.708] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.dvodltmf")) returned 0x2020 [0036.708] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0036.708] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.708] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0036.708] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json")) returned 1 [0036.709] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json")) returned 0xffffffff [0036.709] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.709] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0036.709] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0036.709] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0036.721] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0036.722] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0036.722] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.722] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.722] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe9 [0036.722] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0036.723] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0036.760] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe9, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xe9, lpOverlapped=0x0) returned 1 [0036.761] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0036.762] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0036.762] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.762] CloseHandle (hObject=0x100) returned 1 [0036.762] CloseHandle (hObject=0xfc) returned 1 [0036.765] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.dvodltmf")) returned 0 [0036.765] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.dvodltmf")) returned 0x2020 [0036.766] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0036.766] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.766] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0036.766] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json")) returned 1 [0036.767] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json")) returned 0xffffffff [0036.767] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.767] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0036.767] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1 [0036.767] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0036.767] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0036.767] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0036.767] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.767] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.768] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd2 [0036.768] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0036.768] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0036.836] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd2, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd2, lpOverlapped=0x0) returned 1 [0036.837] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0036.838] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0036.838] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.839] CloseHandle (hObject=0xfc) returned 1 [0036.839] CloseHandle (hObject=0x100) returned 1 [0036.840] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.dvodltmf")) returned 0 [0036.840] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.dvodltmf")) returned 0x2020 [0036.840] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0036.840] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.840] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0036.840] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json")) returned 1 [0036.841] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json")) returned 0xffffffff [0036.841] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.841] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0036.841] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0036.842] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0036.845] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0036.845] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0036.845] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.846] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.846] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0036.846] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0036.846] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0036.887] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xdd, lpOverlapped=0x0) returned 1 [0036.888] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0036.889] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0036.889] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.889] CloseHandle (hObject=0x100) returned 1 [0036.889] CloseHandle (hObject=0xfc) returned 1 [0036.891] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.dvodltmf")) returned 0 [0036.891] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.dvodltmf")) returned 0x2020 [0036.891] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0036.891] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.891] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0036.891] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json")) returned 1 [0036.892] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json")) returned 0xffffffff [0036.892] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.892] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0036.892] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0036.892] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0036.893] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0036.893] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0036.893] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.893] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.893] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcb [0036.893] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0036.893] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0036.921] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xcb, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xcb, lpOverlapped=0x0) returned 1 [0036.922] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xd0, lpOverlapped=0x0) returned 1 [0036.923] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0036.923] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.923] CloseHandle (hObject=0xfc) returned 1 [0036.924] CloseHandle (hObject=0x100) returned 1 [0036.924] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.dvodltmf")) returned 0 [0036.925] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.dvodltmf")) returned 0x2020 [0036.925] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0036.925] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.925] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0036.925] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json")) returned 1 [0036.926] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json")) returned 0xffffffff [0036.926] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.926] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0036.926] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0036.926] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0036.927] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0036.927] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0036.927] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.927] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.928] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd9 [0036.928] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0036.928] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0036.954] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd9, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd9, lpOverlapped=0x0) returned 1 [0036.955] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0036.956] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0036.957] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.957] CloseHandle (hObject=0x100) returned 1 [0036.957] CloseHandle (hObject=0xfc) returned 1 [0036.958] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.dvodltmf")) returned 0 [0036.958] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.dvodltmf")) returned 0x2020 [0036.958] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0036.958] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.958] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0036.958] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json")) returned 1 [0036.959] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json")) returned 0xffffffff [0036.959] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.959] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0036.959] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0036.959] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0036.960] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0036.960] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0036.960] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.960] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.960] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0036.960] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0036.961] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0036.988] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xde, lpOverlapped=0x0) returned 1 [0036.989] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0036.990] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0036.990] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.991] CloseHandle (hObject=0xfc) returned 1 [0036.991] CloseHandle (hObject=0x100) returned 1 [0036.992] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json.dvodltmf")) returned 0 [0036.992] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json.dvodltmf")) returned 0x2020 [0036.992] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0036.992] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.992] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0036.992] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json")) returned 1 [0036.995] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json")) returned 0xffffffff [0036.995] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0036.995] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0036.996] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0036.996] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0036.996] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0036.996] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0036.996] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.997] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.997] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe0 [0036.997] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0036.997] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0037.024] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0037.025] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0037.026] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0037.027] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.027] CloseHandle (hObject=0x100) returned 1 [0037.027] CloseHandle (hObject=0xfc) returned 1 [0037.028] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json.dvodltmf")) returned 0 [0037.028] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json.dvodltmf")) returned 0x2020 [0037.028] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0037.028] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0037.028] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0037.028] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json")) returned 1 [0037.029] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json")) returned 0xffffffff [0037.029] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0037.030] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0037.030] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0037.030] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0037.030] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0037.030] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0037.030] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0037.030] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0037.030] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0037.030] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0037.031] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0037.057] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xde, lpOverlapped=0x0) returned 1 [0037.058] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0037.059] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0037.060] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.060] CloseHandle (hObject=0xfc) returned 1 [0037.060] CloseHandle (hObject=0x100) returned 1 [0037.061] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.dvodltmf")) returned 0 [0037.061] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.dvodltmf")) returned 0x2020 [0037.061] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0037.061] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0037.061] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0037.061] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json")) returned 1 [0037.062] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json")) returned 0xffffffff [0037.062] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0037.062] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0037.062] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0037.062] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0037.063] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0037.063] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0037.063] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0037.064] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0037.064] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x110 [0037.064] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0037.064] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0037.092] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x110, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0037.093] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x120, lpOverlapped=0x0) returned 1 [0037.093] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0037.094] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.094] CloseHandle (hObject=0x100) returned 1 [0037.094] CloseHandle (hObject=0xfc) returned 1 [0037.095] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.dvodltmf")) returned 0 [0037.095] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.dvodltmf")) returned 0x2020 [0037.096] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0037.096] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0037.096] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0037.096] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json")) returned 1 [0037.097] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json")) returned 0xffffffff [0037.097] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0037.097] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0037.097] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0037.097] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0037.097] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0037.097] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0037.097] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0037.097] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0037.098] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe3 [0037.098] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0037.098] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0037.125] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xe3, lpOverlapped=0x0) returned 1 [0037.126] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0037.126] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0037.127] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.127] CloseHandle (hObject=0xfc) returned 1 [0037.127] CloseHandle (hObject=0x100) returned 1 [0037.130] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.dvodltmf")) returned 0 [0037.130] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.dvodltmf")) returned 0x2020 [0037.131] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0037.131] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0037.131] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0037.131] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json")) returned 1 [0037.132] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json")) returned 0xffffffff [0037.132] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0037.132] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0037.132] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0037.132] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0037.133] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0037.133] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0037.133] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0037.133] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0037.133] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdf [0037.133] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0037.134] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0037.160] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xdf, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xdf, lpOverlapped=0x0) returned 1 [0037.161] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0037.162] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0037.162] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.162] CloseHandle (hObject=0x100) returned 1 [0037.162] CloseHandle (hObject=0xfc) returned 1 [0037.165] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.dvodltmf")) returned 0 [0037.165] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.dvodltmf")) returned 0x2020 [0037.165] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0037.165] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0037.165] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0037.165] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json")) returned 1 [0037.166] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json")) returned 0xffffffff [0037.166] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0037.166] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0037.166] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0037.166] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0037.167] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0037.167] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0037.167] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0037.167] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0037.167] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x104 [0037.167] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0037.168] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0037.205] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x104, lpOverlapped=0x0) returned 1 [0037.207] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0037.208] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0037.209] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.209] CloseHandle (hObject=0xfc) returned 1 [0037.209] CloseHandle (hObject=0x100) returned 1 [0037.211] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.dvodltmf")) returned 0 [0037.212] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.dvodltmf")) returned 0x2020 [0037.212] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0037.212] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0037.212] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0037.212] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json")) returned 1 [0037.213] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json")) returned 0xffffffff [0037.213] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0037.213] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0037.213] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0037.214] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0037.215] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0037.215] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0037.215] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0037.215] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0037.216] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe2 [0037.216] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0037.216] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0037.243] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xe2, lpOverlapped=0x0) returned 1 [0037.244] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0037.245] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0037.246] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.246] CloseHandle (hObject=0x100) returned 1 [0037.246] CloseHandle (hObject=0xfc) returned 1 [0037.249] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.dvodltmf")) returned 0 [0037.249] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.dvodltmf")) returned 0x2020 [0037.249] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0037.249] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0037.249] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0037.249] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json")) returned 1 [0037.250] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json")) returned 0xffffffff [0037.250] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0037.250] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0037.251] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0037.251] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0037.251] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0037.251] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0037.251] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0037.251] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0037.251] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x104 [0037.251] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0037.252] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0037.279] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x104, lpOverlapped=0x0) returned 1 [0037.280] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0037.281] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0037.282] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.282] CloseHandle (hObject=0xfc) returned 1 [0037.282] CloseHandle (hObject=0x100) returned 1 [0037.285] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.dvodltmf")) returned 0 [0037.285] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.dvodltmf")) returned 0x2020 [0037.285] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0037.285] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0037.285] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0037.285] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json")) returned 1 [0037.286] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json")) returned 0xffffffff [0037.286] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0037.286] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0037.286] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0037.287] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0037.287] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0037.288] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0037.288] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0037.288] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0037.288] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0037.288] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0037.288] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0037.316] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xdd, lpOverlapped=0x0) returned 1 [0037.317] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0037.318] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0037.318] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.319] CloseHandle (hObject=0x100) returned 1 [0037.319] CloseHandle (hObject=0xfc) returned 1 [0037.320] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.dvodltmf")) returned 0 [0037.320] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.dvodltmf")) returned 0x2020 [0037.320] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0037.320] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0037.320] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0037.320] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json")) returned 1 [0037.321] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json")) returned 0xffffffff [0037.321] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0037.321] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0037.321] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0037.322] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0037.322] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0037.322] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0037.322] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0037.322] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0037.322] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10e [0037.322] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0037.323] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0037.360] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x10e, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x10e, lpOverlapped=0x0) returned 1 [0037.361] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0037.362] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0037.363] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.363] CloseHandle (hObject=0xfc) returned 1 [0037.363] CloseHandle (hObject=0x100) returned 1 [0037.364] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.dvodltmf")) returned 0 [0037.364] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.dvodltmf")) returned 0x2020 [0037.364] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0037.365] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0037.365] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0037.365] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json")) returned 1 [0037.366] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json")) returned 0xffffffff [0037.366] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0037.366] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0037.366] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0037.366] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0037.367] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0037.367] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0037.367] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0037.367] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0037.367] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xed [0037.367] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0037.368] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0037.395] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xed, lpOverlapped=0x0) returned 1 [0037.396] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0037.397] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0037.398] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.398] CloseHandle (hObject=0x100) returned 1 [0037.398] CloseHandle (hObject=0xfc) returned 1 [0037.399] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.dvodltmf")) returned 0 [0037.399] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.dvodltmf")) returned 0x2020 [0037.399] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0037.400] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0037.400] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0037.400] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json")) returned 1 [0037.401] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json")) returned 0xffffffff [0037.401] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0037.401] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0037.401] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0037.401] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0037.401] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0037.401] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0037.401] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0037.401] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0037.402] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd7 [0037.402] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0037.402] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0037.429] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd7, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd7, lpOverlapped=0x0) returned 1 [0037.430] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0037.431] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0037.432] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.432] CloseHandle (hObject=0xfc) returned 1 [0037.432] CloseHandle (hObject=0x100) returned 1 [0037.433] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json.dvodltmf")) returned 0 [0037.433] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json.dvodltmf")) returned 0x2020 [0037.434] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0037.434] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0037.434] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0037.434] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json")) returned 1 [0037.444] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json")) returned 0xffffffff [0037.444] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0037.444] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0037.444] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0037.444] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0037.444] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0037.444] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0037.444] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0037.445] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0037.445] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd1 [0037.445] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0037.445] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0037.473] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd1, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd1, lpOverlapped=0x0) returned 1 [0037.474] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0037.475] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0037.475] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.475] CloseHandle (hObject=0x100) returned 1 [0037.476] CloseHandle (hObject=0xfc) returned 1 [0037.478] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json.dvodltmf")) returned 0 [0037.479] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json.dvodltmf")) returned 0x2020 [0037.479] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8498 [0037.479] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x2defa8, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0037.479] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0037.479] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json")) returned 1 [0037.480] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json")) returned 0xffffffff [0037.480] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x2dee50, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0037.480] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0037.480] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0037.480] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0037.480] FindNextFileA (in: hFindFile=0x2ded18, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85d166b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18e1e4, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0037.480] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85d166b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0037.481] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85d166b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.481] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85d166b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85d166b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 1 [0037.481] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0037.481] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0037.483] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x160 [0037.483] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0037.483] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0037.510] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18df70*=0x160, lpOverlapped=0x0) returned 1 [0037.511] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18df70*=0x170, lpOverlapped=0x0) returned 1 [0037.513] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0037.513] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.513] CloseHandle (hObject=0xf4) returned 1 [0037.513] CloseHandle (hObject=0xfc) returned 1 [0037.514] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json.dvodltmf")) returned 0 [0037.515] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json.dvodltmf")) returned 0x2020 [0037.515] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json", lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85d166b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85d166b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x2defb0, dwReserved1=0x18dfe4, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 0x2e8458 [0037.515] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85d166b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85d166b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x2defb0, dwReserved1=0x18dfe4, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 0 [0037.515] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0037.515] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json")) returned 1 [0037.516] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json")) returned 0xffffffff [0037.516] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b9b830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x2dee50, dwReserved1=0x18df7c, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0037.516] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0037.516] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0037.517] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b56 [0037.517] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0037.517] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0037.545] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2b56, lpNumberOfBytesRead=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18df70*=0x2b56, lpOverlapped=0x0) returned 1 [0037.549] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2b60, lpNumberOfBytesWritten=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18df70*=0x2b60, lpOverlapped=0x0) returned 1 [0037.550] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0037.550] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.550] CloseHandle (hObject=0xfc) returned 1 [0037.550] CloseHandle (hObject=0xf4) returned 1 [0037.551] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json.dvodltmf")) returned 0 [0037.552] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json.dvodltmf")) returned 0x2020 [0037.552] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json", lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b9b830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x2defb0, dwReserved1=0x18dfe4, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0x2e8458 [0037.552] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b9b830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x2defb0, dwReserved1=0x18dfe4, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0037.552] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0037.552] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json")) returned 1 [0037.553] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json")) returned 0xffffffff [0037.553] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b9b830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x2dee50, dwReserved1=0x18df7c, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0037.553] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0037.553] FindNextFileA (in: hFindFile=0x2ded18, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85d166b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dee50, dwReserved1=0x18e1e4, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0037.553] FindClose (in: hFindFile=0x2ded18 | out: hFindFile=0x2ded18) returned 1 [0037.553] FindNextFileA (in: hFindFile=0x2dee18, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="0.9_0", cAlternateFileName="")) returned 0 [0037.554] FindClose (in: hFindFile=0x2dee18 | out: hFindFile=0x2dee18) returned 1 [0037.554] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e6b4, cFileName="aohghmighlieiainnegkcijnfilokake", cAlternateFileName="AOHGHM~1")) returned 1 [0037.554] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0037.554] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.554] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="0.9_0", cAlternateFileName="")) returned 1 [0037.554] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0037.557] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="..", cAlternateFileName="")) returned 1 [0037.557] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc8d, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="icon_128.png", cAlternateFileName="")) returned 1 [0037.557] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0037.558] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0037.558] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc8d [0037.558] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0037.558] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0037.586] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xc8d, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0xc8d, lpOverlapped=0x0) returned 1 [0037.588] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0xc90, lpOverlapped=0x0) returned 1 [0037.589] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0037.590] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.590] CloseHandle (hObject=0xf8) returned 1 [0037.591] CloseHandle (hObject=0xf4) returned 1 [0037.592] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.dvodltmf")) returned 0 [0037.592] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.dvodltmf")) returned 0x2020 [0037.592] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc8d, dwReserved0=0x2dee48, dwReserved1=0x18e24c, cFileName="icon_128.png", cAlternateFileName="")) returned 0x2e8498 [0037.592] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc8d, dwReserved0=0x2dee48, dwReserved1=0x18e24c, cFileName="icon_128.png", cAlternateFileName="")) returned 0 [0037.592] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0037.592] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png")) returned 1 [0037.593] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png")) returned 0xffffffff [0037.593] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8f, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="icon_16.png", cAlternateFileName="")) returned 1 [0037.593] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0037.594] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0037.595] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8f [0037.595] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0037.595] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0037.623] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x8f, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0x8f, lpOverlapped=0x0) returned 1 [0037.624] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0x90, lpOverlapped=0x0) returned 1 [0037.626] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0037.627] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.627] CloseHandle (hObject=0xf4) returned 1 [0037.627] CloseHandle (hObject=0xf8) returned 1 [0037.628] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.dvodltmf")) returned 0 [0037.628] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.dvodltmf")) returned 0x2020 [0037.628] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8f, dwReserved0=0x2dee48, dwReserved1=0x18e24c, cFileName="icon_16.png", cAlternateFileName="")) returned 0x2e8498 [0037.628] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8f, dwReserved0=0x2dee48, dwReserved1=0x18e24c, cFileName="icon_16.png", cAlternateFileName="")) returned 0 [0037.628] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0037.628] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png")) returned 1 [0037.629] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png")) returned 0xffffffff [0037.629] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5c, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="main.html", cAlternateFileName="MAIN~1.HTM")) returned 1 [0037.629] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0037.630] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0037.630] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5c [0037.630] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0037.630] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0037.659] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x5c, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0x5c, lpOverlapped=0x0) returned 1 [0037.660] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0x60, lpOverlapped=0x0) returned 1 [0037.661] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0037.662] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.662] CloseHandle (hObject=0xf8) returned 1 [0037.662] CloseHandle (hObject=0xf4) returned 1 [0037.663] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.dvodltmf")) returned 0 [0037.663] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.dvodltmf")) returned 0x2020 [0037.663] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5c, dwReserved0=0x2dee48, dwReserved1=0x18e24c, cFileName="main.html", cAlternateFileName="MAIN~1.HTM")) returned 0x2e8498 [0037.663] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5c, dwReserved0=0x2dee48, dwReserved1=0x18e24c, cFileName="main.html", cAlternateFileName="MAIN~1.HTM")) returned 0 [0037.663] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0037.663] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html")) returned 1 [0037.664] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html")) returned 0xffffffff [0037.664] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5b, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="main.js", cAlternateFileName="")) returned 1 [0037.664] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0037.665] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0037.665] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5b [0037.665] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0037.665] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0037.692] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x5b, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0x5b, lpOverlapped=0x0) returned 1 [0037.693] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0x60, lpOverlapped=0x0) returned 1 [0037.694] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0037.694] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.694] CloseHandle (hObject=0xf4) returned 1 [0037.694] CloseHandle (hObject=0xf8) returned 1 [0037.695] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.dvodltmf")) returned 0 [0037.696] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.dvodltmf")) returned 0x2020 [0037.696] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5b, dwReserved0=0x2dee40, dwReserved1=0x18e24c, cFileName="main.js", cAlternateFileName="")) returned 0x2e8498 [0037.696] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5b, dwReserved0=0x2dee40, dwReserved1=0x18e24c, cFileName="main.js", cAlternateFileName="")) returned 0 [0037.696] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0037.696] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js")) returned 1 [0037.697] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js")) returned 0xffffffff [0037.697] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86727140, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d5, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0037.697] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0037.697] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0037.697] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d5 [0037.697] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0037.698] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0037.725] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2d5, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0x2d5, lpOverlapped=0x0) returned 1 [0037.726] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0x2e0, lpOverlapped=0x0) returned 1 [0037.727] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0037.728] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.728] CloseHandle (hObject=0xf8) returned 1 [0037.728] CloseHandle (hObject=0xf4) returned 1 [0037.732] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json.dvodltmf")) returned 0 [0037.732] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json.dvodltmf")) returned 0x2020 [0037.733] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86727140, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d5, dwReserved0=0x2dee50, dwReserved1=0x18e24c, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 0x2e8498 [0037.733] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86727140, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d5, dwReserved0=0x2dee50, dwReserved1=0x18e24c, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 0 [0037.733] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0037.733] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json")) returned 1 [0037.734] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json")) returned 0xffffffff [0037.734] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="_locales", cAlternateFileName="")) returned 1 [0037.734] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0037.785] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.786] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0037.786] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x66006e, dwReserved1=0x6c0069, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0037.786] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x66006e, dwReserved1=0x6c0069, cFileName="..", cAlternateFileName="")) returned 1 [0037.786] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0x66006e, dwReserved1=0x6c0069, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0037.786] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0037.786] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0037.786] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf6 [0037.787] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0037.787] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0037.814] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xf6, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xf6, lpOverlapped=0x0) returned 1 [0037.815] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x100, lpOverlapped=0x0) returned 1 [0037.816] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0037.816] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.816] CloseHandle (hObject=0xfc) returned 1 [0037.816] CloseHandle (hObject=0x100) returned 1 [0037.819] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json.dvodltmf")) returned 0 [0037.819] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json.dvodltmf")) returned 0x2020 [0037.819] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0037.820] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0037.820] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0037.820] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json")) returned 1 [0037.821] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json")) returned 0xffffffff [0037.821] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0x66006e, dwReserved1=0x6c0069, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0037.821] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0037.821] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0037.821] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0037.821] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0037.821] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0037.821] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0037.822] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0037.822] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x108 [0037.822] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0037.823] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0037.850] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x108, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x108, lpOverlapped=0x0) returned 1 [0037.850] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0037.851] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0037.852] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.852] CloseHandle (hObject=0x100) returned 1 [0037.852] CloseHandle (hObject=0xfc) returned 1 [0037.853] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json.dvodltmf")) returned 0 [0037.853] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json.dvodltmf")) returned 0x2020 [0037.853] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0037.853] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0037.853] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0037.854] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json")) returned 1 [0037.854] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json")) returned 0xffffffff [0037.854] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0037.854] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0037.855] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0037.855] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0037.855] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0037.855] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0037.855] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0037.855] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0037.855] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcf [0037.855] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0037.856] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0037.887] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xcf, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xcf, lpOverlapped=0x0) returned 1 [0037.888] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xd0, lpOverlapped=0x0) returned 1 [0037.889] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0037.890] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.890] CloseHandle (hObject=0xfc) returned 1 [0037.890] CloseHandle (hObject=0x100) returned 1 [0037.893] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json.dvodltmf")) returned 0 [0037.893] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json.dvodltmf")) returned 0x2020 [0037.893] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0037.893] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0037.893] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0037.893] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json")) returned 1 [0037.894] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json")) returned 0xffffffff [0037.894] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0037.894] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0037.894] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0037.894] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0037.895] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0037.895] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0037.895] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0037.896] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0037.896] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0037.896] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0037.896] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0037.923] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xde, lpOverlapped=0x0) returned 1 [0037.925] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0037.926] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0037.927] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.927] CloseHandle (hObject=0x100) returned 1 [0037.927] CloseHandle (hObject=0xfc) returned 1 [0037.928] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json.dvodltmf")) returned 0 [0037.928] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json.dvodltmf")) returned 0x2020 [0037.928] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0037.928] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0037.928] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0037.928] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json")) returned 1 [0037.929] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json")) returned 0xffffffff [0037.929] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0037.929] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0037.930] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0037.930] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0037.930] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0037.930] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0037.930] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0037.930] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0037.930] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd8 [0037.930] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0037.931] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0037.965] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd8, lpOverlapped=0x0) returned 1 [0037.966] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0037.967] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0037.969] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.970] CloseHandle (hObject=0xfc) returned 1 [0037.970] CloseHandle (hObject=0x100) returned 1 [0037.971] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json.dvodltmf")) returned 0 [0037.971] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json.dvodltmf")) returned 0x2020 [0037.971] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0037.972] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0037.972] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0037.972] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json")) returned 1 [0037.973] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json")) returned 0xffffffff [0037.973] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0037.973] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0037.973] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0037.973] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0037.973] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0037.973] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0037.973] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0037.974] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0037.974] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd9 [0037.974] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0037.975] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0038.002] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd9, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd9, lpOverlapped=0x0) returned 1 [0038.003] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0038.004] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0038.004] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.004] CloseHandle (hObject=0x100) returned 1 [0038.004] CloseHandle (hObject=0xfc) returned 1 [0038.005] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json.dvodltmf")) returned 0 [0038.006] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json.dvodltmf")) returned 0x2020 [0038.006] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0038.006] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.006] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0038.006] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json")) returned 1 [0038.007] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json")) returned 0xffffffff [0038.007] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.007] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0038.007] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0038.007] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0038.007] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0038.007] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.007] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0038.008] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0038.008] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x104 [0038.008] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0038.008] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0038.035] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x104, lpOverlapped=0x0) returned 1 [0038.036] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0038.037] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0038.038] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.038] CloseHandle (hObject=0xfc) returned 1 [0038.038] CloseHandle (hObject=0x100) returned 1 [0038.039] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json.dvodltmf")) returned 0 [0038.039] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json.dvodltmf")) returned 0x2020 [0038.039] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0038.039] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.039] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0038.040] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json")) returned 1 [0038.040] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json")) returned 0xffffffff [0038.040] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.041] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0038.041] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0038.041] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0038.041] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0038.041] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.041] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0038.042] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0038.042] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd0 [0038.042] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0038.043] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0038.069] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd0, lpOverlapped=0x0) returned 1 [0038.070] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0038.071] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0038.072] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.072] CloseHandle (hObject=0x100) returned 1 [0038.072] CloseHandle (hObject=0xfc) returned 1 [0038.073] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json.dvodltmf")) returned 0 [0038.073] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json.dvodltmf")) returned 0x2020 [0038.073] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0038.073] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.073] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0038.074] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json")) returned 1 [0038.075] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json")) returned 0xffffffff [0038.075] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.075] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0038.075] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1 [0038.075] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0038.075] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0038.075] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.075] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0038.076] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0038.076] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd1 [0038.076] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0038.077] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0038.104] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd1, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd1, lpOverlapped=0x0) returned 1 [0038.105] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0038.106] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0038.106] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.107] CloseHandle (hObject=0xfc) returned 1 [0038.107] CloseHandle (hObject=0x100) returned 1 [0038.108] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json.dvodltmf")) returned 0 [0038.108] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json.dvodltmf")) returned 0x2020 [0038.108] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0038.108] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.108] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0038.108] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json")) returned 1 [0038.109] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json")) returned 0xffffffff [0038.109] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.109] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0038.109] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0038.109] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0038.110] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0038.110] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.110] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0038.110] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0038.110] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xce [0038.110] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0038.111] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0038.138] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xce, lpOverlapped=0x0) returned 1 [0038.139] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xd0, lpOverlapped=0x0) returned 1 [0038.140] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0038.140] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.140] CloseHandle (hObject=0x100) returned 1 [0038.141] CloseHandle (hObject=0xfc) returned 1 [0038.142] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json.dvodltmf")) returned 0 [0038.142] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json.dvodltmf")) returned 0x2020 [0038.142] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0038.142] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.142] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0038.142] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json")) returned 1 [0038.143] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json")) returned 0xffffffff [0038.143] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.143] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0038.143] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="es_419", cAlternateFileName="")) returned 1 [0038.143] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0038.144] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0038.144] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.144] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0038.144] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0038.145] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xce [0038.145] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0038.145] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0038.173] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xce, lpOverlapped=0x0) returned 1 [0038.174] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xd0, lpOverlapped=0x0) returned 1 [0038.175] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0038.175] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.176] CloseHandle (hObject=0xfc) returned 1 [0038.176] CloseHandle (hObject=0x100) returned 1 [0038.177] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json.dvodltmf")) returned 0 [0038.177] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json.dvodltmf")) returned 0x2020 [0038.177] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0038.177] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.177] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0038.177] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json")) returned 1 [0038.178] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json")) returned 0xffffffff [0038.178] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.178] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0038.178] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0038.178] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0038.179] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0038.179] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.179] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0038.179] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0038.179] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd8 [0038.179] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0038.180] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0038.207] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd8, lpOverlapped=0x0) returned 1 [0038.208] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0038.209] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0038.209] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.210] CloseHandle (hObject=0x100) returned 1 [0038.210] CloseHandle (hObject=0xfc) returned 1 [0038.211] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json.dvodltmf")) returned 0 [0038.211] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json.dvodltmf")) returned 0x2020 [0038.211] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0038.211] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.211] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0038.211] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json")) returned 1 [0038.212] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json")) returned 0xffffffff [0038.212] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.212] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0038.212] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0038.212] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0038.213] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0038.213] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.213] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0038.214] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0038.214] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd8 [0038.214] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0038.214] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0038.243] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd8, lpOverlapped=0x0) returned 1 [0038.243] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0038.244] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0038.245] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.245] CloseHandle (hObject=0xfc) returned 1 [0038.245] CloseHandle (hObject=0x100) returned 1 [0038.249] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json.dvodltmf")) returned 0 [0038.250] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json.dvodltmf")) returned 0x2020 [0038.250] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0038.250] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.251] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0038.251] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json")) returned 1 [0038.252] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json")) returned 0xffffffff [0038.252] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.252] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0038.252] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0038.252] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0038.253] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0038.253] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.253] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0038.253] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0038.253] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdb [0038.253] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0038.254] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0038.281] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xdb, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xdb, lpOverlapped=0x0) returned 1 [0038.283] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0038.284] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0038.284] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.284] CloseHandle (hObject=0x100) returned 1 [0038.284] CloseHandle (hObject=0xfc) returned 1 [0038.285] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json.dvodltmf")) returned 0 [0038.286] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json.dvodltmf")) returned 0x2020 [0038.286] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0038.286] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.286] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0038.286] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json")) returned 1 [0038.287] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json")) returned 0xffffffff [0038.287] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.287] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0038.287] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0038.287] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0038.287] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0038.287] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.287] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0038.289] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0038.289] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd7 [0038.289] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0038.289] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0038.316] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd7, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd7, lpOverlapped=0x0) returned 1 [0038.317] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0038.318] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0038.319] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.319] CloseHandle (hObject=0xfc) returned 1 [0038.319] CloseHandle (hObject=0x100) returned 1 [0038.320] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json.dvodltmf")) returned 0 [0038.320] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json.dvodltmf")) returned 0x2020 [0038.320] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0038.320] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.320] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0038.320] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json")) returned 1 [0038.321] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json")) returned 0xffffffff [0038.321] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.321] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0038.321] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0038.321] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0038.322] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0038.322] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.322] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0038.322] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0038.322] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0038.322] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0038.323] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0038.359] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xdd, lpOverlapped=0x0) returned 1 [0038.360] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0038.361] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0038.362] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.362] CloseHandle (hObject=0x100) returned 1 [0038.362] CloseHandle (hObject=0xfc) returned 1 [0038.365] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json.dvodltmf")) returned 0 [0038.365] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json.dvodltmf")) returned 0x2020 [0038.365] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0038.365] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.366] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0038.366] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json")) returned 1 [0038.366] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json")) returned 0xffffffff [0038.367] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.367] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0038.367] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0038.367] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0038.367] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0038.367] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.367] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0038.368] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0038.368] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x117 [0038.368] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0038.368] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0038.396] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x117, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x117, lpOverlapped=0x0) returned 1 [0038.396] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x120, lpOverlapped=0x0) returned 1 [0038.397] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0038.398] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.398] CloseHandle (hObject=0xfc) returned 1 [0038.398] CloseHandle (hObject=0x100) returned 1 [0038.399] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json.dvodltmf")) returned 0 [0038.399] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json.dvodltmf")) returned 0x2020 [0038.399] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0038.399] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.400] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0038.400] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json")) returned 1 [0038.400] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json")) returned 0xffffffff [0038.401] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.401] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0038.401] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0038.401] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0038.401] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0038.401] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.401] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0038.401] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0038.401] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xeb [0038.402] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0038.402] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0038.429] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xeb, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xeb, lpOverlapped=0x0) returned 1 [0038.430] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0038.431] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0038.431] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.431] CloseHandle (hObject=0x100) returned 1 [0038.431] CloseHandle (hObject=0xfc) returned 1 [0038.432] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json.dvodltmf")) returned 0 [0038.433] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json.dvodltmf")) returned 0x2020 [0038.433] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0038.433] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.433] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0038.433] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json")) returned 1 [0038.434] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json")) returned 0xffffffff [0038.434] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.434] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0038.434] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0038.434] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0038.434] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0038.434] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.434] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0038.447] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0038.447] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd1 [0038.447] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0038.447] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0038.475] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd1, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd1, lpOverlapped=0x0) returned 1 [0038.476] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0038.476] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0038.477] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.477] CloseHandle (hObject=0xfc) returned 1 [0038.477] CloseHandle (hObject=0x100) returned 1 [0038.478] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json.dvodltmf")) returned 0 [0038.479] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json.dvodltmf")) returned 0x2020 [0038.479] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0038.479] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.479] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0038.479] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json")) returned 1 [0038.480] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json")) returned 0xffffffff [0038.480] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.480] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0038.480] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0038.480] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0038.480] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0038.480] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.480] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0038.481] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0038.481] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd5 [0038.481] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0038.481] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0038.508] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd5, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd5, lpOverlapped=0x0) returned 1 [0038.509] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0038.510] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0038.510] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.510] CloseHandle (hObject=0x100) returned 1 [0038.511] CloseHandle (hObject=0xfc) returned 1 [0038.512] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json.dvodltmf")) returned 0 [0038.512] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json.dvodltmf")) returned 0x2020 [0038.512] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0038.512] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.512] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0038.512] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json")) returned 1 [0038.513] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json")) returned 0xffffffff [0038.513] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.513] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0038.513] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0038.513] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0038.513] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0038.514] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.514] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0038.514] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0038.515] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0038.515] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0038.515] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0038.542] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xdd, lpOverlapped=0x0) returned 1 [0038.543] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0038.552] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0038.552] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.553] CloseHandle (hObject=0xfc) returned 1 [0038.553] CloseHandle (hObject=0x100) returned 1 [0038.554] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json.dvodltmf")) returned 0 [0038.554] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json.dvodltmf")) returned 0x2020 [0038.554] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0038.554] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.554] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0038.554] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json")) returned 1 [0038.555] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json")) returned 0xffffffff [0038.555] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.555] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0038.555] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0038.555] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0038.556] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0038.556] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.556] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0038.556] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0038.559] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xda [0038.559] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0038.559] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0038.593] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xda, lpOverlapped=0x0) returned 1 [0038.594] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0038.596] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0038.596] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.597] CloseHandle (hObject=0x100) returned 1 [0038.597] CloseHandle (hObject=0xfc) returned 1 [0038.598] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json.dvodltmf")) returned 0 [0038.598] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json.dvodltmf")) returned 0x2020 [0038.598] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0038.599] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.599] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0038.599] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json")) returned 1 [0038.600] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json")) returned 0xffffffff [0038.600] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.600] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0038.600] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865abaf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865abaf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0038.600] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865abaf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865abaf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0038.601] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865abaf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865abaf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0038.601] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865aa380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.601] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0038.602] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0038.602] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe4 [0038.602] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0038.602] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0038.635] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe4, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xe4, lpOverlapped=0x0) returned 1 [0038.636] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0038.637] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0038.637] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.638] CloseHandle (hObject=0xfc) returned 1 [0038.638] CloseHandle (hObject=0x100) returned 1 [0038.639] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json.dvodltmf")) returned 0 [0038.639] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json.dvodltmf")) returned 0x2020 [0038.639] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865aa380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0038.639] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865aa380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.639] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0038.639] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json")) returned 1 [0038.640] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json")) returned 0xffffffff [0038.640] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865aa380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.640] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0038.640] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865abaf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865abaf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0038.640] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865abaf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865abaf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0038.641] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865abaf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865abaf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0038.641] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865aa380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.641] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0038.641] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0038.641] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe0 [0038.641] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0038.641] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0038.669] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0038.670] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0038.670] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0038.671] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.671] CloseHandle (hObject=0x100) returned 1 [0038.671] CloseHandle (hObject=0xfc) returned 1 [0038.672] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json.dvodltmf")) returned 0 [0038.672] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json.dvodltmf")) returned 0x2020 [0038.672] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865aa380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0038.672] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865aa380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.673] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0038.673] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json")) returned 1 [0038.673] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json")) returned 0xffffffff [0038.673] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865aa380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.674] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0038.674] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865d1c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865d1c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1 [0038.674] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865d1c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865d1c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0038.674] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865d1c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865d1c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0038.674] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865d1480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.674] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0038.675] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0038.675] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcf [0038.675] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0038.675] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0038.704] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xcf, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xcf, lpOverlapped=0x0) returned 1 [0038.709] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xd0, lpOverlapped=0x0) returned 1 [0038.710] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0038.710] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.711] CloseHandle (hObject=0xfc) returned 1 [0038.711] CloseHandle (hObject=0x100) returned 1 [0038.712] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json.dvodltmf")) returned 0 [0038.712] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json.dvodltmf")) returned 0x2020 [0038.712] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865d1480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0038.713] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865d1480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.713] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0038.713] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json")) returned 1 [0038.714] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json")) returned 0xffffffff [0038.714] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865d1480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.714] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0038.714] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865f7db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865f7db0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0038.714] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865f7db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865f7db0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0038.714] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865f7db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865f7db0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0038.715] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865f7db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865f8580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.715] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0038.715] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0038.715] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd9 [0038.715] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0038.716] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0038.749] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd9, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd9, lpOverlapped=0x0) returned 1 [0038.750] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0038.751] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0038.752] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.752] CloseHandle (hObject=0x100) returned 1 [0038.753] CloseHandle (hObject=0xfc) returned 1 [0038.754] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json.dvodltmf")) returned 0 [0038.754] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json.dvodltmf")) returned 0x2020 [0038.754] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865f7db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865f8580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0038.754] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865f7db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865f8580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.754] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0038.754] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json")) returned 1 [0038.755] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json")) returned 0xffffffff [0038.756] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865f7db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865f8580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.756] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0038.756] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865f7db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8661df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0038.756] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865f7db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8661df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0038.756] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865f7db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8661df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0038.756] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661cf70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0xc3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.756] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0038.771] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0038.772] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc3 [0038.772] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0038.772] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0038.801] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xc3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xc3, lpOverlapped=0x0) returned 1 [0038.802] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xd0, lpOverlapped=0x0) returned 1 [0038.803] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0038.804] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.804] CloseHandle (hObject=0xfc) returned 1 [0038.804] CloseHandle (hObject=0x100) returned 1 [0038.805] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json.dvodltmf")) returned 0 [0038.805] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json.dvodltmf")) returned 0x2020 [0038.806] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661cf70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0xc3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0038.806] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661cf70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0xc3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.806] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0038.806] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json")) returned 1 [0038.807] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json")) returned 0xffffffff [0038.807] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661cf70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0xc3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.807] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0038.807] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8661df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0038.807] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8661df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0038.807] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8661df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0038.807] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661cf70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.807] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0038.808] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0038.808] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd5 [0038.808] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0038.808] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0038.836] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd5, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd5, lpOverlapped=0x0) returned 1 [0038.837] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0038.838] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0038.839] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.839] CloseHandle (hObject=0x100) returned 1 [0038.839] CloseHandle (hObject=0xfc) returned 1 [0038.840] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json.dvodltmf")) returned 0 [0038.840] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json.dvodltmf")) returned 0x2020 [0038.841] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661cf70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0038.841] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661cf70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.841] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0038.841] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json")) returned 1 [0038.842] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json")) returned 0xffffffff [0038.842] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661cf70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.842] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0038.842] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86644070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0038.842] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86644070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0038.842] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86644070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0038.842] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.842] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0038.843] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0038.843] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xce [0038.843] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0038.844] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0038.872] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xce, lpOverlapped=0x0) returned 1 [0038.872] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xd0, lpOverlapped=0x0) returned 1 [0038.873] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0038.874] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.874] CloseHandle (hObject=0xfc) returned 1 [0038.874] CloseHandle (hObject=0x100) returned 1 [0038.875] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json.dvodltmf")) returned 0 [0038.875] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json.dvodltmf")) returned 0x2020 [0038.876] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0038.876] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.876] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0038.876] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json")) returned 1 [0038.877] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json")) returned 0xffffffff [0038.877] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.877] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0038.879] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86644070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0038.879] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86644070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0038.879] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86644070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0038.880] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.880] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0038.880] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0038.880] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd0 [0038.880] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0038.880] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0038.908] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd0, lpOverlapped=0x0) returned 1 [0038.909] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0038.910] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0038.911] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.911] CloseHandle (hObject=0x100) returned 1 [0038.911] CloseHandle (hObject=0xfc) returned 1 [0038.912] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json.dvodltmf")) returned 0 [0038.912] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json.dvodltmf")) returned 0x2020 [0038.912] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0038.913] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.913] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0038.913] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json")) returned 1 [0038.914] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json")) returned 0xffffffff [0038.914] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.914] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0038.914] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8666a1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86690330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86690330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0038.914] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8666a1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86690330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86690330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0038.914] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8666a1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86690330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86690330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0038.914] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8668fb60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.914] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0038.915] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0038.915] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd5 [0038.915] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0038.916] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0038.945] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd5, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd5, lpOverlapped=0x0) returned 1 [0038.946] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0038.947] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0038.947] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.947] CloseHandle (hObject=0xfc) returned 1 [0038.948] CloseHandle (hObject=0x100) returned 1 [0038.948] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json.dvodltmf")) returned 0 [0038.949] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json.dvodltmf")) returned 0x2020 [0038.949] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8668fb60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0038.949] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8668fb60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.949] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0038.950] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json")) returned 1 [0038.950] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json")) returned 0xffffffff [0038.950] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8668fb60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.950] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0038.951] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86690330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86690330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0038.951] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86690330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86690330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0038.951] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86690330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86690330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0038.951] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8668fb60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.951] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0038.951] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0038.952] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10a [0038.952] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0038.952] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0038.981] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x10a, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x10a, lpOverlapped=0x0) returned 1 [0038.982] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0038.982] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0038.983] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.983] CloseHandle (hObject=0x100) returned 1 [0038.983] CloseHandle (hObject=0xfc) returned 1 [0038.984] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json.dvodltmf")) returned 0 [0038.985] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json.dvodltmf")) returned 0x2020 [0038.985] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8668fb60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0038.985] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8668fb60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.985] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0038.985] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json")) returned 1 [0038.986] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json")) returned 0xffffffff [0038.986] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8668fb60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.986] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0038.986] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866b6490, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0038.986] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866b6490, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0038.986] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866b6490, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0038.986] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6c60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.986] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0038.987] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0038.988] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0038.988] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0038.988] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0039.017] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xdd, lpOverlapped=0x0) returned 1 [0039.018] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0039.019] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0039.020] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.020] CloseHandle (hObject=0xfc) returned 1 [0039.020] CloseHandle (hObject=0x100) returned 1 [0039.021] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json.dvodltmf")) returned 0 [0039.021] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json.dvodltmf")) returned 0x2020 [0039.022] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6c60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0039.022] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6c60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.022] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0039.022] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json")) returned 1 [0039.023] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json")) returned 0xffffffff [0039.023] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6c60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.023] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0039.023] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866b6490, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0039.023] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866b6490, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0039.023] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866b6490, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0039.023] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6c60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.023] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0039.023] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.024] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xda [0039.024] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0039.024] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0039.054] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xda, lpOverlapped=0x0) returned 1 [0039.055] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0039.056] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0039.057] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.057] CloseHandle (hObject=0x100) returned 1 [0039.057] CloseHandle (hObject=0xfc) returned 1 [0039.058] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json.dvodltmf")) returned 0 [0039.059] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json.dvodltmf")) returned 0x2020 [0039.059] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6c60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0039.059] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6c60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.059] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0039.059] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json")) returned 1 [0039.060] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json")) returned 0xffffffff [0039.060] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6c60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.060] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0039.060] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0039.060] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0039.060] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0039.060] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.061] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.062] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0039.062] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf8 [0039.062] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0039.063] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0039.091] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xf8, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xf8, lpOverlapped=0x0) returned 1 [0039.092] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x100, lpOverlapped=0x0) returned 1 [0039.093] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0039.093] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.094] CloseHandle (hObject=0xfc) returned 1 [0039.094] CloseHandle (hObject=0x100) returned 1 [0039.095] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json.dvodltmf")) returned 0 [0039.096] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json.dvodltmf")) returned 0x2020 [0039.096] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0039.096] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.096] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0039.096] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json")) returned 1 [0039.097] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json")) returned 0xffffffff [0039.097] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.097] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0039.097] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0039.097] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0039.097] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0039.097] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.098] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0039.098] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.098] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd6 [0039.098] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0039.098] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0039.126] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd6, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd6, lpOverlapped=0x0) returned 1 [0039.127] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0039.128] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0039.128] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.129] CloseHandle (hObject=0x100) returned 1 [0039.129] CloseHandle (hObject=0xfc) returned 1 [0039.130] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json.dvodltmf")) returned 0 [0039.130] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json.dvodltmf")) returned 0x2020 [0039.130] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0039.130] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.130] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0039.130] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json")) returned 1 [0039.131] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json")) returned 0xffffffff [0039.131] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.131] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0039.131] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0039.131] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0039.132] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0039.132] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.132] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.133] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0039.133] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfe [0039.133] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0039.133] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0039.161] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xfe, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xfe, lpOverlapped=0x0) returned 1 [0039.162] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x100, lpOverlapped=0x0) returned 1 [0039.163] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0039.163] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.163] CloseHandle (hObject=0xfc) returned 1 [0039.164] CloseHandle (hObject=0x100) returned 1 [0039.165] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json.dvodltmf")) returned 0 [0039.165] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json.dvodltmf")) returned 0x2020 [0039.165] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0039.165] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.165] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0039.165] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json")) returned 1 [0039.166] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json")) returned 0xffffffff [0039.166] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.166] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0039.166] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0039.166] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0039.167] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0039.167] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.167] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0039.167] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.167] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe3 [0039.167] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0039.168] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0039.194] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xe3, lpOverlapped=0x0) returned 1 [0039.195] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0039.196] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0039.197] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.197] CloseHandle (hObject=0x100) returned 1 [0039.197] CloseHandle (hObject=0xfc) returned 1 [0039.198] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json.dvodltmf")) returned 0 [0039.199] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json.dvodltmf")) returned 0x2020 [0039.199] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0039.199] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.199] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0039.199] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json")) returned 1 [0039.200] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json")) returned 0xffffffff [0039.200] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.200] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0039.200] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0039.200] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0039.200] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0039.200] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.200] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.201] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0039.201] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x108 [0039.201] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0039.202] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0039.233] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x108, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x108, lpOverlapped=0x0) returned 1 [0039.234] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0039.235] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0039.235] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.235] CloseHandle (hObject=0xfc) returned 1 [0039.236] CloseHandle (hObject=0x100) returned 1 [0039.236] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json.dvodltmf")) returned 0 [0039.237] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json.dvodltmf")) returned 0x2020 [0039.237] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0039.237] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.237] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0039.237] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json")) returned 1 [0039.238] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json")) returned 0xffffffff [0039.238] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.238] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0039.238] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0039.238] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0039.238] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0039.238] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.238] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0039.239] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.239] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe1 [0039.239] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0039.239] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0039.266] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe1, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xe1, lpOverlapped=0x0) returned 1 [0039.267] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0039.268] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0039.269] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.269] CloseHandle (hObject=0x100) returned 1 [0039.269] CloseHandle (hObject=0xfc) returned 1 [0039.270] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json.dvodltmf")) returned 0 [0039.270] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json.dvodltmf")) returned 0x2020 [0039.270] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0039.270] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.270] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0039.270] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json")) returned 1 [0039.271] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json")) returned 0xffffffff [0039.271] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.271] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0039.272] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0039.272] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0039.272] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0039.272] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.272] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.272] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0039.272] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xce [0039.272] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0039.273] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0039.299] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xce, lpOverlapped=0x0) returned 1 [0039.300] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xd0, lpOverlapped=0x0) returned 1 [0039.301] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0039.301] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.302] CloseHandle (hObject=0xfc) returned 1 [0039.302] CloseHandle (hObject=0x100) returned 1 [0039.303] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json.dvodltmf")) returned 0 [0039.303] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json.dvodltmf")) returned 0x2020 [0039.303] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0039.303] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.303] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0039.303] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json")) returned 1 [0039.304] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json")) returned 0xffffffff [0039.304] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.304] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0039.304] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0039.304] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0039.304] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0039.305] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.305] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0039.305] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.305] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xce [0039.305] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0039.305] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0039.343] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xce, lpOverlapped=0x0) returned 1 [0039.344] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xd0, lpOverlapped=0x0) returned 1 [0039.345] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0039.345] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.345] CloseHandle (hObject=0x100) returned 1 [0039.345] CloseHandle (hObject=0xfc) returned 1 [0039.346] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json.dvodltmf")) returned 0 [0039.347] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json.dvodltmf")) returned 0x2020 [0039.347] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0039.347] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.347] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0039.347] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json")) returned 1 [0039.348] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json")) returned 0xffffffff [0039.348] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.348] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0039.348] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0039.348] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0039.348] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867288b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8687f510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0039.348] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867288b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8687f510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0039.348] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867288b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8687f510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.348] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8687f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8687f510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 1 [0039.348] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0039.349] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.351] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x160 [0039.351] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0039.351] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0039.378] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18df70*=0x160, lpOverlapped=0x0) returned 1 [0039.379] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18df70*=0x170, lpOverlapped=0x0) returned 1 [0039.379] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0039.380] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.380] CloseHandle (hObject=0xf8) returned 1 [0039.380] CloseHandle (hObject=0xfc) returned 1 [0039.381] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json.dvodltmf")) returned 0 [0039.381] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json.dvodltmf")) returned 0x2020 [0039.382] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json", lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8687f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8687f510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x2dee70, dwReserved1=0x18dfe4, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 0x2e84d8 [0039.382] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8687f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8687f510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x2dee70, dwReserved1=0x18dfe4, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 0 [0039.382] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0039.382] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json")) returned 1 [0039.383] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json")) returned 0xffffffff [0039.383] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x867288b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86727140, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x2ded10, dwReserved1=0x18df7c, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0039.383] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.383] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0039.383] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b56 [0039.383] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0039.383] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0039.411] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2b56, lpNumberOfBytesRead=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18df70*=0x2b56, lpOverlapped=0x0) returned 1 [0039.414] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2b60, lpNumberOfBytesWritten=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18df70*=0x2b60, lpOverlapped=0x0) returned 1 [0039.415] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0039.416] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.416] CloseHandle (hObject=0xfc) returned 1 [0039.416] CloseHandle (hObject=0xf8) returned 1 [0039.417] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json.dvodltmf")) returned 0 [0039.417] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json.dvodltmf")) returned 0x2020 [0039.417] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json", lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x867288b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86727140, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x2dee70, dwReserved1=0x18dfe4, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0x2e84d8 [0039.418] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x867288b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86727140, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x2dee70, dwReserved1=0x18dfe4, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0039.418] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0039.418] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json")) returned 1 [0039.419] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json")) returned 0xffffffff [0039.419] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x867288b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86727140, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x2ded10, dwReserved1=0x18df7c, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0039.419] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0039.419] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867288b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8687f510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0039.419] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0039.419] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="0.9_0", cAlternateFileName="")) returned 0 [0039.419] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0039.419] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x819d0bd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e6b4, cFileName="apdfllckaahabafndbhieahigkjlhalf", cAlternateFileName="APDFLL~1")) returned 1 [0039.419] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x819d0bd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0039.420] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x819d0bd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.420] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x871928f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="14.1_0", cAlternateFileName="")) returned 1 [0039.420] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x871928f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0039.422] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x871928f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="..", cAlternateFileName="")) returned 1 [0039.422] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x871928f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a33, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="128.png", cAlternateFileName="")) returned 1 [0039.422] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0039.422] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0039.423] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a33 [0039.423] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0039.423] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0039.458] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1a33, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0x1a33, lpOverlapped=0x0) returned 1 [0039.459] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1a40, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0x1a40, lpOverlapped=0x0) returned 1 [0039.460] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0039.461] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.461] CloseHandle (hObject=0xf4) returned 1 [0039.461] CloseHandle (hObject=0xf8) returned 1 [0039.462] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.dvodltmf")) returned 0 [0039.463] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.dvodltmf")) returned 0x2020 [0039.463] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x871928f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a33, dwReserved0=0x2dee40, dwReserved1=0x18e24c, cFileName="128.png", cAlternateFileName="")) returned 0x2e8498 [0039.463] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x871928f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a33, dwReserved0=0x2dee40, dwReserved1=0x18e24c, cFileName="128.png", cAlternateFileName="")) returned 0 [0039.463] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0039.463] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png")) returned 1 [0039.464] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png")) returned 0xffffffff [0039.464] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8716c790, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ec, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0039.464] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0039.464] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0039.465] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ec [0039.465] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0039.465] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0039.492] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3ec, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0x3ec, lpOverlapped=0x0) returned 1 [0039.494] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0x3f0, lpOverlapped=0x0) returned 1 [0039.495] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0039.495] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.495] CloseHandle (hObject=0xf8) returned 1 [0039.496] CloseHandle (hObject=0xf4) returned 1 [0039.496] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json.dvodltmf")) returned 0 [0039.497] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json.dvodltmf")) returned 0x2020 [0039.497] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8716c790, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ec, dwReserved0=0x2dee50, dwReserved1=0x18e24c, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 0x2e8498 [0039.497] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8716c790, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ec, dwReserved0=0x2dee50, dwReserved1=0x18e24c, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 0 [0039.497] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0039.497] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json")) returned 1 [0039.498] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json")) returned 0xffffffff [0039.498] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="_locales", cAlternateFileName="")) returned 1 [0039.498] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0039.500] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.500] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0039.500] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x670069, dwReserved1=0x6a006b, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0039.500] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x670069, dwReserved1=0x6a006b, cFileName="..", cAlternateFileName="")) returned 1 [0039.500] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x670069, dwReserved1=0x6a006b, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.500] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.501] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0039.501] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x116 [0039.501] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0039.501] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0039.528] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x116, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x116, lpOverlapped=0x0) returned 1 [0039.529] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x120, lpOverlapped=0x0) returned 1 [0039.530] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0039.531] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.531] CloseHandle (hObject=0xfc) returned 1 [0039.531] CloseHandle (hObject=0x100) returned 1 [0039.532] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json.dvodltmf")) returned 0 [0039.532] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json.dvodltmf")) returned 0x2020 [0039.532] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0039.532] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.533] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0039.533] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json")) returned 1 [0039.533] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json")) returned 0xffffffff [0039.534] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x670069, dwReserved1=0x6a006b, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.534] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0039.534] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0039.534] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0039.534] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0039.534] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13f, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.534] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0039.534] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.534] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13f [0039.535] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0039.535] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0039.570] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x13f, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x13f, lpOverlapped=0x0) returned 1 [0039.571] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x140, lpOverlapped=0x0) returned 1 [0039.572] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0039.573] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.573] CloseHandle (hObject=0x100) returned 1 [0039.573] CloseHandle (hObject=0xfc) returned 1 [0039.574] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json.dvodltmf")) returned 0 [0039.574] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json.dvodltmf")) returned 0x2020 [0039.575] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13f, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0039.575] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13f, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.575] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0039.575] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json")) returned 1 [0039.576] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json")) returned 0xffffffff [0039.576] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13f, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.576] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0039.576] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0039.576] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0039.576] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0039.576] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.576] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.577] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0039.578] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x109 [0039.578] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0039.578] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0039.605] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x109, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x109, lpOverlapped=0x0) returned 1 [0039.606] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0039.607] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0039.608] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.608] CloseHandle (hObject=0xfc) returned 1 [0039.608] CloseHandle (hObject=0x100) returned 1 [0039.609] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json.dvodltmf")) returned 0 [0039.609] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json.dvodltmf")) returned 0x2020 [0039.609] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0039.610] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.610] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0039.610] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json")) returned 1 [0039.611] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json")) returned 0xffffffff [0039.611] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.611] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0039.611] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0039.611] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0039.611] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0039.611] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.611] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0039.611] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.612] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x103 [0039.612] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0039.612] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0039.641] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x103, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x103, lpOverlapped=0x0) returned 1 [0039.642] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0039.643] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0039.643] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.643] CloseHandle (hObject=0x100) returned 1 [0039.643] CloseHandle (hObject=0xfc) returned 1 [0039.644] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json.dvodltmf")) returned 0 [0039.645] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json.dvodltmf")) returned 0x2020 [0039.645] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0039.645] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.645] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0039.645] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json")) returned 1 [0039.646] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json")) returned 0xffffffff [0039.646] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.646] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0039.646] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0039.646] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0039.646] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0039.646] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.646] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.647] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0039.648] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf3 [0039.648] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0039.648] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0039.678] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xf3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xf3, lpOverlapped=0x0) returned 1 [0039.679] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x100, lpOverlapped=0x0) returned 1 [0039.680] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0039.681] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.681] CloseHandle (hObject=0xfc) returned 1 [0039.681] CloseHandle (hObject=0x100) returned 1 [0039.682] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json.dvodltmf")) returned 0 [0039.682] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json.dvodltmf")) returned 0x2020 [0039.682] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0039.682] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.683] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0039.683] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json")) returned 1 [0039.684] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json")) returned 0xffffffff [0039.684] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.684] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0039.684] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0039.684] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0039.684] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0039.685] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.685] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0039.685] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.685] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x100 [0039.685] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0039.685] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0039.714] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x100, lpOverlapped=0x0) returned 1 [0039.714] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0039.715] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0039.716] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.716] CloseHandle (hObject=0x100) returned 1 [0039.716] CloseHandle (hObject=0xfc) returned 1 [0039.717] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json.dvodltmf")) returned 0 [0039.717] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json.dvodltmf")) returned 0x2020 [0039.717] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0039.718] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.718] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0039.718] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json")) returned 1 [0039.719] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json")) returned 0xffffffff [0039.719] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.719] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0039.719] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0039.719] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0039.719] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0039.719] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x149, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.719] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.721] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0039.721] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x149 [0039.721] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0039.722] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0039.749] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x149, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x149, lpOverlapped=0x0) returned 1 [0039.752] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x150, lpOverlapped=0x0) returned 1 [0039.753] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0039.753] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.753] CloseHandle (hObject=0xfc) returned 1 [0039.754] CloseHandle (hObject=0x100) returned 1 [0039.754] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json.dvodltmf")) returned 0 [0039.755] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json.dvodltmf")) returned 0x2020 [0039.755] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x149, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0039.755] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x149, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.755] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0039.755] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json")) returned 1 [0039.756] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json")) returned 0xffffffff [0039.756] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x149, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.756] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0039.756] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0039.756] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0039.756] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0039.756] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.757] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0039.757] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.757] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf9 [0039.757] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0039.757] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0039.784] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xf9, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xf9, lpOverlapped=0x0) returned 1 [0039.785] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x100, lpOverlapped=0x0) returned 1 [0039.786] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0039.786] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.787] CloseHandle (hObject=0x100) returned 1 [0039.787] CloseHandle (hObject=0xfc) returned 1 [0039.788] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json.dvodltmf")) returned 0 [0039.789] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json.dvodltmf")) returned 0x2020 [0039.789] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0039.789] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.789] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0039.789] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json")) returned 1 [0039.790] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json")) returned 0xffffffff [0039.790] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.790] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0039.790] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1 [0039.790] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0039.790] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0039.790] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.791] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.791] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0039.792] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf9 [0039.792] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0039.792] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0039.819] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xf9, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xf9, lpOverlapped=0x0) returned 1 [0039.820] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x100, lpOverlapped=0x0) returned 1 [0039.821] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0039.822] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.822] CloseHandle (hObject=0xfc) returned 1 [0039.822] CloseHandle (hObject=0x100) returned 1 [0039.823] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json.dvodltmf")) returned 0 [0039.823] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json.dvodltmf")) returned 0x2020 [0039.823] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0039.823] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.823] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0039.823] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json")) returned 1 [0039.824] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json")) returned 0xffffffff [0039.824] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.824] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0039.824] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0039.825] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0039.825] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0039.825] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.825] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0039.825] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.825] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x103 [0039.825] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0039.826] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0039.853] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x103, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x103, lpOverlapped=0x0) returned 1 [0039.854] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0039.855] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0039.855] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.855] CloseHandle (hObject=0x100) returned 1 [0039.856] CloseHandle (hObject=0xfc) returned 1 [0039.856] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json.dvodltmf")) returned 0 [0039.857] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json.dvodltmf")) returned 0x2020 [0039.857] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0039.857] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.857] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0039.857] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json")) returned 1 [0039.858] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json")) returned 0xffffffff [0039.858] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.858] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0039.858] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="es_419", cAlternateFileName="")) returned 1 [0039.858] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0039.858] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0039.858] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.858] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.859] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0039.859] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x103 [0039.859] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0039.860] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0039.887] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x103, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x103, lpOverlapped=0x0) returned 1 [0039.888] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0039.889] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0039.889] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.889] CloseHandle (hObject=0xfc) returned 1 [0039.889] CloseHandle (hObject=0x100) returned 1 [0039.891] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json.dvodltmf")) returned 0 [0039.891] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json.dvodltmf")) returned 0x2020 [0039.891] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0039.891] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.891] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0039.891] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json")) returned 1 [0039.892] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json")) returned 0xffffffff [0039.892] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.892] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0039.892] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0039.892] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0039.893] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0039.893] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.893] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0039.893] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.893] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfb [0039.893] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0039.893] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0039.920] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xfb, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xfb, lpOverlapped=0x0) returned 1 [0039.921] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x100, lpOverlapped=0x0) returned 1 [0039.922] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0039.923] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.923] CloseHandle (hObject=0x100) returned 1 [0039.923] CloseHandle (hObject=0xfc) returned 1 [0039.924] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.dvodltmf")) returned 0 [0039.924] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.dvodltmf")) returned 0x2020 [0039.924] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0039.924] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.924] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0039.924] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json")) returned 1 [0039.925] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json")) returned 0xffffffff [0039.925] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.925] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0039.925] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1 [0039.926] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0039.926] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0039.926] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.926] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.927] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0039.928] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf3 [0039.928] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0039.928] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0039.955] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xf3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xf3, lpOverlapped=0x0) returned 1 [0039.957] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x100, lpOverlapped=0x0) returned 1 [0039.957] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0039.958] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.958] CloseHandle (hObject=0xfc) returned 1 [0039.958] CloseHandle (hObject=0x100) returned 1 [0039.960] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json.dvodltmf")) returned 0 [0039.960] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json.dvodltmf")) returned 0x2020 [0039.960] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0039.960] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.960] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0039.960] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json")) returned 1 [0039.961] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json")) returned 0xffffffff [0039.961] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.961] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0039.962] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0039.962] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0039.962] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0039.962] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.962] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0039.962] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.962] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x101 [0039.962] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0039.963] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0039.990] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x101, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x101, lpOverlapped=0x0) returned 1 [0039.991] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0039.992] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0039.993] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.993] CloseHandle (hObject=0x100) returned 1 [0039.993] CloseHandle (hObject=0xfc) returned 1 [0039.994] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json.dvodltmf")) returned 0 [0039.994] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json.dvodltmf")) returned 0x2020 [0039.994] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0039.994] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.994] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0039.995] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json")) returned 1 [0039.995] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json")) returned 0xffffffff [0039.995] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.996] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0039.996] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0039.996] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0039.996] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0039.996] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.996] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.997] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0039.997] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x104 [0039.997] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0039.997] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0040.025] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x104, lpOverlapped=0x0) returned 1 [0040.026] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0040.027] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0040.027] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.028] CloseHandle (hObject=0xfc) returned 1 [0040.028] CloseHandle (hObject=0x100) returned 1 [0040.029] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json.dvodltmf")) returned 0 [0040.029] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json.dvodltmf")) returned 0x2020 [0040.029] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0040.029] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.029] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0040.029] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json")) returned 1 [0040.030] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json")) returned 0xffffffff [0040.030] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.030] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0040.030] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0040.030] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0040.031] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0040.031] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.031] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.031] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.031] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfc [0040.031] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0040.032] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0040.060] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xfc, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xfc, lpOverlapped=0x0) returned 1 [0040.061] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x100, lpOverlapped=0x0) returned 1 [0040.064] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0040.064] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.064] CloseHandle (hObject=0x100) returned 1 [0040.065] CloseHandle (hObject=0xfc) returned 1 [0040.065] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json.dvodltmf")) returned 0 [0040.066] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json.dvodltmf")) returned 0x2020 [0040.066] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0040.066] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.066] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0040.066] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json")) returned 1 [0040.067] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json")) returned 0xffffffff [0040.067] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.067] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0040.067] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0040.067] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0040.068] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0040.068] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.068] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.068] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.069] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x116 [0040.069] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0040.069] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0040.097] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x116, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x116, lpOverlapped=0x0) returned 1 [0040.098] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x120, lpOverlapped=0x0) returned 1 [0040.099] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0040.099] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.099] CloseHandle (hObject=0xfc) returned 1 [0040.099] CloseHandle (hObject=0x100) returned 1 [0040.100] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json.dvodltmf")) returned 0 [0040.101] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json.dvodltmf")) returned 0x2020 [0040.101] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0040.101] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.101] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0040.101] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json")) returned 1 [0040.102] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json")) returned 0xffffffff [0040.102] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.102] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0040.102] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0040.102] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0040.103] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0040.103] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x159, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.103] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.103] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.103] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x159 [0040.103] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0040.103] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0040.131] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x159, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x159, lpOverlapped=0x0) returned 1 [0040.132] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x160, lpOverlapped=0x0) returned 1 [0040.133] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0040.134] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.134] CloseHandle (hObject=0x100) returned 1 [0040.134] CloseHandle (hObject=0xfc) returned 1 [0040.135] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json.dvodltmf")) returned 0 [0040.136] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json.dvodltmf")) returned 0x2020 [0040.136] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x159, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0040.136] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x159, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.136] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0040.136] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json")) returned 1 [0040.137] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json")) returned 0xffffffff [0040.137] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x159, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.137] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0040.137] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0040.137] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0040.137] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0040.137] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x107, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.138] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.138] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.139] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x107 [0040.139] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0040.139] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0040.167] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x107, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x107, lpOverlapped=0x0) returned 1 [0040.168] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0040.169] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0040.170] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.170] CloseHandle (hObject=0xfc) returned 1 [0040.170] CloseHandle (hObject=0x100) returned 1 [0040.172] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json.dvodltmf")) returned 0 [0040.173] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json.dvodltmf")) returned 0x2020 [0040.173] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x107, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0040.173] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x107, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.173] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0040.173] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json")) returned 1 [0040.174] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json")) returned 0xffffffff [0040.174] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x107, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.174] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0040.174] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0040.175] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0040.175] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0040.175] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.175] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.175] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.175] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x108 [0040.175] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0040.176] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0040.205] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x108, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x108, lpOverlapped=0x0) returned 1 [0040.206] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0040.207] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0040.207] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.207] CloseHandle (hObject=0x100) returned 1 [0040.208] CloseHandle (hObject=0xfc) returned 1 [0040.208] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json.dvodltmf")) returned 0 [0040.209] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json.dvodltmf")) returned 0x2020 [0040.209] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0040.209] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.209] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0040.209] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json")) returned 1 [0040.210] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json")) returned 0xffffffff [0040.210] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.210] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0040.210] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0040.210] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0040.210] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0040.211] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x105, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.211] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.211] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.212] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x105 [0040.212] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0040.212] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0040.241] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x105, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x105, lpOverlapped=0x0) returned 1 [0040.242] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0040.243] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0040.243] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.244] CloseHandle (hObject=0xfc) returned 1 [0040.244] CloseHandle (hObject=0x100) returned 1 [0040.245] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json.dvodltmf")) returned 0 [0040.245] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json.dvodltmf")) returned 0x2020 [0040.245] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x105, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0040.245] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x105, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.245] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0040.245] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json")) returned 1 [0040.246] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json")) returned 0xffffffff [0040.246] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x105, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.246] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0040.246] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0040.246] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0040.247] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0040.247] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.247] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.247] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.247] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x102 [0040.247] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0040.248] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0040.278] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x102, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x102, lpOverlapped=0x0) returned 1 [0040.279] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0040.280] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0040.280] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.281] CloseHandle (hObject=0x100) returned 1 [0040.281] CloseHandle (hObject=0xfc) returned 1 [0040.282] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json.dvodltmf")) returned 0 [0040.282] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json.dvodltmf")) returned 0x2020 [0040.282] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0040.282] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.282] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0040.282] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json")) returned 1 [0040.283] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json")) returned 0xffffffff [0040.283] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.283] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0040.283] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0040.283] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0040.284] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0040.284] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.284] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.285] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.285] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x125 [0040.285] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0040.285] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0040.314] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x125, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x125, lpOverlapped=0x0) returned 1 [0040.315] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x130, lpOverlapped=0x0) returned 1 [0040.315] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0040.316] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.316] CloseHandle (hObject=0xfc) returned 1 [0040.316] CloseHandle (hObject=0x100) returned 1 [0040.317] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json.dvodltmf")) returned 0 [0040.318] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json.dvodltmf")) returned 0x2020 [0040.318] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0040.318] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.318] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0040.318] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json")) returned 1 [0040.319] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json")) returned 0xffffffff [0040.319] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.319] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0040.319] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0040.319] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0040.319] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0040.320] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.320] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.320] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.320] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x119 [0040.320] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0040.321] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0040.372] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x119, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x119, lpOverlapped=0x0) returned 1 [0040.373] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x120, lpOverlapped=0x0) returned 1 [0040.374] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0040.375] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.375] CloseHandle (hObject=0x100) returned 1 [0040.375] CloseHandle (hObject=0xfc) returned 1 [0040.376] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json.dvodltmf")) returned 0 [0040.376] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json.dvodltmf")) returned 0x2020 [0040.377] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0040.377] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.377] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0040.377] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json")) returned 1 [0040.378] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json")) returned 0xffffffff [0040.378] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.378] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0040.378] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0040.378] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0040.378] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0040.378] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11d, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.379] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.380] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.380] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11d [0040.380] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0040.380] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0040.409] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x11d, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x11d, lpOverlapped=0x0) returned 1 [0040.410] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x120, lpOverlapped=0x0) returned 1 [0040.411] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0040.411] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.412] CloseHandle (hObject=0xfc) returned 1 [0040.412] CloseHandle (hObject=0x100) returned 1 [0040.413] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json.dvodltmf")) returned 0 [0040.413] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json.dvodltmf")) returned 0x2020 [0040.413] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11d, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0040.413] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11d, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.413] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0040.413] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json")) returned 1 [0040.414] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json")) returned 0xffffffff [0040.414] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11d, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.414] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0040.414] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0040.414] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0040.415] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0040.415] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.415] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.415] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.416] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x102 [0040.416] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0040.416] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0040.444] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x102, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x102, lpOverlapped=0x0) returned 1 [0040.445] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0040.446] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0040.446] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.447] CloseHandle (hObject=0x100) returned 1 [0040.447] CloseHandle (hObject=0xfc) returned 1 [0040.448] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json.dvodltmf")) returned 0 [0040.448] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json.dvodltmf")) returned 0x2020 [0040.448] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0040.448] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.448] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0040.448] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json")) returned 1 [0040.449] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json")) returned 0xffffffff [0040.449] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.449] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0040.449] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1 [0040.449] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0040.450] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0040.450] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.450] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.458] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.459] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfe [0040.459] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0040.459] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0040.487] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xfe, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xfe, lpOverlapped=0x0) returned 1 [0040.488] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x100, lpOverlapped=0x0) returned 1 [0040.489] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0040.489] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.489] CloseHandle (hObject=0xfc) returned 1 [0040.489] CloseHandle (hObject=0x100) returned 1 [0040.490] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json.dvodltmf")) returned 0 [0040.491] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json.dvodltmf")) returned 0x2020 [0040.491] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0040.491] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.491] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0040.491] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json")) returned 1 [0040.492] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json")) returned 0xffffffff [0040.492] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.492] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0040.492] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0040.492] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0040.492] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0040.492] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.492] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.492] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.493] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf2 [0040.493] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0040.493] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0040.521] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xf2, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xf2, lpOverlapped=0x0) returned 1 [0040.522] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x100, lpOverlapped=0x0) returned 1 [0040.523] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0040.523] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.523] CloseHandle (hObject=0x100) returned 1 [0040.523] CloseHandle (hObject=0xfc) returned 1 [0040.524] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json.dvodltmf")) returned 0 [0040.525] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json.dvodltmf")) returned 0x2020 [0040.525] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0040.525] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.525] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0040.525] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json")) returned 1 [0040.526] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json")) returned 0xffffffff [0040.526] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.526] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0040.526] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0040.526] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0040.526] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0040.526] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.526] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.527] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.528] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xda [0040.528] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0040.528] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0040.556] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xda, lpOverlapped=0x0) returned 1 [0040.557] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0040.557] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0040.558] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.558] CloseHandle (hObject=0xfc) returned 1 [0040.558] CloseHandle (hObject=0x100) returned 1 [0040.559] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json.dvodltmf")) returned 0 [0040.559] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json.dvodltmf")) returned 0x2020 [0040.560] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0040.560] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.560] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0040.560] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json")) returned 1 [0040.561] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json")) returned 0xffffffff [0040.561] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.561] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0040.561] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0040.561] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0040.561] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0040.561] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.561] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.561] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.562] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x101 [0040.562] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0040.562] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0040.590] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x101, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x101, lpOverlapped=0x0) returned 1 [0040.591] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0040.592] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0040.592] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.592] CloseHandle (hObject=0x100) returned 1 [0040.592] CloseHandle (hObject=0xfc) returned 1 [0040.593] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json.dvodltmf")) returned 0 [0040.594] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json.dvodltmf")) returned 0x2020 [0040.594] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0040.594] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.594] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0040.594] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json")) returned 1 [0040.595] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json")) returned 0xffffffff [0040.595] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.595] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0040.595] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0040.595] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0040.595] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0040.595] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.595] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.596] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.596] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf6 [0040.596] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0040.597] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0040.624] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xf6, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xf6, lpOverlapped=0x0) returned 1 [0040.627] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x100, lpOverlapped=0x0) returned 1 [0040.628] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0040.628] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.628] CloseHandle (hObject=0xfc) returned 1 [0040.628] CloseHandle (hObject=0x100) returned 1 [0040.629] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json.dvodltmf")) returned 0 [0040.630] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json.dvodltmf")) returned 0x2020 [0040.630] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0040.630] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.630] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0040.630] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json")) returned 1 [0040.631] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json")) returned 0xffffffff [0040.631] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.631] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0040.631] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0040.631] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0040.631] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0040.631] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.631] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.631] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.632] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x108 [0040.632] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0040.632] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0040.660] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x108, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x108, lpOverlapped=0x0) returned 1 [0040.661] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0040.662] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0040.662] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.663] CloseHandle (hObject=0x100) returned 1 [0040.663] CloseHandle (hObject=0xfc) returned 1 [0040.664] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json.dvodltmf")) returned 0 [0040.664] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json.dvodltmf")) returned 0x2020 [0040.664] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0040.664] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.664] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0040.664] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json")) returned 1 [0040.665] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json")) returned 0xffffffff [0040.665] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.665] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0040.666] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0040.666] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0040.666] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0040.666] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.666] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.667] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.667] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x119 [0040.667] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0040.667] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0040.696] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x119, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x119, lpOverlapped=0x0) returned 1 [0040.697] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x120, lpOverlapped=0x0) returned 1 [0040.698] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0040.698] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.698] CloseHandle (hObject=0xfc) returned 1 [0040.698] CloseHandle (hObject=0x100) returned 1 [0040.699] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json.dvodltmf")) returned 0 [0040.700] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json.dvodltmf")) returned 0x2020 [0040.700] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0040.700] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.700] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0040.700] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json")) returned 1 [0040.701] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json")) returned 0xffffffff [0040.701] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.701] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0040.701] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0040.701] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0040.701] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0040.701] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.701] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.702] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.702] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x152 [0040.702] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0040.702] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0040.732] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x152, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x152, lpOverlapped=0x0) returned 1 [0040.734] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x160, lpOverlapped=0x0) returned 1 [0040.734] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0040.735] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.735] CloseHandle (hObject=0x100) returned 1 [0040.735] CloseHandle (hObject=0xfc) returned 1 [0040.736] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json.dvodltmf")) returned 0 [0040.737] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json.dvodltmf")) returned 0x2020 [0040.737] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0040.737] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.737] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0040.737] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json")) returned 1 [0040.738] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json")) returned 0xffffffff [0040.738] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.738] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0040.738] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0040.738] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0040.738] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0040.738] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f7ed20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.738] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.739] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.740] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x112 [0040.740] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0040.740] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0040.768] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x112, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x112, lpOverlapped=0x0) returned 1 [0040.769] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x120, lpOverlapped=0x0) returned 1 [0040.770] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0040.770] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.771] CloseHandle (hObject=0xfc) returned 1 [0040.771] CloseHandle (hObject=0x100) returned 1 [0040.772] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json.dvodltmf")) returned 0 [0040.772] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json.dvodltmf")) returned 0x2020 [0040.772] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f7ed20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0040.772] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f7ed20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.772] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0040.773] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json")) returned 1 [0040.773] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json")) returned 0xffffffff [0040.773] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f7ed20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.773] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0040.774] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0040.774] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0040.774] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0040.774] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.774] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.774] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.775] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10c [0040.775] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0040.775] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0040.803] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x10c, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x10c, lpOverlapped=0x0) returned 1 [0040.804] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0040.805] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0040.805] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.806] CloseHandle (hObject=0x100) returned 1 [0040.806] CloseHandle (hObject=0xfc) returned 1 [0040.807] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json.dvodltmf")) returned 0 [0040.807] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json.dvodltmf")) returned 0x2020 [0040.807] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0040.807] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.807] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0040.808] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json")) returned 1 [0040.808] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json")) returned 0xffffffff [0040.808] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.808] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0040.809] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0040.809] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0040.809] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0040.809] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11f, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.809] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.810] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.810] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11f [0040.810] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0040.810] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0040.838] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x11f, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x11f, lpOverlapped=0x0) returned 1 [0040.839] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x120, lpOverlapped=0x0) returned 1 [0040.840] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0040.840] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.841] CloseHandle (hObject=0xfc) returned 1 [0040.841] CloseHandle (hObject=0x100) returned 1 [0040.842] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json.dvodltmf")) returned 0 [0040.842] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json.dvodltmf")) returned 0x2020 [0040.842] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11f, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0040.842] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11f, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.842] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0040.842] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json")) returned 1 [0040.843] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json")) returned 0xffffffff [0040.843] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11f, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.843] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0040.844] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0040.844] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0040.844] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0040.844] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.844] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.844] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.844] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfd [0040.844] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0040.845] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0040.872] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xfd, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xfd, lpOverlapped=0x0) returned 1 [0040.873] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x100, lpOverlapped=0x0) returned 1 [0040.874] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0040.875] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.875] CloseHandle (hObject=0x100) returned 1 [0040.875] CloseHandle (hObject=0xfc) returned 1 [0040.876] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json.dvodltmf")) returned 0 [0040.877] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json.dvodltmf")) returned 0x2020 [0040.877] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0040.877] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.877] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0040.877] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json")) returned 1 [0040.878] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json")) returned 0xffffffff [0040.878] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.878] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0040.878] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0040.878] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0040.878] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0040.879] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x164, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.879] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.880] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.880] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x164 [0040.880] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0040.880] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0040.908] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x164, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x164, lpOverlapped=0x0) returned 1 [0040.909] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x170, lpOverlapped=0x0) returned 1 [0040.910] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0040.910] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.911] CloseHandle (hObject=0xfc) returned 1 [0040.911] CloseHandle (hObject=0x100) returned 1 [0040.912] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json.dvodltmf")) returned 0 [0040.912] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json.dvodltmf")) returned 0x2020 [0040.912] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x164, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0040.912] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x164, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.912] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0040.912] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json")) returned 1 [0040.913] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json")) returned 0xffffffff [0040.913] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x164, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.913] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0040.915] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0040.915] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0040.916] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0040.916] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.916] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.916] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.916] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10e [0040.916] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0040.916] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0040.944] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x10e, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x10e, lpOverlapped=0x0) returned 1 [0040.945] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0040.946] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0040.946] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.946] CloseHandle (hObject=0x100) returned 1 [0040.946] CloseHandle (hObject=0xfc) returned 1 [0040.947] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json.dvodltmf")) returned 0 [0040.948] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json.dvodltmf")) returned 0x2020 [0040.948] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0040.948] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.948] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0040.948] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json")) returned 1 [0040.949] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json")) returned 0xffffffff [0040.949] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.949] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0040.949] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0040.949] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0040.950] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0040.950] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x161, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.950] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.950] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.951] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x161 [0040.951] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0040.951] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0040.979] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x161, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x161, lpOverlapped=0x0) returned 1 [0040.980] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x170, lpOverlapped=0x0) returned 1 [0040.981] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0040.981] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.982] CloseHandle (hObject=0xfc) returned 1 [0040.982] CloseHandle (hObject=0x100) returned 1 [0040.983] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json.dvodltmf")) returned 0 [0040.983] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json.dvodltmf")) returned 0x2020 [0040.983] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x161, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0040.983] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x161, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.983] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0040.983] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json")) returned 1 [0040.984] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json")) returned 0xffffffff [0040.984] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x161, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.984] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0040.985] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0040.985] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0040.985] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0040.985] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.985] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.985] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.985] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x117 [0040.985] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0040.986] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0041.014] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x117, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x117, lpOverlapped=0x0) returned 1 [0041.015] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x120, lpOverlapped=0x0) returned 1 [0041.016] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0041.016] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.016] CloseHandle (hObject=0x100) returned 1 [0041.016] CloseHandle (hObject=0xfc) returned 1 [0041.017] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json.dvodltmf")) returned 0 [0041.018] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json.dvodltmf")) returned 0x2020 [0041.018] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0041.018] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.018] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0041.018] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json")) returned 1 [0041.019] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json")) returned 0xffffffff [0041.019] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.019] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0041.019] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0041.019] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0041.019] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0041.020] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x111, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0041.020] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0041.020] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.021] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x111 [0041.021] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0041.021] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0041.049] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x111, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x111, lpOverlapped=0x0) returned 1 [0041.050] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x120, lpOverlapped=0x0) returned 1 [0041.051] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0041.052] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.052] CloseHandle (hObject=0xfc) returned 1 [0041.052] CloseHandle (hObject=0x100) returned 1 [0041.053] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json.dvodltmf")) returned 0 [0041.053] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json.dvodltmf")) returned 0x2020 [0041.053] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x111, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0041.054] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x111, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.054] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0041.054] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json")) returned 1 [0041.055] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json")) returned 0xffffffff [0041.055] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x111, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.055] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0041.055] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0041.055] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0041.055] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0041.055] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0041.055] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.055] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0041.056] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10b [0041.056] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0041.056] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0041.085] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x10b, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x10b, lpOverlapped=0x0) returned 1 [0041.086] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0041.087] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0041.089] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.090] CloseHandle (hObject=0x100) returned 1 [0041.090] CloseHandle (hObject=0xfc) returned 1 [0041.091] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json.dvodltmf")) returned 0 [0041.091] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json.dvodltmf")) returned 0x2020 [0041.091] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0041.092] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.092] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0041.092] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json")) returned 1 [0041.093] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json")) returned 0xffffffff [0041.093] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.093] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0041.093] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0041.093] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0041.093] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0041.093] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0041.093] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.093] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0x2bd5, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0041.093] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0041.094] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0041.094] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2bd5 [0041.094] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0041.095] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0041.122] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2bd5, lpNumberOfBytesRead=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18df70*=0x2bd5, lpOverlapped=0x0) returned 1 [0041.124] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18df70*=0x2be0, lpOverlapped=0x0) returned 1 [0041.126] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0041.126] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.126] CloseHandle (hObject=0xf8) returned 1 [0041.126] CloseHandle (hObject=0xfc) returned 1 [0041.128] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json.dvodltmf")) returned 0 [0041.128] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json.dvodltmf")) returned 0x2020 [0041.128] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json", lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0x2bd5, dwReserved0=0x2dee78, dwReserved1=0x18dfe4, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0x2e84d8 [0041.128] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0x2bd5, dwReserved0=0x2dee78, dwReserved1=0x18dfe4, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0041.128] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0041.128] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json")) returned 1 [0041.129] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json")) returned 0xffffffff [0041.129] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0x2bd5, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0041.129] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0041.129] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0041.129] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0041.130] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x871928f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="14.1_0", cAlternateFileName="")) returned 0 [0041.130] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0041.130] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81a42ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e6b4, cFileName="blpcfgokakmgnkcojhhkbfbldkacnbeo", cAlternateFileName="BLPCFG~1")) returned 1 [0041.130] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81a42ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0041.130] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81a42ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.130] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="4.2.8_0", cAlternateFileName="4278E1~1.8_0")) returned 1 [0041.130] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0041.133] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="..", cAlternateFileName="")) returned 1 [0041.133] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4e, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="128.png", cAlternateFileName="")) returned 1 [0041.133] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0041.134] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0041.134] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd4e [0041.134] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0041.134] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0041.179] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd4e, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0xd4e, lpOverlapped=0x0) returned 1 [0041.181] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0xd50, lpOverlapped=0x0) returned 1 [0041.182] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0041.182] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.183] CloseHandle (hObject=0xf4) returned 1 [0041.183] CloseHandle (hObject=0xfc) returned 1 [0041.184] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.dvodltmf")) returned 0 [0041.184] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.dvodltmf")) returned 0x2020 [0041.184] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4e, dwReserved0=0x2dee48, dwReserved1=0x18e24c, cFileName="128.png", cAlternateFileName="")) returned 0x2e8498 [0041.184] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4e, dwReserved0=0x2dee48, dwReserved1=0x18e24c, cFileName="128.png", cAlternateFileName="")) returned 0 [0041.184] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0041.184] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png")) returned 1 [0041.185] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png")) returned 0xffffffff [0041.185] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0041.185] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0041.186] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0041.186] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d8 [0041.186] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0041.186] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0041.214] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2d8, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0x2d8, lpOverlapped=0x0) returned 1 [0041.216] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0x2e0, lpOverlapped=0x0) returned 1 [0041.217] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0041.218] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.218] CloseHandle (hObject=0xfc) returned 1 [0041.218] CloseHandle (hObject=0xf4) returned 1 [0041.219] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json.dvodltmf")) returned 0 [0041.219] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json.dvodltmf")) returned 0x2020 [0041.220] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x2dee50, dwReserved1=0x18e24c, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 0x2e8498 [0041.220] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x2dee50, dwReserved1=0x18e24c, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 0 [0041.220] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0041.220] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json")) returned 1 [0041.221] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json")) returned 0xffffffff [0041.221] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="_locales", cAlternateFileName="")) returned 1 [0041.221] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0041.222] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.222] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0041.222] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64006c, dwReserved1=0x61006b, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0041.223] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64006c, dwReserved1=0x61006b, cFileName="..", cAlternateFileName="")) returned 1 [0041.223] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x64006c, dwReserved1=0x61006b, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0041.223] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0041.223] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.223] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0041.223] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0041.224] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0041.273] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0041.273] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0041.274] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0041.275] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.275] CloseHandle (hObject=0xf8) returned 1 [0041.275] CloseHandle (hObject=0x100) returned 1 [0041.276] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json.dvodltmf")) returned 0 [0041.277] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json.dvodltmf")) returned 0x2020 [0041.277] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0041.277] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.277] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0041.277] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json")) returned 1 [0041.278] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json")) returned 0xffffffff [0041.278] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x64006c, dwReserved1=0x61006b, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.278] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0041.278] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0041.278] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0041.279] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0041.279] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0041.279] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.279] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0041.280] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0041.280] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0041.280] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0041.308] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0041.309] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0041.310] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0041.311] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.311] CloseHandle (hObject=0x100) returned 1 [0041.311] CloseHandle (hObject=0xf8) returned 1 [0041.312] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json.dvodltmf")) returned 0 [0041.313] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json.dvodltmf")) returned 0x2020 [0041.313] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0041.313] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.313] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0041.313] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json")) returned 1 [0041.314] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json")) returned 0xffffffff [0041.314] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.314] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0041.314] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0041.314] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0041.314] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0041.314] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0041.315] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0041.315] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.315] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0041.315] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0041.315] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0041.344] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0041.345] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0041.346] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0041.347] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.347] CloseHandle (hObject=0xf8) returned 1 [0041.347] CloseHandle (hObject=0x100) returned 1 [0041.348] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json.dvodltmf")) returned 0 [0041.348] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json.dvodltmf")) returned 0x2020 [0041.348] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0041.349] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.349] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0041.349] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json")) returned 1 [0041.381] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json")) returned 0xffffffff [0041.381] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.381] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0041.381] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0041.381] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0041.382] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0041.382] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0041.382] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.383] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0041.383] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0041.383] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0041.383] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0041.411] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0041.412] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0041.413] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0041.414] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.414] CloseHandle (hObject=0x100) returned 1 [0041.414] CloseHandle (hObject=0xf8) returned 1 [0041.415] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json.dvodltmf")) returned 0 [0041.415] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json.dvodltmf")) returned 0x2020 [0041.415] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0041.416] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.416] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0041.416] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json")) returned 1 [0041.417] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json")) returned 0xffffffff [0041.417] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.417] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0041.417] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0041.417] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0041.417] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0041.417] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0041.417] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0041.417] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.418] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0041.418] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0041.418] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0041.446] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0041.447] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0041.448] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0041.448] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.449] CloseHandle (hObject=0xf8) returned 1 [0041.449] CloseHandle (hObject=0x100) returned 1 [0041.450] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json.dvodltmf")) returned 0 [0041.450] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json.dvodltmf")) returned 0x2020 [0041.450] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0041.450] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.450] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0041.450] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json")) returned 1 [0041.451] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json")) returned 0xffffffff [0041.451] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.451] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0041.452] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0041.452] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0041.462] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0041.462] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0041.462] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.462] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0041.462] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0041.462] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0041.463] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0041.491] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0041.492] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0041.493] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0041.493] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.494] CloseHandle (hObject=0x100) returned 1 [0041.494] CloseHandle (hObject=0xf8) returned 1 [0041.495] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json.dvodltmf")) returned 0 [0041.496] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json.dvodltmf")) returned 0x2020 [0041.496] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0041.496] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.496] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0041.496] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json")) returned 1 [0041.497] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json")) returned 0xffffffff [0041.497] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.497] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0041.497] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0041.497] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0041.497] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0041.497] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0041.498] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0041.498] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.498] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0041.498] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0041.498] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0041.526] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0041.527] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0041.528] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0041.529] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.529] CloseHandle (hObject=0xf8) returned 1 [0041.529] CloseHandle (hObject=0x100) returned 1 [0041.530] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json.dvodltmf")) returned 0 [0041.530] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json.dvodltmf")) returned 0x2020 [0041.531] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0041.531] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.531] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0041.531] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json")) returned 1 [0041.532] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json")) returned 0xffffffff [0041.532] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.532] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0041.532] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1 [0041.532] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0041.535] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0041.535] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0041.535] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.535] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0041.535] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0041.535] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0041.536] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0041.564] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0041.565] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0041.566] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0041.566] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.566] CloseHandle (hObject=0x100) returned 1 [0041.566] CloseHandle (hObject=0xf8) returned 1 [0041.567] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json.dvodltmf")) returned 0 [0041.568] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json.dvodltmf")) returned 0x2020 [0041.568] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0041.568] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.568] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0041.568] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json")) returned 1 [0041.569] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json")) returned 0xffffffff [0041.569] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.569] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0041.569] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0041.569] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0041.570] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0041.570] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0041.570] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0041.570] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.570] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0041.570] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0041.570] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0041.598] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0041.599] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0041.600] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0041.601] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.601] CloseHandle (hObject=0xf8) returned 1 [0041.601] CloseHandle (hObject=0x100) returned 1 [0041.602] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json.dvodltmf")) returned 0 [0041.602] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json.dvodltmf")) returned 0x2020 [0041.602] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0041.603] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.603] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0041.603] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json")) returned 1 [0041.604] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json")) returned 0xffffffff [0041.604] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.604] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0041.604] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0041.604] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0041.605] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0041.605] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0041.605] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.605] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0041.605] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0041.605] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0041.606] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0041.634] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0041.635] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0041.636] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0041.637] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.637] CloseHandle (hObject=0x100) returned 1 [0041.637] CloseHandle (hObject=0xf8) returned 1 [0041.640] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json.dvodltmf")) returned 0 [0041.641] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json.dvodltmf")) returned 0x2020 [0041.641] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0041.641] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.641] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0041.641] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json")) returned 1 [0041.642] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json")) returned 0xffffffff [0041.642] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.642] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0041.642] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0041.642] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0041.642] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0041.642] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0041.642] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0041.643] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.643] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0041.643] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0041.643] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0041.671] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0041.672] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0041.673] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0041.673] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.673] CloseHandle (hObject=0xf8) returned 1 [0041.674] CloseHandle (hObject=0x100) returned 1 [0041.675] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json.dvodltmf")) returned 0 [0041.675] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json.dvodltmf")) returned 0x2020 [0041.675] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0041.675] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.675] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0041.675] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json")) returned 1 [0041.676] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json")) returned 0xffffffff [0041.676] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.676] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0041.676] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0041.676] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0041.677] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0041.677] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0041.678] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.678] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0041.678] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0041.678] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0041.678] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0041.706] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0041.707] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0041.707] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0041.708] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.708] CloseHandle (hObject=0x100) returned 1 [0041.708] CloseHandle (hObject=0xf8) returned 1 [0041.710] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json.dvodltmf")) returned 0 [0041.710] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json.dvodltmf")) returned 0x2020 [0041.710] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0041.710] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.710] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0041.710] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json")) returned 1 [0041.711] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json")) returned 0xffffffff [0041.711] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.711] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0041.711] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0041.711] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0041.712] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0041.712] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0041.712] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0041.712] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.712] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0041.712] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0041.712] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0041.758] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0041.759] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0041.759] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0041.760] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.760] CloseHandle (hObject=0xf8) returned 1 [0041.760] CloseHandle (hObject=0x100) returned 1 [0041.761] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json.dvodltmf")) returned 0 [0041.762] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json.dvodltmf")) returned 0x2020 [0041.762] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0041.762] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.762] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0041.762] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json")) returned 1 [0041.763] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json")) returned 0xffffffff [0041.763] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.763] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0041.763] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0041.763] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0041.764] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0041.764] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0041.764] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.764] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0041.764] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0041.764] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0041.765] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0041.792] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0041.793] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0041.794] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0041.794] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.794] CloseHandle (hObject=0x100) returned 1 [0041.795] CloseHandle (hObject=0xf8) returned 1 [0041.795] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json.dvodltmf")) returned 0 [0041.796] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json.dvodltmf")) returned 0x2020 [0041.796] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0041.796] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.796] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0041.796] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json")) returned 1 [0041.797] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json")) returned 0xffffffff [0041.797] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.797] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0041.797] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0041.797] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0041.797] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0041.797] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0041.798] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0041.798] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.798] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0041.798] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0041.798] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0041.825] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0041.826] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0041.827] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0041.828] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.828] CloseHandle (hObject=0xf8) returned 1 [0041.828] CloseHandle (hObject=0x100) returned 1 [0041.829] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json.dvodltmf")) returned 0 [0041.829] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json.dvodltmf")) returned 0x2020 [0041.829] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0041.829] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.829] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0041.829] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json")) returned 1 [0041.830] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json")) returned 0xffffffff [0041.831] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.831] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0041.831] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0041.831] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0041.832] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0041.832] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0041.832] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.832] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0041.832] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0041.832] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0041.833] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0041.859] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0041.860] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0041.861] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0041.862] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.862] CloseHandle (hObject=0x100) returned 1 [0041.862] CloseHandle (hObject=0xf8) returned 1 [0041.863] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json.dvodltmf")) returned 0 [0041.863] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json.dvodltmf")) returned 0x2020 [0041.863] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0041.864] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.864] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0041.864] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json")) returned 1 [0041.865] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json")) returned 0xffffffff [0041.865] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.865] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0041.865] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0041.865] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0041.865] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0041.865] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0041.865] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0041.865] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.866] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0041.866] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0041.866] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0041.892] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0041.893] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0041.894] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0041.895] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.895] CloseHandle (hObject=0xf8) returned 1 [0041.895] CloseHandle (hObject=0x100) returned 1 [0041.897] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json.dvodltmf")) returned 0 [0041.897] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json.dvodltmf")) returned 0x2020 [0041.897] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0041.897] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.897] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0041.897] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json")) returned 1 [0041.898] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json")) returned 0xffffffff [0041.898] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.898] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0041.898] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0041.898] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0041.899] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0041.899] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0041.899] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.900] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0041.900] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0041.900] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0041.900] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0041.927] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0041.928] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0041.929] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0041.929] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.929] CloseHandle (hObject=0x100) returned 1 [0041.929] CloseHandle (hObject=0xf8) returned 1 [0041.930] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json.dvodltmf")) returned 0 [0041.931] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json.dvodltmf")) returned 0x2020 [0041.931] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0041.931] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.931] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0041.931] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json")) returned 1 [0041.932] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json")) returned 0xffffffff [0041.932] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.932] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0041.932] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0041.932] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0041.932] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0041.932] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0041.932] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0041.933] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.933] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0041.933] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0041.933] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0041.960] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0041.961] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0041.962] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0041.963] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.963] CloseHandle (hObject=0xf8) returned 1 [0041.963] CloseHandle (hObject=0x100) returned 1 [0041.964] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json.dvodltmf")) returned 0 [0041.964] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json.dvodltmf")) returned 0x2020 [0041.964] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0041.964] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.964] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0041.965] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json")) returned 1 [0041.965] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json")) returned 0xffffffff [0041.965] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.966] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0041.966] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0041.966] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0041.967] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0041.967] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0041.967] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.967] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0041.967] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0041.967] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0041.967] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0041.994] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0041.996] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0041.996] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0041.997] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.997] CloseHandle (hObject=0x100) returned 1 [0041.997] CloseHandle (hObject=0xf8) returned 1 [0041.998] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json.dvodltmf")) returned 0 [0041.999] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json.dvodltmf")) returned 0x2020 [0041.999] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0041.999] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0041.999] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0041.999] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json")) returned 1 [0042.000] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json")) returned 0xffffffff [0042.000] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.000] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0042.000] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0042.000] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0042.000] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0042.000] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0042.001] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.001] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.001] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0042.001] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0042.001] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0042.029] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0042.030] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0042.031] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0042.031] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0042.031] CloseHandle (hObject=0xf8) returned 1 [0042.031] CloseHandle (hObject=0x100) returned 1 [0042.032] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json.dvodltmf")) returned 0 [0042.033] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json.dvodltmf")) returned 0x2020 [0042.033] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0042.033] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.033] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0042.033] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json")) returned 1 [0042.034] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json")) returned 0xffffffff [0042.034] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.034] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0042.034] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0042.034] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0042.035] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0042.035] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0042.035] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.035] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.036] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0042.036] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0042.036] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0042.063] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0042.064] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0042.065] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0042.066] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0042.066] CloseHandle (hObject=0x100) returned 1 [0042.066] CloseHandle (hObject=0xf8) returned 1 [0042.067] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json.dvodltmf")) returned 0 [0042.068] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json.dvodltmf")) returned 0x2020 [0042.068] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0042.068] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.068] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0042.068] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json")) returned 1 [0042.069] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json")) returned 0xffffffff [0042.069] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.069] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0042.069] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0042.069] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0042.069] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0042.070] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0042.070] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.070] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.070] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0042.070] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0042.070] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0042.097] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0042.098] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0042.099] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0042.100] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0042.100] CloseHandle (hObject=0xf8) returned 1 [0042.100] CloseHandle (hObject=0x100) returned 1 [0042.101] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json.dvodltmf")) returned 0 [0042.101] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json.dvodltmf")) returned 0x2020 [0042.101] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0042.101] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.102] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0042.102] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json")) returned 1 [0042.102] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json")) returned 0xffffffff [0042.103] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.103] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0042.103] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0042.103] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0042.104] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0042.104] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c12fb00, ftLastWriteTime.dwHighDateTime=0x1d0f3ee, nFileSizeHigh=0x0, nFileSizeLow=0x9f, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0042.104] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.104] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.104] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9f [0042.105] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0042.105] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0042.132] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x9f, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x9f, lpOverlapped=0x0) returned 1 [0042.133] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xa0, lpOverlapped=0x0) returned 1 [0042.134] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0042.134] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0042.135] CloseHandle (hObject=0x100) returned 1 [0042.135] CloseHandle (hObject=0xf8) returned 1 [0042.136] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json.dvodltmf")) returned 0 [0042.136] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json.dvodltmf")) returned 0x2020 [0042.136] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c12fb00, ftLastWriteTime.dwHighDateTime=0x1d0f3ee, nFileSizeHigh=0x0, nFileSizeLow=0x9f, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0042.136] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c12fb00, ftLastWriteTime.dwHighDateTime=0x1d0f3ee, nFileSizeHigh=0x0, nFileSizeLow=0x9f, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.136] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0042.136] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json")) returned 1 [0042.137] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json")) returned 0xffffffff [0042.137] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c12fb00, ftLastWriteTime.dwHighDateTime=0x1d0f3ee, nFileSizeHigh=0x0, nFileSizeLow=0x9f, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.137] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0042.138] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0042.138] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0042.138] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0042.138] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0042.138] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.138] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.138] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0042.138] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0042.139] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0042.166] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0042.167] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0042.168] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0042.168] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0042.169] CloseHandle (hObject=0xf8) returned 1 [0042.169] CloseHandle (hObject=0x100) returned 1 [0042.170] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json.dvodltmf")) returned 0 [0042.170] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json.dvodltmf")) returned 0x2020 [0042.170] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0042.170] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.170] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0042.170] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json")) returned 1 [0042.171] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json")) returned 0xffffffff [0042.171] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.171] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0042.171] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0042.172] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0042.172] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0042.172] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0042.173] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.173] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.173] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0042.173] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0042.173] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0042.201] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0042.202] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0042.203] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0042.203] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0042.204] CloseHandle (hObject=0x100) returned 1 [0042.204] CloseHandle (hObject=0xf8) returned 1 [0042.205] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json.dvodltmf")) returned 0 [0042.205] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json.dvodltmf")) returned 0x2020 [0042.205] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0042.205] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.205] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0042.205] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json")) returned 1 [0042.206] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json")) returned 0xffffffff [0042.206] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.206] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0042.206] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0042.207] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0042.207] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0042.207] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0042.207] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.207] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.207] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0042.207] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0042.208] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0042.234] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0042.235] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0042.236] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0042.236] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0042.237] CloseHandle (hObject=0xf8) returned 1 [0042.237] CloseHandle (hObject=0x100) returned 1 [0042.238] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json.dvodltmf")) returned 0 [0042.238] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json.dvodltmf")) returned 0x2020 [0042.239] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0042.239] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.239] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0042.239] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json")) returned 1 [0042.240] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json")) returned 0xffffffff [0042.240] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.240] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0042.240] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0042.240] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0042.242] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0042.242] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0042.243] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.243] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.243] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0042.243] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0042.243] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0042.270] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0042.272] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0042.273] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0042.274] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0042.274] CloseHandle (hObject=0x100) returned 1 [0042.274] CloseHandle (hObject=0xf8) returned 1 [0042.275] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json.dvodltmf")) returned 0 [0042.276] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json.dvodltmf")) returned 0x2020 [0042.276] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0042.276] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.276] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0042.276] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json")) returned 1 [0042.277] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json")) returned 0xffffffff [0042.277] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.277] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0042.277] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0042.277] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0042.277] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0042.277] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0042.277] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.277] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.278] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0042.278] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0042.278] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0042.306] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0042.307] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0042.308] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0042.309] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0042.309] CloseHandle (hObject=0xf8) returned 1 [0042.309] CloseHandle (hObject=0x100) returned 1 [0042.310] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json.dvodltmf")) returned 0 [0042.310] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json.dvodltmf")) returned 0x2020 [0042.310] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0042.310] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.310] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0042.311] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json")) returned 1 [0042.311] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json")) returned 0xffffffff [0042.312] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.312] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0042.312] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0042.312] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0042.313] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0042.313] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0042.313] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.313] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.313] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0042.313] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0042.314] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0042.340] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0042.341] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0042.342] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0042.343] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0042.343] CloseHandle (hObject=0x100) returned 1 [0042.343] CloseHandle (hObject=0xf8) returned 1 [0042.344] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json.dvodltmf")) returned 0 [0042.344] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json.dvodltmf")) returned 0x2020 [0042.344] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0042.344] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.344] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0042.344] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json")) returned 1 [0042.345] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json")) returned 0xffffffff [0042.345] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.345] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0042.346] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0042.346] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0042.346] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0042.346] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0042.346] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.346] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.346] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0042.346] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0042.347] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0042.377] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0042.378] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0042.379] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0042.379] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0042.379] CloseHandle (hObject=0xf8) returned 1 [0042.379] CloseHandle (hObject=0x100) returned 1 [0042.380] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json.dvodltmf")) returned 0 [0042.381] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json.dvodltmf")) returned 0x2020 [0042.381] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0042.381] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.381] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0042.381] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json")) returned 1 [0042.382] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json")) returned 0xffffffff [0042.382] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.382] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0042.382] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0042.382] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0042.383] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0042.383] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0042.383] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.383] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.384] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0042.384] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0042.384] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0042.410] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0042.411] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0042.412] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0042.413] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0042.413] CloseHandle (hObject=0x100) returned 1 [0042.413] CloseHandle (hObject=0xf8) returned 1 [0042.414] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json.dvodltmf")) returned 0 [0042.414] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json.dvodltmf")) returned 0x2020 [0042.415] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0042.415] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.415] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0042.415] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json")) returned 1 [0042.416] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json")) returned 0xffffffff [0042.416] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.416] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0042.416] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0042.416] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0042.416] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0042.416] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0042.416] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.416] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.417] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0042.417] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0042.417] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0042.444] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0042.445] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0042.446] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0042.446] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0042.446] CloseHandle (hObject=0xf8) returned 1 [0042.446] CloseHandle (hObject=0x100) returned 1 [0042.447] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json.dvodltmf")) returned 0 [0042.448] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json.dvodltmf")) returned 0x2020 [0042.448] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0042.448] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.448] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0042.448] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json")) returned 1 [0042.449] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json")) returned 0xffffffff [0042.449] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.449] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0042.449] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0042.449] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0042.470] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0042.470] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0042.470] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.470] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.471] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0042.471] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0042.471] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0042.499] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0042.500] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0042.501] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0042.501] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0042.501] CloseHandle (hObject=0x100) returned 1 [0042.502] CloseHandle (hObject=0xf8) returned 1 [0042.503] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json.dvodltmf")) returned 0 [0042.504] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json.dvodltmf")) returned 0x2020 [0042.504] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0042.504] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.504] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0042.504] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json")) returned 1 [0042.505] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json")) returned 0xffffffff [0042.505] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.505] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0042.505] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0042.505] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0042.505] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0042.505] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0042.505] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.506] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.506] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0042.506] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0042.506] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0042.534] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0042.535] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0042.535] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0042.536] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0042.536] CloseHandle (hObject=0xf8) returned 1 [0042.536] CloseHandle (hObject=0x100) returned 1 [0042.537] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json.dvodltmf")) returned 0 [0042.538] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json.dvodltmf")) returned 0x2020 [0042.538] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0042.539] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.539] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0042.539] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json")) returned 1 [0042.540] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json")) returned 0xffffffff [0042.540] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.540] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0042.540] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0042.540] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0042.542] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0042.542] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0042.542] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.542] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.543] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0042.543] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0042.543] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0042.579] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0042.580] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0042.581] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0042.590] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0042.594] CloseHandle (hObject=0x100) returned 1 [0042.595] CloseHandle (hObject=0xf8) returned 1 [0042.595] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json.dvodltmf")) returned 0 [0042.595] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json.dvodltmf")) returned 0x2020 [0042.595] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0042.595] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.595] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0042.596] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json")) returned 1 [0042.596] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json")) returned 0xffffffff [0042.596] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.597] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0042.597] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0042.597] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0042.597] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0042.597] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0042.597] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.597] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.597] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0042.598] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0042.598] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0042.643] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0042.644] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0042.645] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0042.665] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0042.673] CloseHandle (hObject=0xf8) returned 1 [0042.673] CloseHandle (hObject=0x100) returned 1 [0042.674] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json.dvodltmf")) returned 0 [0042.675] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json.dvodltmf")) returned 0x2020 [0042.675] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0042.675] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.675] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0042.675] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json")) returned 1 [0042.676] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json")) returned 0xffffffff [0042.676] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.676] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0042.676] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0042.676] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0042.677] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0042.677] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0042.677] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.677] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.678] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0042.678] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0042.678] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0042.716] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0042.717] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0042.717] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0042.728] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0042.733] CloseHandle (hObject=0x100) returned 1 [0042.734] CloseHandle (hObject=0xf8) returned 1 [0042.735] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json.dvodltmf")) returned 0 [0042.735] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json.dvodltmf")) returned 0x2020 [0042.735] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0042.735] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.735] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0042.735] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json")) returned 1 [0042.736] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json")) returned 0xffffffff [0042.736] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.736] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0042.736] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0042.737] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0042.737] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0042.737] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0042.737] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.737] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.737] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0042.737] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0042.738] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0042.783] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0042.784] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0042.785] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0042.804] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0042.814] CloseHandle (hObject=0xf8) returned 1 [0042.814] CloseHandle (hObject=0x100) returned 1 [0042.815] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json.dvodltmf")) returned 0 [0042.815] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json.dvodltmf")) returned 0x2020 [0042.815] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0042.816] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.816] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0042.816] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json")) returned 1 [0042.817] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json")) returned 0xffffffff [0042.817] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0042.817] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0042.817] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0042.817] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0042.817] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0042.817] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0042.817] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.817] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x628aed00, ftLastWriteTime.dwHighDateTime=0x1d0f5b2, nFileSizeHigh=0x0, nFileSizeLow=0x2769, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0042.817] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0042.818] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.818] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2769 [0042.818] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0042.818] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0042.861] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2769, lpNumberOfBytesRead=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18df70*=0x2769, lpOverlapped=0x0) returned 1 [0042.865] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2770, lpNumberOfBytesWritten=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18df70*=0x2770, lpOverlapped=0x0) returned 1 [0042.866] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0042.885] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0042.894] CloseHandle (hObject=0xfc) returned 1 [0042.894] CloseHandle (hObject=0x100) returned 1 [0042.896] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json.dvodltmf")) returned 0 [0042.897] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json.dvodltmf")) returned 0x2020 [0042.897] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json", lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x628aed00, ftLastWriteTime.dwHighDateTime=0x1d0f5b2, nFileSizeHigh=0x0, nFileSizeLow=0x2769, dwReserved0=0x2dee78, dwReserved1=0x18dfe4, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0x2e84d8 [0042.897] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x628aed00, ftLastWriteTime.dwHighDateTime=0x1d0f5b2, nFileSizeHigh=0x0, nFileSizeLow=0x2769, dwReserved0=0x2dee78, dwReserved1=0x18dfe4, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0042.897] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0042.897] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json")) returned 1 [0042.898] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json")) returned 0xffffffff [0042.898] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x628aed00, ftLastWriteTime.dwHighDateTime=0x1d0f5b2, nFileSizeHigh=0x0, nFileSizeLow=0x2769, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0042.898] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0042.898] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0042.898] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0042.898] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="4.2.8_0", cAlternateFileName="4278E1~1.8_0")) returned 0 [0042.898] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0042.898] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x844bb8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844c0700, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844c0700, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e6b4, cFileName="felcaaldnbdncclmgdcncolpebgiejap", cAlternateFileName="FELCAA~1")) returned 1 [0042.898] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x844bb8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844c0700, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844c0700, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0042.899] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x844bb8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844c0700, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844c0700, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.899] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8401b790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="1.1_0", cAlternateFileName="")) returned 1 [0042.899] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8401b790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0042.901] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8401b790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="..", cAlternateFileName="")) returned 1 [0042.901] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84234950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd47, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="icon_128.png", cAlternateFileName="")) returned 1 [0042.901] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0042.902] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.903] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd47 [0042.903] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0042.903] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0042.945] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd47, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0xd47, lpOverlapped=0x0) returned 1 [0042.947] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0xd50, lpOverlapped=0x0) returned 1 [0042.948] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0042.967] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0042.977] CloseHandle (hObject=0xf4) returned 1 [0042.977] CloseHandle (hObject=0x100) returned 1 [0042.978] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.dvodltmf")) returned 0 [0042.978] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.dvodltmf")) returned 0x2020 [0042.978] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84234950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd47, dwReserved0=0x2dee48, dwReserved1=0x18e24c, cFileName="icon_128.png", cAlternateFileName="")) returned 0x2e8498 [0042.978] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84234950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd47, dwReserved0=0x2dee48, dwReserved1=0x18e24c, cFileName="icon_128.png", cAlternateFileName="")) returned 0 [0042.979] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0042.979] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png")) returned 1 [0042.980] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png")) returned 0xffffffff [0042.980] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84239770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9d, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="icon_16.png", cAlternateFileName="")) returned 1 [0042.980] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.981] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0042.981] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9d [0042.981] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0042.981] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0043.022] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x9d, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0x9d, lpOverlapped=0x0) returned 1 [0043.023] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0xa0, lpOverlapped=0x0) returned 1 [0043.024] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0043.043] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0043.052] CloseHandle (hObject=0x100) returned 1 [0043.053] CloseHandle (hObject=0xf4) returned 1 [0043.053] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.dvodltmf")) returned 0 [0043.054] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.dvodltmf")) returned 0x2020 [0043.054] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84239770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9d, dwReserved0=0x2dee48, dwReserved1=0x18e24c, cFileName="icon_16.png", cAlternateFileName="")) returned 0x2e8498 [0043.054] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84239770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9d, dwReserved0=0x2dee48, dwReserved1=0x18e24c, cFileName="icon_16.png", cAlternateFileName="")) returned 0 [0043.054] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0043.054] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png")) returned 1 [0043.055] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png")) returned 0xffffffff [0043.055] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8423be80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8423e590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5c, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="main.html", cAlternateFileName="MAIN~1.HTM")) returned 1 [0043.055] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0043.055] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0043.056] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5c [0043.056] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0043.056] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0043.095] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x5c, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0x5c, lpOverlapped=0x0) returned 1 [0043.096] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0x60, lpOverlapped=0x0) returned 1 [0043.097] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0043.114] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0043.123] CloseHandle (hObject=0xf4) returned 1 [0043.123] CloseHandle (hObject=0x100) returned 1 [0043.124] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.dvodltmf")) returned 0 [0043.124] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.dvodltmf")) returned 0x2020 [0043.124] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8423be80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8423e590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5c, dwReserved0=0x2dee48, dwReserved1=0x18e24c, cFileName="main.html", cAlternateFileName="MAIN~1.HTM")) returned 0x2e8498 [0043.124] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8423be80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8423e590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5c, dwReserved0=0x2dee48, dwReserved1=0x18e24c, cFileName="main.html", cAlternateFileName="MAIN~1.HTM")) returned 0 [0043.125] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0043.125] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html")) returned 1 [0043.125] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html")) returned 0xffffffff [0043.126] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84240ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84240ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5f, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="main.js", cAlternateFileName="")) returned 1 [0043.126] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0043.126] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0043.126] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5f [0043.126] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0043.126] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0043.166] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x5f, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0x5f, lpOverlapped=0x0) returned 1 [0043.167] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0x60, lpOverlapped=0x0) returned 1 [0043.167] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0043.186] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0043.196] CloseHandle (hObject=0x100) returned 1 [0043.196] CloseHandle (hObject=0xf4) returned 1 [0043.197] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js.dvodltmf")) returned 0 [0043.198] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js.dvodltmf")) returned 0x2020 [0043.198] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84240ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84240ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5f, dwReserved0=0x2dee40, dwReserved1=0x18e24c, cFileName="main.js", cAlternateFileName="")) returned 0x2e8498 [0043.198] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84240ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84240ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5f, dwReserved0=0x2dee40, dwReserved1=0x18e24c, cFileName="main.js", cAlternateFileName="")) returned 0 [0043.198] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0043.198] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js")) returned 1 [0043.199] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js")) returned 0xffffffff [0043.199] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x840205b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84245ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844aa770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0043.199] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0043.199] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0043.199] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d6 [0043.199] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0043.200] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0043.239] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2d6, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0x2d6, lpOverlapped=0x0) returned 1 [0043.241] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0x2e0, lpOverlapped=0x0) returned 1 [0043.242] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0043.261] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0043.271] CloseHandle (hObject=0xf4) returned 1 [0043.271] CloseHandle (hObject=0x100) returned 1 [0043.272] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json.dvodltmf")) returned 0 [0043.272] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json.dvodltmf")) returned 0x2020 [0043.272] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x840205b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84245ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844aa770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x2dee50, dwReserved1=0x18e24c, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 0x2e8498 [0043.272] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x840205b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84245ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844aa770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x2dee50, dwReserved1=0x18e24c, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 0 [0043.273] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0043.273] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json")) returned 1 [0043.274] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json")) returned 0xffffffff [0043.274] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8402f010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422fb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422fb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="_locales", cAlternateFileName="")) returned 1 [0043.274] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8402f010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422fb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422fb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0043.275] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8402f010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422fb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422fb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.275] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84036540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8403b360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0043.275] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84036540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8403b360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650070, dwReserved1=0x670062, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0043.275] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84036540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8403b360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650070, dwReserved1=0x670062, cFileName="..", cAlternateFileName="")) returned 1 [0043.275] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8403b360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x650070, dwReserved1=0x670062, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0043.276] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0043.276] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.277] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfe [0043.277] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0043.277] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0043.315] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xfe, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xfe, lpOverlapped=0x0) returned 1 [0043.316] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x100, lpOverlapped=0x0) returned 1 [0043.317] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0043.342] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0043.358] CloseHandle (hObject=0xfc) returned 1 [0043.358] CloseHandle (hObject=0xf8) returned 1 [0043.359] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json.dvodltmf")) returned 0 [0043.359] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json.dvodltmf")) returned 0x2020 [0043.360] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8403b360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0043.360] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8403b360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0043.360] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0043.360] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json")) returned 1 [0043.361] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json")) returned 0xffffffff [0043.361] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8403b360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x650070, dwReserved1=0x670062, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0043.361] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0043.361] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x840512f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84056110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84056110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0043.361] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x840512f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84056110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84056110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0043.361] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x840512f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84056110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84056110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0043.361] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84056110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84058820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0043.361] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.361] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0043.362] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12f [0043.362] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0043.362] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0043.400] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x12f, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x12f, lpOverlapped=0x0) returned 1 [0043.401] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x130, lpOverlapped=0x0) returned 1 [0043.402] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0043.421] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0043.431] CloseHandle (hObject=0xf8) returned 1 [0043.431] CloseHandle (hObject=0xfc) returned 1 [0043.432] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json.dvodltmf")) returned 0 [0043.432] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json.dvodltmf")) returned 0x2020 [0043.432] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84056110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84058820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0043.432] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84056110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84058820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0043.433] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0043.433] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json")) returned 1 [0043.433] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json")) returned 0xffffffff [0043.434] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84056110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84058820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0043.434] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0043.434] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84062460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84067280, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0043.434] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84062460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84067280, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0043.434] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84062460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84067280, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0043.434] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84067280, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0043.434] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0043.435] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.435] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe5 [0043.435] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0043.436] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0043.474] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe5, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xe5, lpOverlapped=0x0) returned 1 [0043.475] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0043.476] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0043.495] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0043.504] CloseHandle (hObject=0xfc) returned 1 [0043.505] CloseHandle (hObject=0xf8) returned 1 [0043.505] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json.dvodltmf")) returned 0 [0043.506] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json.dvodltmf")) returned 0x2020 [0043.506] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84067280, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0043.506] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84067280, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0043.506] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0043.506] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json")) returned 1 [0043.507] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json")) returned 0xffffffff [0043.507] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84067280, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0043.507] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0043.507] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8406e7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8407f920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8407f920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0043.507] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8406e7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8407f920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8407f920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0043.508] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8406e7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8407f920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8407f920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0043.508] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8407f920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84082030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0043.508] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.508] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0043.508] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xda [0043.508] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0043.508] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0043.547] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xda, lpOverlapped=0x0) returned 1 [0043.548] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0043.557] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0043.577] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0043.586] CloseHandle (hObject=0xf8) returned 1 [0043.586] CloseHandle (hObject=0xfc) returned 1 [0043.587] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json.dvodltmf")) returned 0 [0043.587] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json.dvodltmf")) returned 0x2020 [0043.588] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8407f920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84082030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0043.588] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8407f920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84082030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0043.588] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0043.588] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json")) returned 1 [0043.589] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json")) returned 0xffffffff [0043.589] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8407f920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84082030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0043.589] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0043.589] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8408bc70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84090a90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0043.589] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8408bc70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84090a90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0043.589] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8408bc70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84090a90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0043.589] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84090a90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0043.589] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0043.590] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.590] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcf [0043.590] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0043.591] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0043.631] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xcf, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xcf, lpOverlapped=0x0) returned 1 [0043.632] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xd0, lpOverlapped=0x0) returned 1 [0043.633] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0043.653] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0043.662] CloseHandle (hObject=0xfc) returned 1 [0043.663] CloseHandle (hObject=0xf8) returned 1 [0043.663] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json.dvodltmf")) returned 0 [0043.664] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json.dvodltmf")) returned 0x2020 [0043.664] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84090a90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0043.664] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84090a90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0043.664] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0043.664] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json")) returned 1 [0043.665] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json")) returned 0xffffffff [0043.665] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84090a90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0043.665] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0043.667] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84097fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8409cde0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0043.668] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84097fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8409cde0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0043.668] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84097fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8409cde0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0043.668] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8409cde0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0043.668] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.668] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0043.668] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdc [0043.668] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0043.669] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0043.707] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xdc, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xdc, lpOverlapped=0x0) returned 1 [0043.708] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0043.709] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0043.729] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0043.738] CloseHandle (hObject=0xf8) returned 1 [0043.738] CloseHandle (hObject=0xfc) returned 1 [0043.739] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json.dvodltmf")) returned 0 [0043.740] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json.dvodltmf")) returned 0x2020 [0043.740] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8409cde0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0043.740] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8409cde0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0043.740] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0043.740] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json")) returned 1 [0043.741] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json")) returned 0xffffffff [0043.741] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8409cde0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0043.741] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0043.741] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841147f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84116f00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0043.741] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841147f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84116f00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0043.741] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841147f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84116f00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0043.741] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84116f00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0043.741] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0043.759] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.761] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x130 [0043.761] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0043.762] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0043.801] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x130, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x130, lpOverlapped=0x0) returned 1 [0043.802] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x140, lpOverlapped=0x0) returned 1 [0043.802] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0043.822] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0043.831] CloseHandle (hObject=0xfc) returned 1 [0043.831] CloseHandle (hObject=0xf8) returned 1 [0043.832] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json.dvodltmf")) returned 0 [0043.833] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json.dvodltmf")) returned 0x2020 [0043.833] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84116f00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0043.833] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84116f00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0043.833] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0043.833] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json")) returned 1 [0043.834] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json")) returned 0xffffffff [0043.834] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84116f00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0043.834] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0043.834] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8411bd20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84120b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0043.834] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8411bd20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84120b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0043.834] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8411bd20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84120b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0043.834] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84120b40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0043.834] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.834] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0043.835] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd5 [0043.835] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0043.835] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0043.874] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd5, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd5, lpOverlapped=0x0) returned 1 [0043.875] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0043.876] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0043.896] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0043.905] CloseHandle (hObject=0xf8) returned 1 [0043.905] CloseHandle (hObject=0xfc) returned 1 [0043.907] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json.dvodltmf")) returned 0 [0043.907] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json.dvodltmf")) returned 0x2020 [0043.907] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84120b40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0043.907] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84120b40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0043.907] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0043.907] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json")) returned 1 [0043.908] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json")) returned 0xffffffff [0043.908] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84120b40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0043.908] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0043.909] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8412a780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8412ce90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1 [0043.909] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8412a780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8412ce90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0043.909] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8412a780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8412ce90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0043.909] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8412ce90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0043.909] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0043.910] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.910] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd5 [0043.910] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0043.910] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0043.949] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd5, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd5, lpOverlapped=0x0) returned 1 [0043.950] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0043.951] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0043.971] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0043.980] CloseHandle (hObject=0xfc) returned 1 [0043.980] CloseHandle (hObject=0xf8) returned 1 [0043.981] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json.dvodltmf")) returned 0 [0043.982] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json.dvodltmf")) returned 0x2020 [0043.982] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8412ce90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0043.982] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8412ce90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0043.982] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0043.982] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json")) returned 1 [0043.983] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json")) returned 0xffffffff [0043.983] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8412ce90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0043.983] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0043.983] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84131cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841343c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0043.983] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84131cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841343c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0043.984] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84131cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841343c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0043.984] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841343c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0043.984] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.984] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0043.984] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe5 [0043.984] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0043.984] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0044.024] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe5, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xe5, lpOverlapped=0x0) returned 1 [0044.025] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0044.026] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0044.045] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0044.055] CloseHandle (hObject=0xf8) returned 1 [0044.055] CloseHandle (hObject=0xfc) returned 1 [0044.056] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json.dvodltmf")) returned 0 [0044.056] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json.dvodltmf")) returned 0x2020 [0044.056] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841343c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0044.056] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841343c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.056] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0044.057] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json")) returned 1 [0044.057] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json")) returned 0xffffffff [0044.057] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841343c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.058] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0044.058] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841391e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8413b8f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="es_419", cAlternateFileName="")) returned 1 [0044.058] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841391e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8413b8f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0044.058] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841391e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8413b8f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0044.058] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8413b8f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0044.058] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0044.070] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0044.071] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe5 [0044.071] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0044.071] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0044.111] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe5, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xe5, lpOverlapped=0x0) returned 1 [0044.112] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0044.113] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0044.133] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0044.142] CloseHandle (hObject=0xfc) returned 1 [0044.143] CloseHandle (hObject=0xf8) returned 1 [0044.143] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json.dvodltmf")) returned 0 [0044.144] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json.dvodltmf")) returned 0x2020 [0044.144] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8413b8f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0044.144] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8413b8f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.144] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0044.144] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json")) returned 1 [0044.145] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json")) returned 0xffffffff [0044.145] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8413b8f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.145] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0044.145] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84140710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84142e20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0044.146] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84140710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84142e20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0044.146] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84140710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84142e20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0044.146] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84142e20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0044.146] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0044.146] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0044.146] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe2 [0044.146] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0044.147] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0044.186] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xe2, lpOverlapped=0x0) returned 1 [0044.187] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0044.188] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0044.208] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0044.217] CloseHandle (hObject=0xf8) returned 1 [0044.218] CloseHandle (hObject=0xfc) returned 1 [0044.219] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json.dvodltmf")) returned 0 [0044.219] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json.dvodltmf")) returned 0x2020 [0044.219] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84142e20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0044.219] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84142e20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.219] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0044.219] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json")) returned 1 [0044.220] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json")) returned 0xffffffff [0044.220] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84142e20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.220] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0044.221] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84147c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414a350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8414a350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0044.221] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84147c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414a350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8414a350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0044.221] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84147c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414a350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8414a350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0044.221] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8414a350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414f170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0044.221] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0044.222] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0044.222] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdc [0044.222] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0044.222] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0044.262] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xdc, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xdc, lpOverlapped=0x0) returned 1 [0044.263] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0044.263] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0044.283] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0044.292] CloseHandle (hObject=0xfc) returned 1 [0044.293] CloseHandle (hObject=0xf8) returned 1 [0044.293] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json.dvodltmf")) returned 0 [0044.294] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json.dvodltmf")) returned 0x2020 [0044.294] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8414a350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414f170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0044.294] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8414a350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414f170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.294] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0044.294] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json")) returned 1 [0044.295] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json")) returned 0xffffffff [0044.295] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8414a350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414f170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.295] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0044.295] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84153f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841566a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0044.295] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84153f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841566a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0044.296] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84153f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841566a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0044.296] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841566a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0044.296] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0044.296] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0044.296] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdf [0044.296] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0044.297] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0044.337] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xdf, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xdf, lpOverlapped=0x0) returned 1 [0044.337] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0044.338] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0044.370] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0044.379] CloseHandle (hObject=0xf8) returned 1 [0044.379] CloseHandle (hObject=0xfc) returned 1 [0044.380] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json.dvodltmf")) returned 0 [0044.381] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json.dvodltmf")) returned 0x2020 [0044.381] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841566a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0044.381] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841566a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.381] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0044.381] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json")) returned 1 [0044.382] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json")) returned 0xffffffff [0044.382] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841566a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.382] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0044.382] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8415b4c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8415dbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0044.382] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8415b4c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8415dbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0044.382] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8415b4c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8415dbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0044.382] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8415dbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0044.382] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0044.383] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0044.383] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe2 [0044.384] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0044.384] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0044.422] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xe2, lpOverlapped=0x0) returned 1 [0044.423] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0044.424] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0044.444] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0044.453] CloseHandle (hObject=0xfc) returned 1 [0044.453] CloseHandle (hObject=0xf8) returned 1 [0044.454] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json.dvodltmf")) returned 0 [0044.455] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json.dvodltmf")) returned 0x2020 [0044.455] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8415dbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0044.455] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8415dbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.455] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0044.455] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json")) returned 1 [0044.456] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json")) returned 0xffffffff [0044.456] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8415dbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.456] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0044.456] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841629f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84165100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0044.456] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841629f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84165100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0044.457] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841629f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84165100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0044.457] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84165100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0044.457] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0044.457] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0044.457] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xee [0044.457] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0044.457] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0044.496] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xee, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xee, lpOverlapped=0x0) returned 1 [0044.497] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0044.498] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0044.518] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0044.527] CloseHandle (hObject=0xf8) returned 1 [0044.527] CloseHandle (hObject=0xfc) returned 1 [0044.528] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json.dvodltmf")) returned 0 [0044.529] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json.dvodltmf")) returned 0x2020 [0044.529] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84165100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0044.529] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84165100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.529] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0044.529] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json")) returned 1 [0044.530] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json")) returned 0xffffffff [0044.530] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84165100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.530] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0044.530] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84169f20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8416c630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0044.530] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84169f20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8416c630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0044.530] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84169f20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8416c630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0044.530] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8416c630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0044.530] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0044.531] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0044.531] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11a [0044.531] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0044.532] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0044.578] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x11a, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x11a, lpOverlapped=0x0) returned 1 [0044.578] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x120, lpOverlapped=0x0) returned 1 [0044.579] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0044.598] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0044.608] CloseHandle (hObject=0xfc) returned 1 [0044.608] CloseHandle (hObject=0xf8) returned 1 [0044.609] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json.dvodltmf")) returned 0 [0044.609] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json.dvodltmf")) returned 0x2020 [0044.609] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8416c630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0044.609] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8416c630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.609] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0044.610] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json")) returned 1 [0044.611] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json")) returned 0xffffffff [0044.611] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8416c630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.611] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0044.611] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84171450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84173b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84173b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0044.611] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84171450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84173b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84173b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0044.611] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84171450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84173b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84173b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0044.611] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84173b60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84173b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0044.611] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0044.612] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0044.612] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xeb [0044.612] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0044.612] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0044.652] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xeb, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xeb, lpOverlapped=0x0) returned 1 [0044.653] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0044.654] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0044.677] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0044.686] CloseHandle (hObject=0xf8) returned 1 [0044.687] CloseHandle (hObject=0xfc) returned 1 [0044.688] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json.dvodltmf")) returned 0 [0044.688] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json.dvodltmf")) returned 0x2020 [0044.689] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84173b60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84173b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0044.689] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84173b60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84173b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.689] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0044.689] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json")) returned 1 [0044.690] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json")) returned 0xffffffff [0044.690] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84173b60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84173b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.690] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0044.690] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84176270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8417b090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8417b090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0044.690] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84176270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8417b090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8417b090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0044.690] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84176270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8417b090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8417b090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0044.690] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8417b090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8417b090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0044.690] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0044.691] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0044.692] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd8 [0044.692] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0044.692] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0044.730] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd8, lpOverlapped=0x0) returned 1 [0044.731] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0044.732] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0044.752] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0044.761] CloseHandle (hObject=0xfc) returned 1 [0044.761] CloseHandle (hObject=0xf8) returned 1 [0044.762] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json.dvodltmf")) returned 0 [0044.762] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json.dvodltmf")) returned 0x2020 [0044.762] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8417b090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8417b090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0044.763] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8417b090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8417b090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.763] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0044.763] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json")) returned 1 [0044.764] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json")) returned 0xffffffff [0044.764] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8417b090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8417b090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.764] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0044.764] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8417feb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841825c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841825c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0044.764] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8417feb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841825c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841825c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0044.764] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8417feb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841825c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841825c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0044.764] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841825c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841825c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0044.764] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0044.765] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0044.765] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd7 [0044.765] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0044.765] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0044.804] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd7, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd7, lpOverlapped=0x0) returned 1 [0044.805] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0044.806] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0044.825] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0044.834] CloseHandle (hObject=0xf8) returned 1 [0044.834] CloseHandle (hObject=0xfc) returned 1 [0044.835] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json.dvodltmf")) returned 0 [0044.836] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json.dvodltmf")) returned 0x2020 [0044.836] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841825c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841825c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0044.836] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841825c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841825c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.836] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0044.836] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json")) returned 1 [0044.837] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json")) returned 0xffffffff [0044.837] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841825c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841825c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.837] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0044.837] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841873e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84189af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84189af0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0044.837] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841873e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84189af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84189af0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0044.837] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841873e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84189af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84189af0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0044.837] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84189af0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84189af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0044.837] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0044.838] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0044.839] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf5 [0044.839] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0044.839] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0044.885] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xf5, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xf5, lpOverlapped=0x0) returned 1 [0044.887] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x100, lpOverlapped=0x0) returned 1 [0044.888] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0044.908] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0044.917] CloseHandle (hObject=0xfc) returned 1 [0044.917] CloseHandle (hObject=0xf8) returned 1 [0044.919] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json.dvodltmf")) returned 0 [0044.919] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json.dvodltmf")) returned 0x2020 [0044.920] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84189af0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84189af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0044.920] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84189af0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84189af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.920] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0044.920] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json")) returned 1 [0044.921] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json")) returned 0xffffffff [0044.921] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84189af0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84189af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.921] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0044.921] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8418e910, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84191020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84191020, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0044.921] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8418e910, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84191020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84191020, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0044.922] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8418e910, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84191020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84191020, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0044.922] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84191020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84191020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0044.922] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0044.923] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0044.923] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe0 [0044.923] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0044.923] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0044.961] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0044.962] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0044.963] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0044.982] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0044.991] CloseHandle (hObject=0xf8) returned 1 [0044.991] CloseHandle (hObject=0xfc) returned 1 [0044.992] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json.dvodltmf")) returned 0 [0044.992] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json.dvodltmf")) returned 0x2020 [0044.992] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84191020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84191020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0044.992] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84191020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84191020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.993] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0044.993] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json")) returned 1 [0044.993] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json")) returned 0xffffffff [0044.994] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84191020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84191020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0044.994] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0044.994] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84195e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84198550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84198550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0044.994] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84195e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84198550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84198550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0044.994] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84195e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84198550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84198550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0044.994] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84198550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8419d370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0044.994] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0044.995] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0044.996] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xeb [0044.996] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0044.996] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0045.034] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xeb, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xeb, lpOverlapped=0x0) returned 1 [0045.035] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0045.036] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0045.055] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0045.065] CloseHandle (hObject=0xfc) returned 1 [0045.065] CloseHandle (hObject=0xf8) returned 1 [0045.066] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json.dvodltmf")) returned 0 [0045.066] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json.dvodltmf")) returned 0x2020 [0045.066] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84198550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8419d370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0045.066] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84198550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8419d370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.067] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0045.067] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json")) returned 1 [0045.067] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json")) returned 0xffffffff [0045.068] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84198550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8419d370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.068] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0045.068] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8419fa80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a2190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841a2190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0045.068] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8419fa80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a2190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841a2190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0045.068] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8419fa80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a2190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841a2190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0045.068] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841a2190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a48a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0045.068] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0045.068] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0045.069] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe5 [0045.069] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0045.069] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0045.107] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe5, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xe5, lpOverlapped=0x0) returned 1 [0045.108] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0045.110] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0045.129] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0045.139] CloseHandle (hObject=0xf8) returned 1 [0045.139] CloseHandle (hObject=0xfc) returned 1 [0045.140] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json.dvodltmf")) returned 0 [0045.140] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json.dvodltmf")) returned 0x2020 [0045.141] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841a2190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a48a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0045.141] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841a2190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a48a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.141] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0045.141] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json")) returned 1 [0045.142] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json")) returned 0xffffffff [0045.142] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841a2190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a48a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.142] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0045.142] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841a6fb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a96c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841a96c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1 [0045.142] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841a6fb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a96c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841a96c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0045.142] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841a6fb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a96c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841a96c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0045.142] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841a96c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a96c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0045.143] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0045.143] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0045.144] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd0 [0045.144] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0045.144] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0045.184] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd0, lpOverlapped=0x0) returned 1 [0045.185] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0045.185] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0045.206] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0045.215] CloseHandle (hObject=0xfc) returned 1 [0045.215] CloseHandle (hObject=0xf8) returned 1 [0045.216] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json.dvodltmf")) returned 0 [0045.217] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json.dvodltmf")) returned 0x2020 [0045.217] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841a96c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a96c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0045.217] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841a96c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a96c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.217] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0045.217] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json")) returned 1 [0045.218] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json")) returned 0xffffffff [0045.218] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841a96c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a96c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.218] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0045.218] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ae4e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b0bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0045.218] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ae4e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b0bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0045.219] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ae4e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b0bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0045.219] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b0bf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0045.219] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0045.219] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0045.219] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0045.219] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0045.220] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0045.258] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xdd, lpOverlapped=0x0) returned 1 [0045.259] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0045.260] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0045.279] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0045.288] CloseHandle (hObject=0xf8) returned 1 [0045.289] CloseHandle (hObject=0xfc) returned 1 [0045.290] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json.dvodltmf")) returned 0 [0045.290] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json.dvodltmf")) returned 0x2020 [0045.290] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b0bf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0045.290] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b0bf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.290] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0045.290] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json")) returned 1 [0045.291] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json")) returned 0xffffffff [0045.291] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b0bf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.291] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0045.291] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841b5a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b8120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0045.292] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841b5a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b8120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0045.292] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841b5a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b8120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0045.292] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b8120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xbf, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0045.292] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0045.293] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0045.293] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbf [0045.293] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0045.293] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0045.332] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xbf, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xbf, lpOverlapped=0x0) returned 1 [0045.333] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0045.334] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0045.361] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0045.371] CloseHandle (hObject=0xfc) returned 1 [0045.371] CloseHandle (hObject=0xf8) returned 1 [0045.372] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json.dvodltmf")) returned 0 [0045.372] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json.dvodltmf")) returned 0x2020 [0045.372] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b8120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xbf, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0045.372] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b8120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xbf, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.372] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0045.373] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json")) returned 1 [0045.373] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json")) returned 0xffffffff [0045.374] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b8120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xbf, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.374] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0045.374] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841bcf40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841bf650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0045.374] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841bcf40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841bf650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0045.374] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841bcf40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841bf650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0045.374] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841bf650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0045.374] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0045.374] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0045.375] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd1 [0045.375] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0045.375] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0045.413] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd1, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd1, lpOverlapped=0x0) returned 1 [0045.414] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0045.415] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0045.434] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0045.444] CloseHandle (hObject=0xf8) returned 1 [0045.444] CloseHandle (hObject=0xfc) returned 1 [0045.445] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json.dvodltmf")) returned 0 [0045.445] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json.dvodltmf")) returned 0x2020 [0045.445] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841bf650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0045.445] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841bf650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.446] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0045.446] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json")) returned 1 [0045.446] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json")) returned 0xffffffff [0045.447] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841bf650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.447] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0045.447] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841c6b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841c9290, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0045.447] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841c6b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841c9290, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0045.447] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841c6b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841c9290, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0045.447] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841c9290, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0045.447] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0045.448] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0045.448] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd5 [0045.448] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0045.449] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0045.488] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd5, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd5, lpOverlapped=0x0) returned 1 [0045.488] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0045.489] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0045.508] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0045.517] CloseHandle (hObject=0xfc) returned 1 [0045.518] CloseHandle (hObject=0xf8) returned 1 [0045.519] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json.dvodltmf")) returned 0 [0045.519] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json.dvodltmf")) returned 0x2020 [0045.519] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841c9290, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0045.519] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841c9290, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.519] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0045.519] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json")) returned 1 [0045.520] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json")) returned 0xffffffff [0045.520] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841c9290, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.520] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0045.520] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ce0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d07c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0045.520] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ce0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d07c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0045.521] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ce0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d07c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0045.521] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d07c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0045.521] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0045.521] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0045.521] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe6 [0045.521] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0045.522] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0045.559] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe6, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xe6, lpOverlapped=0x0) returned 1 [0045.560] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0045.561] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0045.580] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0045.589] CloseHandle (hObject=0xf8) returned 1 [0045.590] CloseHandle (hObject=0xfc) returned 1 [0045.591] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json.dvodltmf")) returned 0 [0045.591] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json.dvodltmf")) returned 0x2020 [0045.591] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d07c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0045.591] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d07c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.591] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0045.592] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json")) returned 1 [0045.592] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json")) returned 0xffffffff [0045.592] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d07c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.592] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0045.593] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841d55e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d7cf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0045.593] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841d55e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d7cf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0045.593] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841d55e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d7cf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0045.593] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d7cf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0045.593] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0045.603] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0045.603] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe2 [0045.603] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0045.603] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0045.644] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xe2, lpOverlapped=0x0) returned 1 [0045.645] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0045.646] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0045.664] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0045.674] CloseHandle (hObject=0xfc) returned 1 [0045.674] CloseHandle (hObject=0xf8) returned 1 [0045.676] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json.dvodltmf")) returned 0 [0045.676] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json.dvodltmf")) returned 0x2020 [0045.677] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d7cf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0045.677] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d7cf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.677] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0045.677] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json")) returned 1 [0045.678] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json")) returned 0xffffffff [0045.678] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d7cf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.678] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0045.678] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841dcb10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841df220, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0045.678] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841dcb10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841df220, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0045.678] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841dcb10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841df220, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0045.678] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841df220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0045.678] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0045.678] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0045.679] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfe [0045.679] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0045.679] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0045.718] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xfe, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xfe, lpOverlapped=0x0) returned 1 [0045.719] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x100, lpOverlapped=0x0) returned 1 [0045.720] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0045.740] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0045.750] CloseHandle (hObject=0xf8) returned 1 [0045.750] CloseHandle (hObject=0xfc) returned 1 [0045.751] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json.dvodltmf")) returned 0 [0045.751] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json.dvodltmf")) returned 0x2020 [0045.751] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841df220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0045.752] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841df220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.752] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0045.752] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json")) returned 1 [0045.753] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json")) returned 0xffffffff [0045.753] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841df220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.753] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0045.753] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841eb570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f0390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0045.753] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841eb570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f0390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0045.753] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841eb570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f0390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0045.753] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f0390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0045.753] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0045.769] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0045.770] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdb [0045.770] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0045.770] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0045.818] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xdb, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xdb, lpOverlapped=0x0) returned 1 [0045.819] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0045.819] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0045.839] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0045.848] CloseHandle (hObject=0xfc) returned 1 [0045.848] CloseHandle (hObject=0xf8) returned 1 [0045.849] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json.dvodltmf")) returned 0 [0045.850] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json.dvodltmf")) returned 0x2020 [0045.850] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f0390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0045.850] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f0390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.850] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0045.850] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json")) returned 1 [0045.851] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json")) returned 0xffffffff [0045.851] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f0390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.851] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0045.851] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841f51b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f78c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0045.851] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841f51b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f78c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0045.852] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841f51b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f78c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0045.852] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f78c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0045.852] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0045.852] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0045.852] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0045.852] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0045.853] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0045.891] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xde, lpOverlapped=0x0) returned 1 [0045.892] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0045.893] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0045.912] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0045.922] CloseHandle (hObject=0xf8) returned 1 [0045.922] CloseHandle (hObject=0xfc) returned 1 [0045.923] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json.dvodltmf")) returned 0 [0045.924] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json.dvodltmf")) returned 0x2020 [0045.924] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f78c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0045.924] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f78c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.924] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0045.924] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json")) returned 1 [0045.925] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json")) returned 0xffffffff [0045.925] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f78c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.925] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0045.925] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841fc6e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841fedf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0045.925] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841fc6e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841fedf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0045.926] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841fc6e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841fedf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0045.926] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841fedf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0045.926] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0045.927] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0045.927] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xec [0045.927] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0045.927] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0045.966] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xec, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xec, lpOverlapped=0x0) returned 1 [0045.967] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0045.968] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0045.987] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0045.996] CloseHandle (hObject=0xfc) returned 1 [0045.996] CloseHandle (hObject=0xf8) returned 1 [0045.997] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json.dvodltmf")) returned 0 [0045.998] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json.dvodltmf")) returned 0x2020 [0045.998] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841fedf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0045.998] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841fedf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.998] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0045.998] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json")) returned 1 [0045.999] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json")) returned 0xffffffff [0045.999] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841fedf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0045.999] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0045.999] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84203c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84206320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0045.999] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84203c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84206320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0046.000] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84203c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84206320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0046.000] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84206320, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0046.000] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0046.000] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0046.000] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd8 [0046.000] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0046.000] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0046.039] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd8, lpOverlapped=0x0) returned 1 [0046.040] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0046.041] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0046.060] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0046.072] CloseHandle (hObject=0xf8) returned 1 [0046.072] CloseHandle (hObject=0xfc) returned 1 [0046.073] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json.dvodltmf")) returned 0 [0046.073] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json.dvodltmf")) returned 0x2020 [0046.074] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84206320, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0046.074] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84206320, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0046.074] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0046.074] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json")) returned 1 [0046.075] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json")) returned 0xffffffff [0046.075] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84206320, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0046.075] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0046.075] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8420b140, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8420d850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0046.075] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8420b140, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8420d850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0046.075] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8420b140, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8420d850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0046.075] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8420d850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0046.075] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0046.076] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0046.077] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10a [0046.077] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0046.077] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0046.117] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x10a, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x10a, lpOverlapped=0x0) returned 1 [0046.118] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0046.119] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0046.139] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0046.148] CloseHandle (hObject=0xfc) returned 1 [0046.148] CloseHandle (hObject=0xf8) returned 1 [0046.149] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json.dvodltmf")) returned 0 [0046.150] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json.dvodltmf")) returned 0x2020 [0046.150] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8420d850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0046.150] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8420d850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0046.150] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0046.150] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json")) returned 1 [0046.151] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json")) returned 0xffffffff [0046.151] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8420d850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0046.151] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0046.151] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84212670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84212670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0046.151] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84212670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84212670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0046.151] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84212670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84212670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0046.152] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84214d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0046.152] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0046.152] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0046.152] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe1 [0046.152] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0046.152] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0046.197] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe1, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xe1, lpOverlapped=0x0) returned 1 [0046.198] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0046.199] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0046.218] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0046.228] CloseHandle (hObject=0xf8) returned 1 [0046.228] CloseHandle (hObject=0xfc) returned 1 [0046.229] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json.dvodltmf")) returned 0 [0046.230] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json.dvodltmf")) returned 0x2020 [0046.230] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84214d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0046.230] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84214d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0046.230] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0046.230] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json")) returned 1 [0046.231] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json")) returned 0xffffffff [0046.231] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84214d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0046.231] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0046.231] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84219ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8421c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0046.231] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84219ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8421c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0046.231] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84219ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8421c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0046.232] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8421c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0046.232] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0046.232] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0046.233] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfe [0046.233] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0046.233] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0046.274] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xfe, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xfe, lpOverlapped=0x0) returned 1 [0046.275] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x100, lpOverlapped=0x0) returned 1 [0046.276] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0046.295] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0046.304] CloseHandle (hObject=0xfc) returned 1 [0046.304] CloseHandle (hObject=0xf8) returned 1 [0046.305] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json.dvodltmf")) returned 0 [0046.305] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json.dvodltmf")) returned 0x2020 [0046.306] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8421c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0046.306] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8421c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0046.306] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0046.306] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json")) returned 1 [0046.307] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json")) returned 0xffffffff [0046.307] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8421c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0046.307] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0046.307] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842210d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x842237e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0046.307] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842210d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x842237e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0046.307] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842210d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x842237e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0046.307] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x842237e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0046.307] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0046.307] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0046.308] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe3 [0046.308] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0046.308] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0046.396] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xe3, lpOverlapped=0x0) returned 1 [0046.397] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0046.398] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0046.417] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0046.426] CloseHandle (hObject=0xf8) returned 1 [0046.426] CloseHandle (hObject=0xfc) returned 1 [0046.427] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json.dvodltmf")) returned 0 [0046.428] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json.dvodltmf")) returned 0x2020 [0046.428] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x842237e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0046.428] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x842237e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0046.428] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0046.428] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json")) returned 1 [0046.429] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json")) returned 0xffffffff [0046.429] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x842237e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0046.429] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0046.429] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84228600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0046.429] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84228600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0046.430] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84228600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0046.430] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8422ad10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0046.430] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0046.430] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0046.430] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd4 [0046.430] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0046.431] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0046.471] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd4, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd4, lpOverlapped=0x0) returned 1 [0046.472] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0046.473] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0046.492] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0046.502] CloseHandle (hObject=0xfc) returned 1 [0046.502] CloseHandle (hObject=0xf8) returned 1 [0046.503] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json.dvodltmf")) returned 0 [0046.503] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json.dvodltmf")) returned 0x2020 [0046.503] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8422ad10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0046.504] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8422ad10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0046.504] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0046.504] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json")) returned 1 [0046.505] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json")) returned 0xffffffff [0046.505] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8422ad10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0046.505] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0046.505] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8422fb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84232240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0046.505] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8422fb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84232240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0046.505] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8422fb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84232240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0046.505] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84232240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0046.505] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0046.505] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0046.506] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd4 [0046.506] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0046.506] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0046.545] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd4, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd4, lpOverlapped=0x0) returned 1 [0046.546] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0046.547] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0046.566] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0046.576] CloseHandle (hObject=0xf8) returned 1 [0046.576] CloseHandle (hObject=0xfc) returned 1 [0046.577] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json.dvodltmf")) returned 0 [0046.577] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json.dvodltmf")) returned 0x2020 [0046.577] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84232240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0046.577] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84232240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0046.577] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0046.578] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json")) returned 1 [0046.579] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json")) returned 0xffffffff [0046.579] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84232240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0046.579] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0046.579] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8422fb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84232240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0046.579] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0046.579] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842481d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844eed30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844eed30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0046.579] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842481d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844eed30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844eed30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0046.579] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842481d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844eed30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844eed30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.579] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x844eed30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844eed30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844eed30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 1 [0046.579] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0046.580] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0046.582] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x160 [0046.582] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0046.582] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0046.622] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18df70*=0x160, lpOverlapped=0x0) returned 1 [0046.623] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18df70*=0x170, lpOverlapped=0x0) returned 1 [0046.624] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0046.644] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0046.663] CloseHandle (hObject=0xf4) returned 1 [0046.663] CloseHandle (hObject=0xfc) returned 1 [0046.665] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json.dvodltmf")) returned 0 [0046.665] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json.dvodltmf")) returned 0x2020 [0046.665] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json", lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x844eed30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844eed30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844eed30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x2dee70, dwReserved1=0x18dfe4, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 0x2e84d8 [0046.665] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x844eed30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844eed30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844eed30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x2dee70, dwReserved1=0x18dfe4, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 0 [0046.665] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0046.665] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json")) returned 1 [0046.666] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json")) returned 0xffffffff [0046.666] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8424a8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8424a8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x2ded10, dwReserved1=0x18df7c, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0046.666] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0046.667] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0046.668] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b56 [0046.668] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0046.668] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0046.707] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2b56, lpNumberOfBytesRead=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18df70*=0x2b56, lpOverlapped=0x0) returned 1 [0046.709] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2b60, lpNumberOfBytesWritten=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18df70*=0x2b60, lpOverlapped=0x0) returned 1 [0046.710] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0046.729] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0046.738] CloseHandle (hObject=0xfc) returned 1 [0046.739] CloseHandle (hObject=0xf4) returned 1 [0046.740] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json.dvodltmf")) returned 0 [0046.740] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json.dvodltmf")) returned 0x2020 [0046.740] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json", lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8424a8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8424a8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x2dee70, dwReserved1=0x18dfe4, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0x2e84d8 [0046.740] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8424a8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8424a8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x2dee70, dwReserved1=0x18dfe4, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0046.740] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0046.740] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json")) returned 1 [0046.741] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json")) returned 0xffffffff [0046.741] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8424a8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8424a8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x2ded10, dwReserved1=0x18df7c, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0046.741] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0046.742] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842481d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844eed30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844eed30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0046.742] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0046.742] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8401b790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="1.1_0", cAlternateFileName="")) returned 0 [0046.742] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0046.742] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x862fc2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86322450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86322450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e6b4, cFileName="ghbmnnjooekpmoecnnnilnnbdlolhkhi", cAlternateFileName="GHBMNN~1")) returned 1 [0046.742] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x862fc2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86322450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86322450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0046.743] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x862fc2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86322450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86322450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.743] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x862fc2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="1.4_0", cAlternateFileName="")) returned 1 [0046.743] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x862fc2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0046.745] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x862fc2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="..", cAlternateFileName="")) returned 1 [0046.745] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x862fc2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1378, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="128.png", cAlternateFileName="")) returned 1 [0046.745] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0046.745] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0046.745] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1378 [0046.745] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0046.746] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0046.785] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1378, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0x1378, lpOverlapped=0x0) returned 1 [0046.786] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0x1380, lpOverlapped=0x0) returned 1 [0046.787] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0046.806] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0046.816] CloseHandle (hObject=0x100) returned 1 [0046.816] CloseHandle (hObject=0xf4) returned 1 [0046.817] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.dvodltmf")) returned 0 [0046.817] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.dvodltmf")) returned 0x2020 [0046.817] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x862fc2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1378, dwReserved0=0x2dee40, dwReserved1=0x18e24c, cFileName="128.png", cAlternateFileName="")) returned 0x2e8498 [0046.818] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x862fc2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1378, dwReserved0=0x2dee40, dwReserved1=0x18e24c, cFileName="128.png", cAlternateFileName="")) returned 0 [0046.818] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0046.818] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png")) returned 1 [0046.819] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png")) returned 0xffffffff [0046.819] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1103, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="contentscript_bin_prod.js", cAlternateFileName="CONTEN~1.JS")) returned 1 [0046.819] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0046.820] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0046.820] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1103 [0046.820] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0046.821] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0046.860] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1103, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0x1103, lpOverlapped=0x0) returned 1 [0046.862] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1110, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0x1110, lpOverlapped=0x0) returned 1 [0046.863] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0046.882] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0046.891] CloseHandle (hObject=0xf4) returned 1 [0046.892] CloseHandle (hObject=0x100) returned 1 [0046.895] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.dvodltmf")) returned 0 [0046.896] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.dvodltmf")) returned 0x2020 [0046.896] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1103, dwReserved0=0x2dee68, dwReserved1=0x18e24c, cFileName="contentscript_bin_prod.js", cAlternateFileName="CONTEN~1.JS")) returned 0x2e8498 [0046.896] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1103, dwReserved0=0x2dee68, dwReserved1=0x18e24c, cFileName="contentscript_bin_prod.js", cAlternateFileName="CONTEN~1.JS")) returned 0 [0046.896] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0046.896] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js")) returned 1 [0046.897] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js")) returned 0xffffffff [0046.897] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x356, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="dasherSettingSchema.json", cAlternateFileName="DASHER~1.JSO")) returned 1 [0046.897] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0046.898] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0046.898] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x356 [0046.898] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0046.898] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0046.937] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x356, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0x356, lpOverlapped=0x0) returned 1 [0046.939] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0x360, lpOverlapped=0x0) returned 1 [0046.940] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0046.959] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0046.968] CloseHandle (hObject=0x100) returned 1 [0046.969] CloseHandle (hObject=0xf4) returned 1 [0046.970] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json.dvodltmf")) returned 0 [0046.970] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json.dvodltmf")) returned 0x2020 [0046.970] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x356, dwReserved0=0x2dee60, dwReserved1=0x18e24c, cFileName="dasherSettingSchema.json", cAlternateFileName="DASHER~1.JSO")) returned 0x2e8498 [0046.971] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x356, dwReserved0=0x2dee60, dwReserved1=0x18e24c, cFileName="dasherSettingSchema.json", cAlternateFileName="DASHER~1.JSO")) returned 0 [0046.971] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0046.971] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json")) returned 1 [0046.973] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json")) returned 0xffffffff [0046.974] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x5b6c, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="eventpage_bin_prod.js", cAlternateFileName="EVENTP~1.JS")) returned 1 [0046.974] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0046.974] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0046.974] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5b6c [0046.974] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0046.974] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0047.014] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x5b6c, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0x5b6c, lpOverlapped=0x0) returned 1 [0047.016] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x5b70, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0x5b70, lpOverlapped=0x0) returned 1 [0047.017] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0047.036] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0047.045] CloseHandle (hObject=0xf4) returned 1 [0047.046] CloseHandle (hObject=0x100) returned 1 [0047.047] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.dvodltmf")) returned 0 [0047.047] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.dvodltmf")) returned 0x2020 [0047.047] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x5b6c, dwReserved0=0x2dee60, dwReserved1=0x18e24c, cFileName="eventpage_bin_prod.js", cAlternateFileName="EVENTP~1.JS")) returned 0x2e8498 [0047.047] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x5b6c, dwReserved0=0x2dee60, dwReserved1=0x18e24c, cFileName="eventpage_bin_prod.js", cAlternateFileName="EVENTP~1.JS")) returned 0 [0047.047] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0047.048] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js")) returned 1 [0047.049] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js")) returned 0xffffffff [0047.049] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0047.049] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0047.049] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0047.049] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5b1 [0047.049] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0047.049] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0047.089] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x5b1, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0x5b1, lpOverlapped=0x0) returned 1 [0047.091] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0x5c0, lpOverlapped=0x0) returned 1 [0047.092] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0047.111] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0047.120] CloseHandle (hObject=0x100) returned 1 [0047.121] CloseHandle (hObject=0xf4) returned 1 [0047.122] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json.dvodltmf")) returned 0 [0047.122] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json.dvodltmf")) returned 0x2020 [0047.122] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x2dee50, dwReserved1=0x18e24c, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 0x2e8498 [0047.122] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x2dee50, dwReserved1=0x18e24c, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 0 [0047.122] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0047.122] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json")) returned 1 [0047.123] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json")) returned 0xffffffff [0047.123] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="page_embed_script.js", cAlternateFileName="PAGE_E~1.JS")) returned 1 [0047.123] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0047.124] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0047.124] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe0 [0047.124] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0047.124] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0047.165] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0xe0, lpOverlapped=0x0) returned 1 [0047.165] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0xf0, lpOverlapped=0x0) returned 1 [0047.166] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0047.186] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0047.195] CloseHandle (hObject=0xf4) returned 1 [0047.196] CloseHandle (hObject=0x100) returned 1 [0047.197] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.dvodltmf")) returned 0 [0047.198] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.dvodltmf")) returned 0x2020 [0047.198] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x2dee58, dwReserved1=0x18e24c, cFileName="page_embed_script.js", cAlternateFileName="PAGE_E~1.JS")) returned 0x2e8498 [0047.198] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x2dee58, dwReserved1=0x18e24c, cFileName="page_embed_script.js", cAlternateFileName="PAGE_E~1.JS")) returned 0 [0047.198] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0047.198] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js")) returned 1 [0047.199] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js")) returned 0xffffffff [0047.199] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="_locales", cAlternateFileName="")) returned 1 [0047.199] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0047.201] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.202] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dd4d90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="af", cAlternateFileName="")) returned 1 [0047.202] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dd4d90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690072, dwReserved1=0x740070, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0047.202] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dd4d90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690072, dwReserved1=0x740070, cFileName="..", cAlternateFileName="")) returned 1 [0047.202] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0x690072, dwReserved1=0x740070, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0047.202] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0047.203] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0047.203] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x84 [0047.203] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0047.203] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0047.245] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x84, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x84, lpOverlapped=0x0) returned 1 [0047.246] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x90, lpOverlapped=0x0) returned 1 [0047.247] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0047.267] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0047.276] CloseHandle (hObject=0xfc) returned 1 [0047.276] CloseHandle (hObject=0xf8) returned 1 [0047.278] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json.dvodltmf")) returned 0 [0047.278] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json.dvodltmf")) returned 0x2020 [0047.278] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0047.278] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0047.278] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0047.279] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json")) returned 1 [0047.279] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json")) returned 0xffffffff [0047.280] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0x690072, dwReserved1=0x740070, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0047.280] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0047.280] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="am", cAlternateFileName="")) returned 1 [0047.280] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0047.280] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0047.280] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0047.280] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0047.280] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0047.281] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x103 [0047.281] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0047.281] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0047.323] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x103, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x103, lpOverlapped=0x0) returned 1 [0047.324] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0047.325] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0047.350] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0047.372] CloseHandle (hObject=0xf8) returned 1 [0047.373] CloseHandle (hObject=0xfc) returned 1 [0047.375] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json.dvodltmf")) returned 0 [0047.377] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json.dvodltmf")) returned 0x2020 [0047.377] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0047.377] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0047.377] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0047.377] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json")) returned 1 [0047.379] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json")) returned 0xffffffff [0047.379] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0047.379] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0047.379] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0047.379] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0047.382] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0047.382] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0047.382] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0047.382] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0047.383] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xed [0047.383] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0047.383] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0047.435] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xed, lpOverlapped=0x0) returned 1 [0047.437] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0047.438] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0047.457] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0047.467] CloseHandle (hObject=0xfc) returned 1 [0047.467] CloseHandle (hObject=0xf8) returned 1 [0047.468] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json.dvodltmf")) returned 0 [0047.469] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json.dvodltmf")) returned 0x2020 [0047.469] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0047.469] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0047.469] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0047.469] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json")) returned 1 [0047.470] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json")) returned 0xffffffff [0047.470] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0047.470] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0047.470] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="az", cAlternateFileName="")) returned 1 [0047.470] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0047.470] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0047.470] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0047.470] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0047.471] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0047.471] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa7 [0047.471] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0047.471] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0047.516] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa7, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xa7, lpOverlapped=0x0) returned 1 [0047.517] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xb0, lpOverlapped=0x0) returned 1 [0047.518] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0047.538] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0047.548] CloseHandle (hObject=0xf8) returned 1 [0047.548] CloseHandle (hObject=0xfc) returned 1 [0047.549] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json.dvodltmf")) returned 0 [0047.549] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json.dvodltmf")) returned 0x2020 [0047.549] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0047.550] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0047.550] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0047.550] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json")) returned 1 [0047.551] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json")) returned 0xffffffff [0047.551] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0047.551] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0047.551] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0047.551] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0047.552] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0047.552] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0047.552] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0047.552] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0047.552] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x114 [0047.553] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0047.553] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0047.597] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x114, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x114, lpOverlapped=0x0) returned 1 [0047.598] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x120, lpOverlapped=0x0) returned 1 [0047.599] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0047.619] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0047.629] CloseHandle (hObject=0xfc) returned 1 [0047.630] CloseHandle (hObject=0xf8) returned 1 [0047.630] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json.dvodltmf")) returned 0 [0047.631] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json.dvodltmf")) returned 0x2020 [0047.631] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0047.631] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0047.631] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0047.631] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json")) returned 1 [0047.632] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json")) returned 0xffffffff [0047.632] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0047.632] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0047.632] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="bn", cAlternateFileName="")) returned 1 [0047.633] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0047.633] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0047.633] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14b, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0047.633] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0047.633] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0047.633] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14b [0047.633] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0047.634] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0047.691] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x14b, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x14b, lpOverlapped=0x0) returned 1 [0047.692] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x150, lpOverlapped=0x0) returned 1 [0047.693] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0047.713] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0047.722] CloseHandle (hObject=0xf8) returned 1 [0047.723] CloseHandle (hObject=0xfc) returned 1 [0047.724] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json.dvodltmf")) returned 0 [0047.724] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json.dvodltmf")) returned 0x2020 [0047.724] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14b, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0047.724] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14b, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0047.724] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0047.724] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json")) returned 1 [0047.725] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json")) returned 0xffffffff [0047.725] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14b, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0047.725] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0047.726] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0047.726] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0047.727] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0047.727] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0047.727] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0047.727] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0047.727] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcf [0047.727] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0047.728] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0047.850] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xcf, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xcf, lpOverlapped=0x0) returned 1 [0047.851] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xd0, lpOverlapped=0x0) returned 1 [0047.852] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0047.873] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0047.883] CloseHandle (hObject=0xfc) returned 1 [0047.883] CloseHandle (hObject=0xf8) returned 1 [0047.884] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json.dvodltmf")) returned 0 [0047.884] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json.dvodltmf")) returned 0x2020 [0047.884] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0047.885] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0047.885] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0047.885] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json")) returned 1 [0047.886] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json")) returned 0xffffffff [0047.886] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0047.886] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0047.886] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0047.886] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0047.886] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0047.886] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0047.886] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0047.887] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0047.887] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xad [0047.887] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0047.887] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0047.935] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xad, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xad, lpOverlapped=0x0) returned 1 [0047.936] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xb0, lpOverlapped=0x0) returned 1 [0047.937] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0047.956] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0047.967] CloseHandle (hObject=0xf8) returned 1 [0047.967] CloseHandle (hObject=0xfc) returned 1 [0047.969] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json.dvodltmf")) returned 0 [0047.969] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json.dvodltmf")) returned 0x2020 [0047.969] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0047.969] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0047.969] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0047.969] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json")) returned 1 [0047.970] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json")) returned 0xffffffff [0047.970] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0047.970] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0047.970] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0047.970] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0047.974] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0047.974] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0047.974] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0047.974] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0047.974] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xac [0047.974] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0047.975] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0048.020] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xac, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xac, lpOverlapped=0x0) returned 1 [0048.021] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xb0, lpOverlapped=0x0) returned 1 [0048.022] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0048.041] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0048.050] CloseHandle (hObject=0xfc) returned 1 [0048.051] CloseHandle (hObject=0xf8) returned 1 [0048.052] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json.dvodltmf")) returned 0 [0048.052] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json.dvodltmf")) returned 0x2020 [0048.052] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0048.052] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0048.052] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0048.053] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json")) returned 1 [0048.053] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json")) returned 0xffffffff [0048.053] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0048.053] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0048.054] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0048.054] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0048.054] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0048.054] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc1, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0048.054] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0048.054] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0048.054] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc1 [0048.054] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0048.055] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0048.104] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xc1, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xc1, lpOverlapped=0x0) returned 1 [0048.107] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xd0, lpOverlapped=0x0) returned 1 [0048.109] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0048.128] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0048.138] CloseHandle (hObject=0xf8) returned 1 [0048.138] CloseHandle (hObject=0xfc) returned 1 [0048.139] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json.dvodltmf")) returned 0 [0048.139] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json.dvodltmf")) returned 0x2020 [0048.139] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc1, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0048.139] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc1, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0048.140] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0048.140] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json")) returned 1 [0048.141] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json")) returned 0xffffffff [0048.141] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc1, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0048.141] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0048.141] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0048.141] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0048.142] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0048.142] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12a, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0048.142] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0048.142] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0048.142] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12a [0048.142] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0048.143] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0048.192] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x12a, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x12a, lpOverlapped=0x0) returned 1 [0048.193] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x130, lpOverlapped=0x0) returned 1 [0048.194] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0048.213] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0048.223] CloseHandle (hObject=0xfc) returned 1 [0048.223] CloseHandle (hObject=0xf8) returned 1 [0048.226] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json.dvodltmf")) returned 0 [0048.227] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json.dvodltmf")) returned 0x2020 [0048.227] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12a, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0048.227] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12a, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0048.227] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0048.228] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json")) returned 1 [0048.228] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json")) returned 0xffffffff [0048.229] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12a, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0048.229] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0048.229] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0048.229] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0048.229] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0048.229] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0048.229] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0048.229] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0048.230] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb2 [0048.230] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0048.230] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0048.275] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb2, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb2, lpOverlapped=0x0) returned 1 [0048.276] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0048.277] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0048.296] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0048.305] CloseHandle (hObject=0xf8) returned 1 [0048.305] CloseHandle (hObject=0xfc) returned 1 [0048.306] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json.dvodltmf")) returned 0 [0048.306] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json.dvodltmf")) returned 0x2020 [0048.307] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0048.307] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0048.307] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0048.307] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json")) returned 1 [0048.308] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json")) returned 0xffffffff [0048.308] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0048.308] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0048.308] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1 [0048.308] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0048.309] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0048.309] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0048.309] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0048.309] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0048.310] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x109 [0048.310] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0048.310] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0048.376] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x109, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x109, lpOverlapped=0x0) returned 1 [0048.377] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0048.378] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0048.397] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0048.406] CloseHandle (hObject=0xfc) returned 1 [0048.407] CloseHandle (hObject=0xf8) returned 1 [0048.408] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json.dvodltmf")) returned 0 [0048.409] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json.dvodltmf")) returned 0x2020 [0048.409] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0048.409] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0048.409] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0048.409] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json")) returned 1 [0048.410] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json")) returned 0xffffffff [0048.410] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0048.410] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0048.410] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0048.410] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0048.410] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0048.411] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0048.411] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0048.411] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0048.411] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcc [0048.411] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0048.411] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0048.455] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xcc, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xcc, lpOverlapped=0x0) returned 1 [0048.455] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xd0, lpOverlapped=0x0) returned 1 [0048.456] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0048.479] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0048.488] CloseHandle (hObject=0xf8) returned 1 [0048.488] CloseHandle (hObject=0xfc) returned 1 [0048.489] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json.dvodltmf")) returned 0 [0048.490] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json.dvodltmf")) returned 0x2020 [0048.490] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0048.490] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0048.490] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0048.490] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json")) returned 1 [0048.491] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json")) returned 0xffffffff [0048.491] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0048.491] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0048.491] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="es_419", cAlternateFileName="")) returned 1 [0048.491] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0048.492] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0048.492] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0048.492] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0048.493] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0048.493] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe3 [0048.493] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0048.493] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0048.536] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xe3, lpOverlapped=0x0) returned 1 [0048.537] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0048.538] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0048.557] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0048.567] CloseHandle (hObject=0xfc) returned 1 [0048.567] CloseHandle (hObject=0xf8) returned 1 [0048.568] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json.dvodltmf")) returned 0 [0048.568] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json.dvodltmf")) returned 0x2020 [0048.568] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0048.568] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0048.568] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0048.568] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json")) returned 1 [0048.569] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json")) returned 0xffffffff [0048.569] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0048.569] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0048.572] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0048.572] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0048.572] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0048.572] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0048.572] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0048.572] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0048.573] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd4 [0048.573] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0048.573] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0048.616] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd4, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd4, lpOverlapped=0x0) returned 1 [0048.617] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0048.618] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0048.639] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0048.648] CloseHandle (hObject=0xf8) returned 1 [0048.648] CloseHandle (hObject=0xfc) returned 1 [0048.649] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json.dvodltmf")) returned 0 [0048.650] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json.dvodltmf")) returned 0x2020 [0048.650] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0048.650] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0048.650] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0048.650] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json")) returned 1 [0048.672] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json")) returned 0xffffffff [0048.673] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0048.673] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0048.673] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1 [0048.673] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0048.674] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0048.674] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x98, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0048.674] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0048.674] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0048.675] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x98 [0048.675] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0048.675] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0048.718] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x98, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x98, lpOverlapped=0x0) returned 1 [0048.719] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xa0, lpOverlapped=0x0) returned 1 [0048.720] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0048.739] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0048.748] CloseHandle (hObject=0xfc) returned 1 [0048.748] CloseHandle (hObject=0xf8) returned 1 [0048.750] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json.dvodltmf")) returned 0 [0048.750] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json.dvodltmf")) returned 0x2020 [0048.750] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x98, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0048.751] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x98, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0048.751] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0048.751] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json")) returned 1 [0048.752] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json")) returned 0xffffffff [0048.752] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x98, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0048.752] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0048.752] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fa", cAlternateFileName="")) returned 1 [0048.752] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0048.752] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0048.752] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0048.752] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0048.752] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0048.753] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xff [0048.753] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0048.753] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0048.843] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xff, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xff, lpOverlapped=0x0) returned 1 [0048.845] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x100, lpOverlapped=0x0) returned 1 [0048.845] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0048.865] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0048.874] CloseHandle (hObject=0xf8) returned 1 [0048.875] CloseHandle (hObject=0xfc) returned 1 [0048.876] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json.dvodltmf")) returned 0 [0048.876] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json.dvodltmf")) returned 0x2020 [0048.876] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0048.876] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0048.876] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0048.876] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json")) returned 1 [0048.877] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json")) returned 0xffffffff [0048.877] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0048.877] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0048.878] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0048.878] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0048.878] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0048.878] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0048.879] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0048.879] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0048.879] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb7 [0048.879] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0048.879] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0048.964] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb7, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb7, lpOverlapped=0x0) returned 1 [0048.965] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0048.966] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0048.985] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0048.995] CloseHandle (hObject=0xfc) returned 1 [0048.995] CloseHandle (hObject=0xf8) returned 1 [0048.997] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json.dvodltmf")) returned 0 [0048.997] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json.dvodltmf")) returned 0x2020 [0048.997] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0048.998] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0048.998] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0048.998] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json")) returned 1 [0048.999] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json")) returned 0xffffffff [0048.999] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0048.999] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0048.999] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0048.999] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0048.999] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0048.999] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc7, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0048.999] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0048.999] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0049.000] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc7 [0049.000] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0049.000] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0049.084] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xc7, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xc7, lpOverlapped=0x0) returned 1 [0049.085] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xd0, lpOverlapped=0x0) returned 1 [0049.085] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0049.105] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0049.114] CloseHandle (hObject=0xf8) returned 1 [0049.114] CloseHandle (hObject=0xfc) returned 1 [0049.115] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json.dvodltmf")) returned 0 [0049.116] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json.dvodltmf")) returned 0x2020 [0049.116] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc7, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0049.116] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc7, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0049.116] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0049.116] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json")) returned 1 [0049.117] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json")) returned 0xffffffff [0049.117] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc7, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0049.117] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0049.117] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0049.117] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0049.118] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0049.118] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0049.118] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0049.118] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0049.119] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbb [0049.119] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0049.119] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0049.204] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xbb, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xbb, lpOverlapped=0x0) returned 1 [0049.204] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0049.205] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0049.225] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0049.234] CloseHandle (hObject=0xfc) returned 1 [0049.234] CloseHandle (hObject=0xf8) returned 1 [0049.236] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json.dvodltmf")) returned 0 [0049.236] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json.dvodltmf")) returned 0x2020 [0049.236] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0049.236] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0049.237] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0049.237] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json")) returned 1 [0049.237] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json")) returned 0xffffffff [0049.238] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0049.238] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0049.238] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fr_CA", cAlternateFileName="")) returned 1 [0049.238] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0049.239] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0049.239] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0049.239] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0049.239] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0049.239] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd2 [0049.239] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0049.240] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0049.324] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd2, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd2, lpOverlapped=0x0) returned 1 [0049.325] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0049.326] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0049.353] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0049.362] CloseHandle (hObject=0xf8) returned 1 [0049.362] CloseHandle (hObject=0xfc) returned 1 [0049.363] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json.dvodltmf")) returned 0 [0049.364] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json.dvodltmf")) returned 0x2020 [0049.364] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0049.364] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0049.364] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0049.364] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json")) returned 1 [0049.365] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json")) returned 0xffffffff [0049.365] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0049.365] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0049.365] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="gl", cAlternateFileName="")) returned 1 [0049.365] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0049.365] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0049.365] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0049.365] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0049.366] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0049.367] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xac [0049.367] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0049.367] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0049.456] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xac, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xac, lpOverlapped=0x0) returned 1 [0049.457] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xb0, lpOverlapped=0x0) returned 1 [0049.458] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0049.477] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0049.486] CloseHandle (hObject=0xfc) returned 1 [0049.486] CloseHandle (hObject=0xf8) returned 1 [0049.487] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json.dvodltmf")) returned 0 [0049.487] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json.dvodltmf")) returned 0x2020 [0049.487] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0049.488] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0049.488] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0049.488] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json")) returned 1 [0049.489] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json")) returned 0xffffffff [0049.489] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0049.489] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0049.489] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="gu", cAlternateFileName="")) returned 1 [0049.489] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0049.489] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0049.489] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0049.489] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0049.489] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0049.490] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11e [0049.490] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0049.490] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0049.575] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x11e, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x11e, lpOverlapped=0x0) returned 1 [0049.576] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x120, lpOverlapped=0x0) returned 1 [0049.576] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0049.596] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0049.605] CloseHandle (hObject=0xf8) returned 1 [0049.605] CloseHandle (hObject=0xfc) returned 1 [0049.606] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json.dvodltmf")) returned 0 [0049.607] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json.dvodltmf")) returned 0x2020 [0049.607] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0049.607] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0049.607] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0049.607] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json")) returned 1 [0049.608] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json")) returned 0xffffffff [0049.608] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0049.608] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0049.608] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0049.609] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0049.609] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0049.609] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0049.609] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0049.610] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0049.610] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13e [0049.610] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0049.610] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0049.704] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x13e, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x13e, lpOverlapped=0x0) returned 1 [0049.705] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x140, lpOverlapped=0x0) returned 1 [0049.706] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0049.725] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0049.734] CloseHandle (hObject=0xfc) returned 1 [0049.734] CloseHandle (hObject=0xf8) returned 1 [0049.736] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json.dvodltmf")) returned 0 [0049.737] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json.dvodltmf")) returned 0x2020 [0049.737] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0049.737] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0049.737] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0049.737] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json")) returned 1 [0049.738] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json")) returned 0xffffffff [0049.738] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0049.738] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0049.738] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0049.738] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0049.738] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0049.738] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0049.738] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0049.739] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0049.739] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc8 [0049.739] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0049.739] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0049.886] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xc8, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xc8, lpOverlapped=0x0) returned 1 [0049.887] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xd0, lpOverlapped=0x0) returned 1 [0049.888] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0049.908] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0049.917] CloseHandle (hObject=0xf8) returned 1 [0049.917] CloseHandle (hObject=0xfc) returned 1 [0049.920] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json.dvodltmf")) returned 0 [0049.920] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json.dvodltmf")) returned 0x2020 [0049.920] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0049.920] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0049.920] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0049.920] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json")) returned 1 [0049.921] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json")) returned 0xffffffff [0049.921] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0049.921] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0049.921] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0049.922] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0049.922] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0049.922] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0049.922] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0049.923] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0049.923] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc6 [0049.923] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0049.923] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0050.007] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xc6, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xc6, lpOverlapped=0x0) returned 1 [0050.008] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xd0, lpOverlapped=0x0) returned 1 [0050.009] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0050.028] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0050.038] CloseHandle (hObject=0xfc) returned 1 [0050.038] CloseHandle (hObject=0xf8) returned 1 [0050.039] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json.dvodltmf")) returned 0 [0050.039] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json.dvodltmf")) returned 0x2020 [0050.039] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0050.039] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0050.040] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0050.040] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json")) returned 1 [0050.041] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json")) returned 0xffffffff [0050.041] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0050.041] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0050.041] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hy", cAlternateFileName="")) returned 1 [0050.041] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0050.041] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0050.041] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x299, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0050.041] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0050.042] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0050.042] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x299 [0050.042] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0050.042] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0050.136] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x299, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x299, lpOverlapped=0x0) returned 1 [0050.139] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x2a0, lpOverlapped=0x0) returned 1 [0050.140] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0050.160] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0050.169] CloseHandle (hObject=0xf8) returned 1 [0050.169] CloseHandle (hObject=0xfc) returned 1 [0050.170] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json.dvodltmf")) returned 0 [0050.171] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json.dvodltmf")) returned 0x2020 [0050.171] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x299, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0050.171] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x299, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0050.171] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0050.171] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json")) returned 1 [0050.172] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json")) returned 0xffffffff [0050.172] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x299, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0050.172] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0050.172] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0050.172] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0050.173] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0050.173] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0050.173] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0050.174] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0050.174] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbb [0050.174] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0050.174] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0050.260] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xbb, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xbb, lpOverlapped=0x0) returned 1 [0050.261] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0050.262] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0050.282] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0050.291] CloseHandle (hObject=0xfc) returned 1 [0050.291] CloseHandle (hObject=0xf8) returned 1 [0050.292] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json.dvodltmf")) returned 0 [0050.293] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json.dvodltmf")) returned 0x2020 [0050.293] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0050.293] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0050.293] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0050.293] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json")) returned 1 [0050.294] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json")) returned 0xffffffff [0050.294] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0050.294] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0050.294] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="is", cAlternateFileName="")) returned 1 [0050.294] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0050.295] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0050.295] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0050.295] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0050.295] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0050.295] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb2 [0050.295] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0050.296] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0050.387] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb2, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb2, lpOverlapped=0x0) returned 1 [0050.388] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0050.389] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0050.408] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0050.418] CloseHandle (hObject=0xf8) returned 1 [0050.418] CloseHandle (hObject=0xfc) returned 1 [0050.419] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json.dvodltmf")) returned 0 [0050.419] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json.dvodltmf")) returned 0x2020 [0050.419] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0050.420] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0050.420] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0050.420] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json")) returned 1 [0050.421] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json")) returned 0xffffffff [0050.421] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0050.421] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0050.421] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0050.421] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0050.421] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0050.421] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0050.421] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0050.422] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0050.423] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb6 [0050.423] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0050.423] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0050.509] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb6, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb6, lpOverlapped=0x0) returned 1 [0050.510] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0050.511] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0050.530] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0050.539] CloseHandle (hObject=0xfc) returned 1 [0050.540] CloseHandle (hObject=0xf8) returned 1 [0050.541] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json.dvodltmf")) returned 0 [0050.541] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json.dvodltmf")) returned 0x2020 [0050.541] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0050.541] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0050.541] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0050.542] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json")) returned 1 [0050.542] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json")) returned 0xffffffff [0050.542] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0050.542] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0050.543] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="iw", cAlternateFileName="")) returned 1 [0050.543] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0050.543] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0050.543] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0050.543] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0050.543] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0050.543] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16a [0050.543] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0050.544] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0050.628] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x16a, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x16a, lpOverlapped=0x0) returned 1 [0050.629] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x170, lpOverlapped=0x0) returned 1 [0050.630] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0050.650] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0050.660] CloseHandle (hObject=0xf8) returned 1 [0050.660] CloseHandle (hObject=0xfc) returned 1 [0050.661] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json.dvodltmf")) returned 0 [0050.661] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json.dvodltmf")) returned 0x2020 [0050.661] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0050.661] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0050.661] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0050.662] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json")) returned 1 [0050.662] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json")) returned 0xffffffff [0050.662] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0050.663] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0050.663] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0050.663] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0050.663] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0050.663] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0050.663] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0050.672] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0050.673] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfb [0050.673] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0050.673] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0050.760] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xfb, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xfb, lpOverlapped=0x0) returned 1 [0050.761] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x100, lpOverlapped=0x0) returned 1 [0050.762] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0050.781] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0050.790] CloseHandle (hObject=0xfc) returned 1 [0050.790] CloseHandle (hObject=0xf8) returned 1 [0050.792] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json.dvodltmf")) returned 0 [0050.793] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json.dvodltmf")) returned 0x2020 [0050.793] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0050.793] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0050.793] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0050.793] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json")) returned 1 [0050.794] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json")) returned 0xffffffff [0050.794] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0050.794] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0050.794] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ka", cAlternateFileName="")) returned 1 [0050.794] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0050.795] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0050.795] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x165, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0050.795] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0050.795] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0050.795] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x165 [0050.795] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0050.796] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0050.881] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x165, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x165, lpOverlapped=0x0) returned 1 [0050.882] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x170, lpOverlapped=0x0) returned 1 [0050.883] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0050.933] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0050.942] CloseHandle (hObject=0xf8) returned 1 [0050.942] CloseHandle (hObject=0xfc) returned 1 [0050.943] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json.dvodltmf")) returned 0 [0050.944] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json.dvodltmf")) returned 0x2020 [0050.944] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x165, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0050.944] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x165, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0050.944] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0050.944] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json")) returned 1 [0050.945] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json")) returned 0xffffffff [0050.945] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x165, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0050.945] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0050.945] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="km", cAlternateFileName="")) returned 1 [0050.945] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0050.946] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0050.946] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x25f, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0050.946] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0050.991] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0050.991] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x25f [0050.991] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0050.992] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0051.192] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x25f, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x25f, lpOverlapped=0x0) returned 1 [0051.198] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x260, lpOverlapped=0x0) returned 1 [0051.199] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0051.218] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.228] CloseHandle (hObject=0xfc) returned 1 [0051.228] CloseHandle (hObject=0xf8) returned 1 [0051.230] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json.dvodltmf")) returned 0 [0051.231] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json.dvodltmf")) returned 0x2020 [0051.231] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x25f, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0051.231] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x25f, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0051.231] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0051.231] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json")) returned 1 [0051.232] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json")) returned 0xffffffff [0051.232] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x25f, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0051.232] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0051.232] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="kn", cAlternateFileName="")) returned 1 [0051.232] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0051.233] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0051.233] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x147, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0051.233] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0051.233] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0051.233] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x147 [0051.233] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0051.233] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0051.324] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x147, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x147, lpOverlapped=0x0) returned 1 [0051.325] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x150, lpOverlapped=0x0) returned 1 [0051.326] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0051.345] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.402] CloseHandle (hObject=0xf8) returned 1 [0051.402] CloseHandle (hObject=0xfc) returned 1 [0051.403] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json.dvodltmf")) returned 0 [0051.403] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json.dvodltmf")) returned 0x2020 [0051.403] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x147, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0051.404] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x147, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0051.404] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0051.404] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json")) returned 1 [0051.405] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json")) returned 0xffffffff [0051.405] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x147, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0051.405] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0051.405] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0051.405] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0051.405] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0051.405] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0051.405] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0051.408] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0051.408] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd9 [0051.408] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0051.408] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0051.501] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd9, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd9, lpOverlapped=0x0) returned 1 [0051.502] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0051.503] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0051.522] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.531] CloseHandle (hObject=0xfc) returned 1 [0051.531] CloseHandle (hObject=0xf8) returned 1 [0051.532] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json.dvodltmf")) returned 0 [0051.533] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json.dvodltmf")) returned 0x2020 [0051.533] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0051.533] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0051.533] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0051.533] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json")) returned 1 [0051.534] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json")) returned 0xffffffff [0051.534] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0051.534] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0051.534] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="lo", cAlternateFileName="")) returned 1 [0051.534] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0051.535] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0051.535] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0051.535] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0051.535] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0051.535] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c2 [0051.535] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0051.536] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0051.622] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1c2, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x1c2, lpOverlapped=0x0) returned 1 [0051.623] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x1d0, lpOverlapped=0x0) returned 1 [0051.624] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0051.644] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.654] CloseHandle (hObject=0xf8) returned 1 [0051.654] CloseHandle (hObject=0xfc) returned 1 [0051.655] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json.dvodltmf")) returned 0 [0051.656] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json.dvodltmf")) returned 0x2020 [0051.656] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0051.656] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0051.656] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0051.656] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json")) returned 1 [0051.657] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json")) returned 0xffffffff [0051.657] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0051.657] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0051.660] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0051.662] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0051.662] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0051.662] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0051.663] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0051.663] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0051.664] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd5 [0051.664] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0051.664] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0051.815] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd5, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd5, lpOverlapped=0x0) returned 1 [0051.816] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0051.817] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0051.837] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.846] CloseHandle (hObject=0xfc) returned 1 [0051.847] CloseHandle (hObject=0xf8) returned 1 [0051.848] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json.dvodltmf")) returned 0 [0051.848] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json.dvodltmf")) returned 0x2020 [0051.848] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0051.848] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0051.848] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0051.849] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json")) returned 1 [0051.850] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json")) returned 0xffffffff [0051.850] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0051.850] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0051.850] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0051.850] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0051.850] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0051.850] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0051.850] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0051.850] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0051.851] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc6 [0051.851] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0051.851] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0051.937] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xc6, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xc6, lpOverlapped=0x0) returned 1 [0051.938] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xd0, lpOverlapped=0x0) returned 1 [0051.939] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0051.958] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.967] CloseHandle (hObject=0xf8) returned 1 [0051.967] CloseHandle (hObject=0xfc) returned 1 [0051.970] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json.dvodltmf")) returned 0 [0051.970] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json.dvodltmf")) returned 0x2020 [0051.970] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0051.970] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0051.970] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0051.971] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json")) returned 1 [0051.971] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json")) returned 0xffffffff [0051.972] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0051.972] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0051.972] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ml", cAlternateFileName="")) returned 1 [0051.972] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0051.972] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0051.972] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x183, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0051.972] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0051.973] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0051.973] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x183 [0051.973] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0051.974] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0052.063] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x183, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x183, lpOverlapped=0x0) returned 1 [0052.064] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x190, lpOverlapped=0x0) returned 1 [0052.065] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0052.084] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.094] CloseHandle (hObject=0xfc) returned 1 [0052.094] CloseHandle (hObject=0xf8) returned 1 [0052.096] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json.dvodltmf")) returned 0 [0052.097] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json.dvodltmf")) returned 0x2020 [0052.097] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x183, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0052.097] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x183, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0052.097] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0052.097] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json")) returned 1 [0052.098] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json")) returned 0xffffffff [0052.098] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x183, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0052.098] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0052.098] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="mn", cAlternateFileName="")) returned 1 [0052.098] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0052.099] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0052.099] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0052.099] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0052.099] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0052.099] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c3 [0052.099] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0052.100] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0052.184] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1c3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x1c3, lpOverlapped=0x0) returned 1 [0052.185] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x1d0, lpOverlapped=0x0) returned 1 [0052.186] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0052.205] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.215] CloseHandle (hObject=0xf8) returned 1 [0052.215] CloseHandle (hObject=0xfc) returned 1 [0052.216] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json.dvodltmf")) returned 0 [0052.217] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json.dvodltmf")) returned 0x2020 [0052.217] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0052.217] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0052.217] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0052.217] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json")) returned 1 [0052.218] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json")) returned 0xffffffff [0052.218] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0052.218] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0052.218] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="mr", cAlternateFileName="")) returned 1 [0052.218] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0052.218] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0052.219] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0052.219] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0052.219] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0052.220] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12c [0052.220] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0052.220] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0052.305] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x12c, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x12c, lpOverlapped=0x0) returned 1 [0052.306] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x130, lpOverlapped=0x0) returned 1 [0052.307] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0052.327] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.337] CloseHandle (hObject=0xfc) returned 1 [0052.337] CloseHandle (hObject=0xf8) returned 1 [0052.339] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json.dvodltmf")) returned 0 [0052.340] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json.dvodltmf")) returned 0x2020 [0052.340] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0052.340] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0052.340] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0052.341] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json")) returned 1 [0052.342] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json")) returned 0xffffffff [0052.342] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0052.342] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0052.342] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1 [0052.342] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0052.342] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0052.342] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0052.342] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0052.343] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0052.343] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcb [0052.343] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0052.344] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0052.443] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xcb, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xcb, lpOverlapped=0x0) returned 1 [0052.444] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xd0, lpOverlapped=0x0) returned 1 [0052.444] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0052.464] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.474] CloseHandle (hObject=0xf8) returned 1 [0052.474] CloseHandle (hObject=0xfc) returned 1 [0052.476] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json.dvodltmf")) returned 0 [0052.476] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json.dvodltmf")) returned 0x2020 [0052.476] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0052.476] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0052.476] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0052.476] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json")) returned 1 [0052.477] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json")) returned 0xffffffff [0052.477] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0052.477] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0052.477] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ne", cAlternateFileName="")) returned 1 [0052.478] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0052.478] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0052.478] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x20b, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0052.478] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0052.478] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0052.478] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x20b [0052.478] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0052.479] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0052.568] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x20b, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x20b, lpOverlapped=0x0) returned 1 [0052.569] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x210, lpOverlapped=0x0) returned 1 [0052.570] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0052.590] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.599] CloseHandle (hObject=0xfc) returned 1 [0052.599] CloseHandle (hObject=0xf8) returned 1 [0052.602] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json.dvodltmf")) returned 0 [0052.602] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json.dvodltmf")) returned 0x2020 [0052.602] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x20b, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0052.602] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x20b, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0052.602] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0052.602] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json")) returned 1 [0052.603] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json")) returned 0xffffffff [0052.603] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x20b, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0052.603] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0052.604] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0052.604] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0052.618] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0052.619] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0052.619] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0052.619] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0052.619] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb1 [0052.619] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0052.620] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0052.707] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb1, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb1, lpOverlapped=0x0) returned 1 [0052.708] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0052.709] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0052.728] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.745] CloseHandle (hObject=0xf8) returned 1 [0052.745] CloseHandle (hObject=0xfc) returned 1 [0052.746] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json.dvodltmf")) returned 0 [0052.747] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json.dvodltmf")) returned 0x2020 [0052.747] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0052.747] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0052.747] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0052.747] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json")) returned 1 [0052.748] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json")) returned 0xffffffff [0052.748] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0052.748] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0052.748] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0052.748] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0052.749] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0052.749] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0052.749] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0052.749] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0052.749] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x96 [0052.749] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0052.749] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0052.835] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x96, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x96, lpOverlapped=0x0) returned 1 [0052.836] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xa0, lpOverlapped=0x0) returned 1 [0052.837] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0052.857] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.866] CloseHandle (hObject=0xfc) returned 1 [0052.866] CloseHandle (hObject=0xf8) returned 1 [0052.867] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json.dvodltmf")) returned 0 [0052.868] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json.dvodltmf")) returned 0x2020 [0052.868] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0052.868] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0052.868] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0052.868] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json")) returned 1 [0052.869] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json")) returned 0xffffffff [0052.869] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0052.869] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0052.869] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0052.869] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0052.870] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0052.870] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0052.870] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0052.871] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0052.871] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb4 [0052.871] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0052.871] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0052.955] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb4, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb4, lpOverlapped=0x0) returned 1 [0052.957] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0052.958] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0052.977] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.987] CloseHandle (hObject=0xf8) returned 1 [0052.987] CloseHandle (hObject=0xfc) returned 1 [0052.988] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json.dvodltmf")) returned 0 [0052.989] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json.dvodltmf")) returned 0x2020 [0052.989] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0052.989] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0052.989] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0052.989] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json")) returned 1 [0052.990] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json")) returned 0xffffffff [0052.990] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0052.990] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0052.990] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0052.990] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0052.990] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0052.990] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0052.991] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0052.991] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0052.991] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbb [0052.991] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0052.991] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0053.080] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xbb, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xbb, lpOverlapped=0x0) returned 1 [0053.081] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0053.082] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0053.102] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.111] CloseHandle (hObject=0xfc) returned 1 [0053.111] CloseHandle (hObject=0xf8) returned 1 [0053.113] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json.dvodltmf")) returned 0 [0053.113] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json.dvodltmf")) returned 0x2020 [0053.113] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0053.113] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0053.113] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0053.114] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json")) returned 1 [0053.114] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json")) returned 0xffffffff [0053.114] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0053.114] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0053.115] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0053.115] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0053.116] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0053.116] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0053.116] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0053.116] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0053.116] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc6 [0053.116] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0053.117] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0053.200] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xc6, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xc6, lpOverlapped=0x0) returned 1 [0053.201] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xd0, lpOverlapped=0x0) returned 1 [0053.202] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0053.222] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.233] CloseHandle (hObject=0xf8) returned 1 [0053.233] CloseHandle (hObject=0xfc) returned 1 [0053.234] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json.dvodltmf")) returned 0 [0053.235] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json.dvodltmf")) returned 0x2020 [0053.235] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0053.235] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0053.235] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0053.235] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json")) returned 1 [0053.236] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json")) returned 0xffffffff [0053.236] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0053.236] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0053.236] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0053.236] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0053.237] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0053.237] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0053.237] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0053.237] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0053.237] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaf [0053.237] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0053.238] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0053.321] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xaf, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xaf, lpOverlapped=0x0) returned 1 [0053.323] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xb0, lpOverlapped=0x0) returned 1 [0053.323] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0053.343] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.357] CloseHandle (hObject=0xfc) returned 1 [0053.358] CloseHandle (hObject=0xf8) returned 1 [0053.359] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json.dvodltmf")) returned 0 [0053.359] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json.dvodltmf")) returned 0x2020 [0053.359] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0053.359] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0053.359] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0053.360] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json")) returned 1 [0053.360] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json")) returned 0xffffffff [0053.361] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0053.361] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0053.361] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0053.361] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0053.362] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0053.362] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0053.362] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0053.362] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0053.362] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x119 [0053.362] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0053.363] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0053.456] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x119, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x119, lpOverlapped=0x0) returned 1 [0053.457] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x120, lpOverlapped=0x0) returned 1 [0053.458] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0053.478] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.487] CloseHandle (hObject=0xf8) returned 1 [0053.487] CloseHandle (hObject=0xfc) returned 1 [0053.488] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json.dvodltmf")) returned 0 [0053.489] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json.dvodltmf")) returned 0x2020 [0053.489] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0053.489] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0053.489] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0053.489] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json")) returned 1 [0053.490] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json")) returned 0xffffffff [0053.490] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0053.490] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0053.490] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="si", cAlternateFileName="")) returned 1 [0053.490] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0053.491] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0053.491] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x14e, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0053.491] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0053.491] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0053.491] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14e [0053.491] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0053.492] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0053.577] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x14e, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x14e, lpOverlapped=0x0) returned 1 [0053.578] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x150, lpOverlapped=0x0) returned 1 [0053.579] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0053.599] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.608] CloseHandle (hObject=0xfc) returned 1 [0053.609] CloseHandle (hObject=0xf8) returned 1 [0053.609] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json.dvodltmf")) returned 0 [0053.610] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json.dvodltmf")) returned 0x2020 [0053.610] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x14e, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0053.610] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x14e, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0053.610] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0053.610] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json")) returned 1 [0053.612] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json")) returned 0xffffffff [0053.612] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x14e, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0053.612] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0053.612] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0053.612] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0053.613] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0053.613] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc5, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0053.613] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0053.613] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0053.613] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc5 [0053.613] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0053.614] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0053.708] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xc5, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xc5, lpOverlapped=0x0) returned 1 [0053.709] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xd0, lpOverlapped=0x0) returned 1 [0053.710] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0053.730] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.739] CloseHandle (hObject=0xf8) returned 1 [0053.740] CloseHandle (hObject=0xfc) returned 1 [0053.741] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json.dvodltmf")) returned 0 [0053.741] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json.dvodltmf")) returned 0x2020 [0053.741] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc5, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0053.741] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc5, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0053.741] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0053.742] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json")) returned 1 [0053.742] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json")) returned 0xffffffff [0053.742] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc5, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0053.742] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0053.743] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0053.743] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0053.743] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0053.743] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0053.743] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0053.743] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0053.744] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbe [0053.744] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0053.744] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0053.871] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xbe, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xbe, lpOverlapped=0x0) returned 1 [0053.873] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0053.877] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0053.897] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.906] CloseHandle (hObject=0xfc) returned 1 [0053.906] CloseHandle (hObject=0xf8) returned 1 [0053.907] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json.dvodltmf")) returned 0 [0053.907] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json.dvodltmf")) returned 0x2020 [0053.907] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0053.909] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0053.909] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0053.909] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json")) returned 1 [0053.910] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json")) returned 0xffffffff [0053.910] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0053.910] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0053.910] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0053.910] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0053.913] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0053.913] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0053.913] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0053.913] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0053.913] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x104 [0053.913] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0053.913] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0053.999] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x104, lpOverlapped=0x0) returned 1 [0054.000] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0054.001] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0054.021] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.030] CloseHandle (hObject=0xf8) returned 1 [0054.031] CloseHandle (hObject=0xfc) returned 1 [0054.032] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json.dvodltmf")) returned 0 [0054.032] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json.dvodltmf")) returned 0x2020 [0054.032] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0054.032] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0054.033] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0054.033] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json")) returned 1 [0054.034] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json")) returned 0xffffffff [0054.034] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0054.034] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0054.034] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0054.034] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0054.034] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0054.034] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0054.053] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0054.053] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0054.054] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0054.054] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0054.054] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0054.139] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb3, lpOverlapped=0x0) returned 1 [0054.140] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0054.141] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0054.161] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.170] CloseHandle (hObject=0xfc) returned 1 [0054.170] CloseHandle (hObject=0xf8) returned 1 [0054.171] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json.dvodltmf")) returned 0 [0054.172] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json.dvodltmf")) returned 0x2020 [0054.172] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0054.172] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0054.172] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0054.172] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json")) returned 1 [0054.173] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json")) returned 0xffffffff [0054.173] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0054.173] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0054.174] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sw", cAlternateFileName="")) returned 1 [0054.174] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0054.174] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0054.174] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0054.175] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0054.175] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0054.175] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc4 [0054.175] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0054.175] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0054.261] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xc4, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xc4, lpOverlapped=0x0) returned 1 [0054.262] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xd0, lpOverlapped=0x0) returned 1 [0054.263] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0054.283] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.292] CloseHandle (hObject=0xf8) returned 1 [0054.293] CloseHandle (hObject=0xfc) returned 1 [0054.294] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json.dvodltmf")) returned 0 [0054.294] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json.dvodltmf")) returned 0x2020 [0054.294] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0054.294] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0054.294] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0054.295] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json")) returned 1 [0054.295] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json")) returned 0xffffffff [0054.295] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0054.295] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0054.296] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ta", cAlternateFileName="")) returned 1 [0054.296] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0054.296] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0054.296] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x150, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0054.296] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0054.296] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0054.296] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x150 [0054.297] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0054.297] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0054.385] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x150, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x150, lpOverlapped=0x0) returned 1 [0054.386] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x160, lpOverlapped=0x0) returned 1 [0054.387] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0054.407] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.416] CloseHandle (hObject=0xfc) returned 1 [0054.417] CloseHandle (hObject=0xf8) returned 1 [0054.418] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json.dvodltmf")) returned 0 [0054.418] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json.dvodltmf")) returned 0x2020 [0054.418] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x150, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0054.418] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x150, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0054.418] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0054.418] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json")) returned 1 [0054.419] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json")) returned 0xffffffff [0054.419] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x150, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0054.419] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0054.420] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="te", cAlternateFileName="")) returned 1 [0054.420] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0054.420] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0054.421] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0054.421] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0054.421] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0054.421] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x115 [0054.421] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0054.421] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0054.506] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x115, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x115, lpOverlapped=0x0) returned 1 [0054.507] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x120, lpOverlapped=0x0) returned 1 [0054.508] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0054.527] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.536] CloseHandle (hObject=0xf8) returned 1 [0054.537] CloseHandle (hObject=0xfc) returned 1 [0054.538] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json.dvodltmf")) returned 0 [0054.538] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json.dvodltmf")) returned 0x2020 [0054.538] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0054.538] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0054.538] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0054.539] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json")) returned 1 [0054.539] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json")) returned 0xffffffff [0054.540] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0054.540] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0054.540] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0054.540] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0054.540] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0054.540] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0054.540] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0054.540] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0054.541] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x125 [0054.541] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0054.541] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0054.627] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x125, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x125, lpOverlapped=0x0) returned 1 [0054.628] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x130, lpOverlapped=0x0) returned 1 [0054.629] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0054.649] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.659] CloseHandle (hObject=0xfc) returned 1 [0054.660] CloseHandle (hObject=0xf8) returned 1 [0054.661] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json.dvodltmf")) returned 0 [0054.661] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json.dvodltmf")) returned 0x2020 [0054.661] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0054.661] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0054.661] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0054.661] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json")) returned 1 [0054.662] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json")) returned 0xffffffff [0054.662] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0054.662] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0054.663] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0054.663] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0054.663] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0054.664] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0054.664] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0054.664] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0054.664] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcd [0054.664] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0054.664] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0054.752] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xcd, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xcd, lpOverlapped=0x0) returned 1 [0054.753] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xd0, lpOverlapped=0x0) returned 1 [0054.761] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0054.781] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.791] CloseHandle (hObject=0xf8) returned 1 [0054.791] CloseHandle (hObject=0xfc) returned 1 [0054.792] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json.dvodltmf")) returned 0 [0054.793] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json.dvodltmf")) returned 0x2020 [0054.793] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0054.793] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0054.793] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0054.793] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json")) returned 1 [0054.794] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json")) returned 0xffffffff [0054.794] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0054.794] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0054.794] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0054.794] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0054.794] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0054.795] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0054.795] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0054.795] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0054.795] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x115 [0054.795] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0054.795] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0054.885] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x115, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x115, lpOverlapped=0x0) returned 1 [0054.886] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x120, lpOverlapped=0x0) returned 1 [0054.887] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0054.908] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.917] CloseHandle (hObject=0xfc) returned 1 [0054.918] CloseHandle (hObject=0xf8) returned 1 [0054.919] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json.dvodltmf")) returned 0 [0054.919] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json.dvodltmf")) returned 0x2020 [0054.919] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0054.920] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0054.920] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0054.920] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json")) returned 1 [0054.921] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json")) returned 0xffffffff [0054.921] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0054.921] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0054.921] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ur", cAlternateFileName="")) returned 1 [0054.921] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0054.923] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0054.923] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x177, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0054.923] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0054.923] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0054.923] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x177 [0054.923] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0054.924] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0055.011] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x177, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x177, lpOverlapped=0x0) returned 1 [0055.012] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x180, lpOverlapped=0x0) returned 1 [0055.013] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0055.034] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.043] CloseHandle (hObject=0xf8) returned 1 [0055.044] CloseHandle (hObject=0xfc) returned 1 [0055.045] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json.dvodltmf")) returned 0 [0055.045] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json.dvodltmf")) returned 0x2020 [0055.045] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x177, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0055.045] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x177, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0055.045] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0055.045] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json")) returned 1 [0055.046] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json")) returned 0xffffffff [0055.047] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x177, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0055.047] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0055.047] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0055.047] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0055.047] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0055.047] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0055.047] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0055.047] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0055.048] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0055.048] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0055.048] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0055.137] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xdd, lpOverlapped=0x0) returned 1 [0055.138] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0055.139] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0055.159] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.169] CloseHandle (hObject=0xfc) returned 1 [0055.169] CloseHandle (hObject=0xf8) returned 1 [0055.171] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json.dvodltmf")) returned 0 [0055.172] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json.dvodltmf")) returned 0x2020 [0055.172] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0055.172] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0055.172] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0055.172] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json")) returned 1 [0055.173] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json")) returned 0xffffffff [0055.173] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0055.173] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0055.173] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0055.173] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0055.174] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0055.174] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0055.174] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0055.175] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0055.175] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb0 [0055.175] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0055.175] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0055.268] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb0, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xb0, lpOverlapped=0x0) returned 1 [0055.269] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xc0, lpOverlapped=0x0) returned 1 [0055.270] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0055.290] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.299] CloseHandle (hObject=0xf8) returned 1 [0055.300] CloseHandle (hObject=0xfc) returned 1 [0055.300] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json.dvodltmf")) returned 0 [0055.301] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json.dvodltmf")) returned 0x2020 [0055.301] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0055.301] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0055.301] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0055.301] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json")) returned 1 [0055.302] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json")) returned 0xffffffff [0055.302] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0055.302] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0055.302] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_HK", cAlternateFileName="")) returned 1 [0055.302] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0055.303] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0055.303] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0055.303] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0055.303] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0055.303] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd2 [0055.303] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0055.304] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0055.393] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd2, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd2, lpOverlapped=0x0) returned 1 [0055.394] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0055.395] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0055.415] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.424] CloseHandle (hObject=0xfc) returned 1 [0055.425] CloseHandle (hObject=0xf8) returned 1 [0055.426] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json.dvodltmf")) returned 0 [0055.426] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json.dvodltmf")) returned 0x2020 [0055.426] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0055.426] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0055.426] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0055.427] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json")) returned 1 [0055.427] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json")) returned 0xffffffff [0055.427] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0055.427] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0055.429] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0055.429] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0055.430] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0055.430] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0055.430] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0055.430] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0055.431] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaa [0055.431] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0055.431] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0055.519] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xaa, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xaa, lpOverlapped=0x0) returned 1 [0055.520] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xb0, lpOverlapped=0x0) returned 1 [0055.521] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0055.541] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.550] CloseHandle (hObject=0xf8) returned 1 [0055.551] CloseHandle (hObject=0xfc) returned 1 [0055.552] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json.dvodltmf")) returned 0 [0055.552] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json.dvodltmf")) returned 0x2020 [0055.552] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0055.552] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0055.552] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0055.553] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json")) returned 1 [0055.553] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json")) returned 0xffffffff [0055.553] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0055.553] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0055.554] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zu", cAlternateFileName="")) returned 1 [0055.554] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0055.554] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0055.554] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xc2, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0055.554] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0055.554] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0055.554] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc2 [0055.554] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0055.555] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0055.642] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xc2, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xc2, lpOverlapped=0x0) returned 1 [0055.642] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xd0, lpOverlapped=0x0) returned 1 [0055.643] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0055.663] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.673] CloseHandle (hObject=0xfc) returned 1 [0055.673] CloseHandle (hObject=0xf8) returned 1 [0055.674] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json.dvodltmf")) returned 0 [0055.675] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json.dvodltmf")) returned 0x2020 [0055.675] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xc2, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0055.675] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xc2, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0055.675] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0055.675] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json")) returned 1 [0055.676] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json")) returned 0xffffffff [0055.676] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xc2, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0055.676] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0055.676] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zu", cAlternateFileName="")) returned 0 [0055.676] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0055.676] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8636e710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8636e710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0055.676] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8636e710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8636e710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0055.687] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8636e710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8636e710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.687] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8636e710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8636e710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8636e710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf3, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 1 [0055.687] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0055.687] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0055.691] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaf3 [0055.691] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0055.692] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0055.821] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xaf3, lpNumberOfBytesRead=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18df70*=0xaf3, lpOverlapped=0x0) returned 1 [0055.869] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb00, lpNumberOfBytesWritten=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18df70*=0xb00, lpOverlapped=0x0) returned 1 [0055.870] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0055.890] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.899] CloseHandle (hObject=0xf4) returned 1 [0055.900] CloseHandle (hObject=0xf8) returned 1 [0055.900] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json.dvodltmf")) returned 0 [0055.901] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json.dvodltmf")) returned 0x2020 [0055.901] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json", lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8636e710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8636e710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8636e710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf3, dwReserved0=0x2dee70, dwReserved1=0x18dfe4, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 0x2e84d8 [0055.901] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8636e710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8636e710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8636e710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf3, dwReserved0=0x2dee70, dwReserved1=0x18dfe4, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 0 [0055.901] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0055.901] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json")) returned 1 [0055.902] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json")) returned 0xffffffff [0055.902] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x4454, dwReserved0=0x2ded10, dwReserved1=0x18df7c, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0055.902] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0055.903] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0055.903] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4454 [0055.903] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0055.903] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0055.988] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4454, lpNumberOfBytesRead=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18df70*=0x4454, lpOverlapped=0x0) returned 1 [0055.990] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4460, lpNumberOfBytesWritten=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18df70*=0x4460, lpOverlapped=0x0) returned 1 [0055.991] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0056.011] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.021] CloseHandle (hObject=0xf8) returned 1 [0056.021] CloseHandle (hObject=0xf4) returned 1 [0056.022] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json.dvodltmf")) returned 0 [0056.022] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json.dvodltmf")) returned 0x2020 [0056.022] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json", lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x4454, dwReserved0=0x2dee70, dwReserved1=0x18dfe4, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0x2e84d8 [0056.022] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x4454, dwReserved0=0x2dee70, dwReserved1=0x18dfe4, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0056.022] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0056.022] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json")) returned 1 [0056.023] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json")) returned 0xffffffff [0056.024] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x4454, dwReserved0=0x2ded10, dwReserved1=0x18df7c, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0056.024] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0056.024] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8636e710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8636e710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0056.024] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0056.024] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x862fc2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="1.4_0", cAlternateFileName="")) returned 0 [0056.024] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0056.024] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ab7660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82abeb90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82abeb90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e6b4, cFileName="nmmhkkegccagdldgiimedpiccmgmieda", cAlternateFileName="NMMHKK~1")) returned 1 [0056.024] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ab7660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82abeb90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82abeb90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69726373, dwReserved1=0x6a2e7470, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0056.024] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ab7660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82abeb90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82abeb90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69726373, dwReserved1=0x6a2e7470, cFileName="..", cAlternateFileName="")) returned 1 [0056.025] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82651e90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e7880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e7880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69726373, dwReserved1=0x6a2e7470, cFileName="1.0.0.2_0", cAlternateFileName="100~1.2_0")) returned 1 [0056.025] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82651e90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e7880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e7880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0056.027] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82651e90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e7880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e7880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="..", cAlternateFileName="")) returned 1 [0056.027] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82888510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8288ac20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba221600, ftLastWriteTime.dwHighDateTime=0x1d297b0, nFileSizeHigh=0x0, nFileSizeLow=0x32a2e, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="craw_background.js", cAlternateFileName="CRAW_B~1.JS")) returned 1 [0056.027] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0056.030] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0056.030] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x32a2e [0056.031] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0056.031] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0056.118] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x32a2e, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0x32a2e, lpOverlapped=0x0) returned 1 [0056.216] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x32a30, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0x32a30, lpOverlapped=0x0) returned 1 [0056.220] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0056.240] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.250] CloseHandle (hObject=0x100) returned 1 [0056.250] CloseHandle (hObject=0xf4) returned 1 [0056.254] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.dvodltmf")) returned 0 [0056.254] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.dvodltmf")) returned 0x2020 [0056.254] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82888510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8288ac20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba221600, ftLastWriteTime.dwHighDateTime=0x1d297b0, nFileSizeHigh=0x0, nFileSizeLow=0x32a2e, dwReserved0=0x2dee60, dwReserved1=0x18e24c, cFileName="craw_background.js", cAlternateFileName="CRAW_B~1.JS")) returned 0x2e8498 [0056.254] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82888510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8288ac20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba221600, ftLastWriteTime.dwHighDateTime=0x1d297b0, nFileSizeHigh=0x0, nFileSizeLow=0x32a2e, dwReserved0=0x2dee60, dwReserved1=0x18e24c, cFileName="craw_background.js", cAlternateFileName="CRAW_B~1.JS")) returned 0 [0056.254] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0056.254] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js")) returned 1 [0056.257] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js")) returned 0xffffffff [0056.257] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8288d330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82892150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba221600, ftLastWriteTime.dwHighDateTime=0x1d297b0, nFileSizeHigh=0x0, nFileSizeLow=0x3b059, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="craw_window.js", cAlternateFileName="CRAW_W~1.JS")) returned 1 [0056.257] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0056.257] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0056.258] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b059 [0056.258] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0056.258] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0056.393] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3b059, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0x3b059, lpOverlapped=0x0) returned 1 [0056.398] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3b060, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0x3b060, lpOverlapped=0x0) returned 1 [0056.402] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0056.422] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.432] CloseHandle (hObject=0xf4) returned 1 [0056.432] CloseHandle (hObject=0x100) returned 1 [0056.435] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.dvodltmf")) returned 0 [0056.435] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.dvodltmf")) returned 0x2020 [0056.435] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8288d330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82892150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba221600, ftLastWriteTime.dwHighDateTime=0x1d297b0, nFileSizeHigh=0x0, nFileSizeLow=0x3b059, dwReserved0=0x2dee58, dwReserved1=0x18e24c, cFileName="craw_window.js", cAlternateFileName="CRAW_W~1.JS")) returned 0x2e8498 [0056.436] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8288d330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82892150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba221600, ftLastWriteTime.dwHighDateTime=0x1d297b0, nFileSizeHigh=0x0, nFileSizeLow=0x3b059, dwReserved0=0x2dee58, dwReserved1=0x18e24c, cFileName="craw_window.js", cAlternateFileName="CRAW_W~1.JS")) returned 0 [0056.436] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0056.436] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js")) returned 1 [0056.438] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js")) returned 0xffffffff [0056.438] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82896f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82899680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82899680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="css", cAlternateFileName="")) returned 1 [0056.438] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82896f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82899680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82899680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0056.438] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82896f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82899680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82899680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.438] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82899680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82899680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaae46e00, ftLastWriteTime.dwHighDateTime=0x1cec2fb, nFileSizeHigh=0x0, nFileSizeLow=0x6cd, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="craw_window.css", cAlternateFileName="CRAW_W~1.CSS")) returned 1 [0056.439] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0056.439] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0056.439] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6cd [0056.439] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0056.439] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0056.528] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x6cd, lpNumberOfBytesRead=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18df70*=0x6cd, lpOverlapped=0x0) returned 1 [0056.531] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18df70*=0x6d0, lpOverlapped=0x0) returned 1 [0056.532] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0056.552] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.562] CloseHandle (hObject=0xf4) returned 1 [0056.562] CloseHandle (hObject=0xf8) returned 1 [0056.563] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.dvodltmf")) returned 0 [0056.564] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.dvodltmf")) returned 0x2020 [0056.564] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css", lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82899680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82899680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaae46e00, ftLastWriteTime.dwHighDateTime=0x1cec2fb, nFileSizeHigh=0x0, nFileSizeLow=0x6cd, dwReserved0=0x2dee60, dwReserved1=0x18dfe4, cFileName="craw_window.css", cAlternateFileName="CRAW_W~1.CSS")) returned 0x2e84d8 [0056.564] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82899680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82899680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaae46e00, ftLastWriteTime.dwHighDateTime=0x1cec2fb, nFileSizeHigh=0x0, nFileSizeLow=0x6cd, dwReserved0=0x2dee60, dwReserved1=0x18dfe4, cFileName="craw_window.css", cAlternateFileName="CRAW_W~1.CSS")) returned 0 [0056.564] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0056.564] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css")) returned 1 [0056.565] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css")) returned 0xffffffff [0056.565] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82899680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82899680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaae46e00, ftLastWriteTime.dwHighDateTime=0x1cec2fb, nFileSizeHigh=0x0, nFileSizeLow=0x6cd, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="craw_window.css", cAlternateFileName="CRAW_W~1.CSS")) returned 0 [0056.565] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0056.565] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8289e4a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828a0bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828a0bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7373632e, dwReserved1=0x18e1e4, cFileName="html", cAlternateFileName="")) returned 1 [0056.565] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8289e4a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828a0bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828a0bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18df7c, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0056.565] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8289e4a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828a0bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828a0bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18df7c, cFileName="..", cAlternateFileName="")) returned 1 [0056.565] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828a0bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828a0bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x2ded10, dwReserved1=0x18df7c, cFileName="craw_window.html", cAlternateFileName="CRAW_W~1.HTM")) returned 1 [0056.566] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0056.575] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0056.575] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x32a [0056.575] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0056.576] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0056.670] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x32a, lpNumberOfBytesRead=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18df70*=0x32a, lpOverlapped=0x0) returned 1 [0056.672] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18df70*=0x330, lpOverlapped=0x0) returned 1 [0056.673] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0056.693] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.702] CloseHandle (hObject=0xf8) returned 1 [0056.703] CloseHandle (hObject=0xf4) returned 1 [0056.704] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.dvodltmf")) returned 0 [0056.704] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.dvodltmf")) returned 0x2020 [0056.704] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html", lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828a0bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828a0bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x2dee68, dwReserved1=0x18dfe4, cFileName="craw_window.html", cAlternateFileName="CRAW_W~1.HTM")) returned 0x2e84d8 [0056.704] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828a0bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828a0bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x2dee68, dwReserved1=0x18dfe4, cFileName="craw_window.html", cAlternateFileName="CRAW_W~1.HTM")) returned 0 [0056.705] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0056.705] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html")) returned 1 [0056.706] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html")) returned 0xffffffff [0056.706] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828a0bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828a0bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x2ded10, dwReserved1=0x18df7c, cFileName="craw_window.html", cAlternateFileName="CRAW_W~1.HTM")) returned 0 [0056.706] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0056.706] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828a32c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d74682e, dwReserved1=0x18e16c, cFileName="images", cAlternateFileName="")) returned 1 [0056.706] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828a32c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18df7c, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0056.707] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828a32c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18df7c, cFileName="..", cAlternateFileName="")) returned 1 [0056.707] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828a80e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828aa7f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0x112dc, dwReserved0=0x2ded10, dwReserved1=0x18df7c, cFileName="flapper.gif", cAlternateFileName="")) returned 1 [0056.707] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0056.708] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0056.708] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x112dc [0056.708] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0056.708] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0056.794] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x112dc, lpNumberOfBytesRead=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18df70*=0x112dc, lpOverlapped=0x0) returned 1 [0056.805] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x112e0, lpNumberOfBytesWritten=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18df70*=0x112e0, lpOverlapped=0x0) returned 1 [0056.807] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0056.827] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.837] CloseHandle (hObject=0xf4) returned 1 [0056.837] CloseHandle (hObject=0xf8) returned 1 [0056.838] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.dvodltmf")) returned 0 [0056.839] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.dvodltmf")) returned 0x2020 [0056.839] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif", lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828a80e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828aa7f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0x112dc, dwReserved0=0x2dee60, dwReserved1=0x18dfe4, cFileName="flapper.gif", cAlternateFileName="")) returned 0x2e84d8 [0056.839] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828a80e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828aa7f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0x112dc, dwReserved0=0x2dee60, dwReserved1=0x18dfe4, cFileName="flapper.gif", cAlternateFileName="")) returned 0 [0056.839] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0056.839] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif")) returned 1 [0056.841] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif")) returned 0xffffffff [0056.841] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828af610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1109, dwReserved0=0x2ded10, dwReserved1=0x18df7c, cFileName="icon_128.png", cAlternateFileName="")) returned 1 [0056.841] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0056.841] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0056.841] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1109 [0056.841] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0056.842] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0056.927] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1109, lpNumberOfBytesRead=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18df70*=0x1109, lpOverlapped=0x0) returned 1 [0056.929] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1110, lpNumberOfBytesWritten=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18df70*=0x1110, lpOverlapped=0x0) returned 1 [0056.930] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0056.957] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.966] CloseHandle (hObject=0xf8) returned 1 [0056.967] CloseHandle (hObject=0xf4) returned 1 [0056.968] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.dvodltmf")) returned 0 [0056.969] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.dvodltmf")) returned 0x2020 [0056.970] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png", lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828af610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1109, dwReserved0=0x2dee60, dwReserved1=0x18dfe4, cFileName="icon_128.png", cAlternateFileName="")) returned 0x2e84d8 [0056.970] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828af610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1109, dwReserved0=0x2dee60, dwReserved1=0x18dfe4, cFileName="icon_128.png", cAlternateFileName="")) returned 0 [0056.970] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0056.970] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png")) returned 1 [0056.971] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png")) returned 0xffffffff [0056.971] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828c7cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x22c, dwReserved0=0x2ded10, dwReserved1=0x18df7c, cFileName="icon_16.png", cAlternateFileName="")) returned 1 [0056.971] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0056.973] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0056.973] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x22c [0056.973] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0056.974] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0057.058] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x22c, lpNumberOfBytesRead=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18df70*=0x22c, lpOverlapped=0x0) returned 1 [0057.059] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18df70*=0x230, lpOverlapped=0x0) returned 1 [0057.060] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0057.080] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.089] CloseHandle (hObject=0xf4) returned 1 [0057.089] CloseHandle (hObject=0xf8) returned 1 [0057.091] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.dvodltmf")) returned 0 [0057.091] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.dvodltmf")) returned 0x2020 [0057.091] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png", lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828c7cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x22c, dwReserved0=0x2dee60, dwReserved1=0x18dfe4, cFileName="icon_16.png", cAlternateFileName="")) returned 0x2e84d8 [0057.091] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828c7cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x22c, dwReserved0=0x2dee60, dwReserved1=0x18dfe4, cFileName="icon_16.png", cAlternateFileName="")) returned 0 [0057.091] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0057.091] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png")) returned 1 [0057.095] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png")) returned 0xffffffff [0057.095] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828ccad0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828ccad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x2ded10, dwReserved1=0x18df7c, cFileName="topbar_floating_button.png", cAlternateFileName="TOPBAR~1.PNG")) returned 1 [0057.096] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0057.096] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0057.096] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa0 [0057.096] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0057.096] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0057.183] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18df70*=0xa0, lpOverlapped=0x0) returned 1 [0057.184] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18df70*=0xb0, lpOverlapped=0x0) returned 1 [0057.185] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0057.206] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.215] CloseHandle (hObject=0xf8) returned 1 [0057.216] CloseHandle (hObject=0xf4) returned 1 [0057.217] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.dvodltmf")) returned 0 [0057.217] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.dvodltmf")) returned 0x2020 [0057.217] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png", lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828ccad0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828ccad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x2dee80, dwReserved1=0x18dfe4, cFileName="topbar_floating_button.png", cAlternateFileName="TOPBAR~1.PNG")) returned 0x2e84d8 [0057.217] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828ccad0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828ccad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x2dee80, dwReserved1=0x18dfe4, cFileName="topbar_floating_button.png", cAlternateFileName="TOPBAR~1.PNG")) returned 0 [0057.217] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0057.217] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png")) returned 1 [0057.218] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png")) returned 0xffffffff [0057.218] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828cf1e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828d18f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x2ded10, dwReserved1=0x18df7c, cFileName="topbar_floating_button_close.png", cAlternateFileName="TOPBAR~2.PNG")) returned 1 [0057.218] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0057.219] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0057.219] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfc [0057.219] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0057.219] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0057.305] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xfc, lpNumberOfBytesRead=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18df70*=0xfc, lpOverlapped=0x0) returned 1 [0057.306] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18df70*=0x100, lpOverlapped=0x0) returned 1 [0057.307] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0057.327] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.337] CloseHandle (hObject=0xf4) returned 1 [0057.337] CloseHandle (hObject=0xf8) returned 1 [0057.338] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.dvodltmf")) returned 0 [0057.338] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.dvodltmf")) returned 0x2020 [0057.339] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png", lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828cf1e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828d18f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x2dee88, dwReserved1=0x18dfe4, cFileName="topbar_floating_button_close.png", cAlternateFileName="TOPBAR~2.PNG")) returned 0x2e84d8 [0057.339] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828cf1e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828d18f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x2dee88, dwReserved1=0x18dfe4, cFileName="topbar_floating_button_close.png", cAlternateFileName="TOPBAR~2.PNG")) returned 0 [0057.339] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0057.339] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png")) returned 1 [0057.344] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png")) returned 0xffffffff [0057.344] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828d6710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828d6710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x2ded10, dwReserved1=0x18df7c, cFileName="topbar_floating_button_hover.png", cAlternateFileName="TOPBAR~3.PNG")) returned 1 [0057.344] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0057.345] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0057.345] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa0 [0057.345] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0057.345] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0057.434] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18df70*=0xa0, lpOverlapped=0x0) returned 1 [0057.435] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18df70*=0xb0, lpOverlapped=0x0) returned 1 [0057.436] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0057.455] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.465] CloseHandle (hObject=0xf8) returned 1 [0057.465] CloseHandle (hObject=0xf4) returned 1 [0057.467] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.dvodltmf")) returned 0 [0057.467] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.dvodltmf")) returned 0x2020 [0057.467] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png", lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828d6710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828d6710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x2dee88, dwReserved1=0x18dfe4, cFileName="topbar_floating_button_hover.png", cAlternateFileName="TOPBAR~3.PNG")) returned 0x2e84d8 [0057.467] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828d6710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828d6710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x2dee88, dwReserved1=0x18dfe4, cFileName="topbar_floating_button_hover.png", cAlternateFileName="TOPBAR~3.PNG")) returned 0 [0057.467] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0057.467] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png")) returned 1 [0057.468] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png")) returned 0xffffffff [0057.469] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828d8e20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828d8e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa6, dwReserved0=0x2ded10, dwReserved1=0x18df7c, cFileName="topbar_floating_button_maximize.png", cAlternateFileName="TOPBAR~4.PNG")) returned 1 [0057.469] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0057.469] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0057.470] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa6 [0057.470] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0057.470] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0057.556] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa6, lpNumberOfBytesRead=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18df70*=0xa6, lpOverlapped=0x0) returned 1 [0057.557] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18df70*=0xb0, lpOverlapped=0x0) returned 1 [0057.558] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0057.577] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.587] CloseHandle (hObject=0xf4) returned 1 [0057.587] CloseHandle (hObject=0xf8) returned 1 [0057.588] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.dvodltmf")) returned 0 [0057.588] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.dvodltmf")) returned 0x2020 [0057.588] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png", lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828d8e20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828d8e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa6, dwReserved0=0x2dee90, dwReserved1=0x18dfe4, cFileName="topbar_floating_button_maximize.png", cAlternateFileName="TOPBAR~4.PNG")) returned 0x2e84d8 [0057.588] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828d8e20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828d8e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa6, dwReserved0=0x2dee90, dwReserved1=0x18dfe4, cFileName="topbar_floating_button_maximize.png", cAlternateFileName="TOPBAR~4.PNG")) returned 0 [0057.589] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0057.589] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png")) returned 1 [0057.590] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png")) returned 0xffffffff [0057.590] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828ddc40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828ddc40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x2ded10, dwReserved1=0x18df7c, cFileName="topbar_floating_button_pressed.png", cAlternateFileName="TOF9E1~1.PNG")) returned 1 [0057.590] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0057.590] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0057.590] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa0 [0057.590] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0057.591] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0057.677] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18df70*=0xa0, lpOverlapped=0x0) returned 1 [0057.678] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18df70*=0xb0, lpOverlapped=0x0) returned 1 [0057.679] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0057.698] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.708] CloseHandle (hObject=0xf8) returned 1 [0057.708] CloseHandle (hObject=0xf4) returned 1 [0057.709] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.dvodltmf")) returned 0 [0057.709] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.dvodltmf")) returned 0x2020 [0057.709] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png", lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828ddc40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828ddc40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x2dee90, dwReserved1=0x18dfe4, cFileName="topbar_floating_button_pressed.png", cAlternateFileName="TOF9E1~1.PNG")) returned 0x2e84d8 [0057.709] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828ddc40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828ddc40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x2dee90, dwReserved1=0x18dfe4, cFileName="topbar_floating_button_pressed.png", cAlternateFileName="TOF9E1~1.PNG")) returned 0 [0057.710] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0057.710] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png")) returned 1 [0057.711] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png")) returned 0xffffffff [0057.711] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828ddc40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828ddc40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x2ded10, dwReserved1=0x18df7c, cFileName="topbar_floating_button_pressed.png", cAlternateFileName="TOF9E1~1.PNG")) returned 0 [0057.711] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0057.711] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826545a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e2a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aa3de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x676e6974, dwReserved1=0x7475625f, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0057.711] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0057.711] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0057.711] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x52a [0057.711] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0057.712] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0057.828] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x52a, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0x52a, lpOverlapped=0x0) returned 1 [0057.839] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0x530, lpOverlapped=0x0) returned 1 [0057.840] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0057.859] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.869] CloseHandle (hObject=0x100) returned 1 [0057.869] CloseHandle (hObject=0xf4) returned 1 [0057.870] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json.dvodltmf")) returned 0 [0057.871] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json.dvodltmf")) returned 0x2020 [0057.871] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826545a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e2a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aa3de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x2dee58, dwReserved1=0x18e24c, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 0x2e8498 [0057.871] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826545a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e2a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aa3de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x2dee58, dwReserved1=0x18e24c, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 0 [0057.871] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0057.871] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json")) returned 1 [0057.872] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json")) returned 0xffffffff [0057.872] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82665710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828836f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828836f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="_locales", cAlternateFileName="")) returned 1 [0057.872] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82665710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828836f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828836f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0057.874] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82665710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828836f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828836f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.874] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8266a530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8266f350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0057.874] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8266a530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8266f350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0057.874] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8266a530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8266f350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.874] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8266f350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x376, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0057.874] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0057.875] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0057.875] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x376 [0057.875] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0057.876] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0057.961] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x376, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x376, lpOverlapped=0x0) returned 1 [0057.962] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x380, lpOverlapped=0x0) returned 1 [0057.963] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0057.983] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.993] CloseHandle (hObject=0xf8) returned 1 [0057.993] CloseHandle (hObject=0xfc) returned 1 [0057.994] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json.dvodltmf")) returned 0 [0057.994] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json.dvodltmf")) returned 0x2020 [0057.994] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8266f350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x376, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0057.995] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8266f350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x376, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0057.995] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0057.995] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json")) returned 1 [0057.996] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json")) returned 0xffffffff [0057.996] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8266f350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x376, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0057.996] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0057.996] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82676880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8267ddb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0057.996] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82676880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8267ddb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0057.997] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82676880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8267ddb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0057.997] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8267ddb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0057.997] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0057.997] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0057.997] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c1 [0057.997] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0057.998] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0058.083] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2c1, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x2c1, lpOverlapped=0x0) returned 1 [0058.085] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x2d0, lpOverlapped=0x0) returned 1 [0058.086] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0058.105] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.115] CloseHandle (hObject=0xfc) returned 1 [0058.115] CloseHandle (hObject=0xf8) returned 1 [0058.116] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json.dvodltmf")) returned 0 [0058.117] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json.dvodltmf")) returned 0x2020 [0058.117] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8267ddb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0058.117] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8267ddb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0058.117] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0058.117] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json")) returned 1 [0058.118] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json")) returned 0xffffffff [0058.118] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8267ddb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0058.118] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0058.118] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826a0090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a27a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826a27a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0058.118] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826a0090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a27a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826a27a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0058.119] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826a0090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a27a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826a27a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0058.119] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826a27a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0058.119] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0058.120] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0058.120] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x297 [0058.120] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0058.120] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0058.205] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x297, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x297, lpOverlapped=0x0) returned 1 [0058.206] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x2a0, lpOverlapped=0x0) returned 1 [0058.207] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0058.228] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.238] CloseHandle (hObject=0xf8) returned 1 [0058.238] CloseHandle (hObject=0xfc) returned 1 [0058.239] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json.dvodltmf")) returned 0 [0058.239] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json.dvodltmf")) returned 0x2020 [0058.239] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826a27a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0058.239] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826a27a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0058.240] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0058.240] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json")) returned 1 [0058.241] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json")) returned 0xffffffff [0058.241] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826a27a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0058.241] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0058.241] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ac3e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826b1200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0058.241] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ac3e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826b1200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0058.241] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ac3e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826b1200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0058.241] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826b1200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0058.241] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0058.241] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0058.242] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x282 [0058.242] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0058.242] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0058.326] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x282, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x282, lpOverlapped=0x0) returned 1 [0058.328] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x290, lpOverlapped=0x0) returned 1 [0058.329] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0058.353] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.362] CloseHandle (hObject=0xfc) returned 1 [0058.363] CloseHandle (hObject=0xf8) returned 1 [0058.364] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json.dvodltmf")) returned 0 [0058.364] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json.dvodltmf")) returned 0x2020 [0058.364] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826b1200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0058.364] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826b1200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0058.364] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0058.365] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json")) returned 1 [0058.365] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json")) returned 0xffffffff [0058.365] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826b1200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0058.366] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0058.366] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826bae40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0058.366] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826bae40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0058.366] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826bae40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0058.366] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826bae40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2bd, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0058.366] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0058.367] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0058.367] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2bd [0058.367] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0058.368] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0058.455] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2bd, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x2bd, lpOverlapped=0x0) returned 1 [0058.457] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x2c0, lpOverlapped=0x0) returned 1 [0058.458] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0058.477] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.487] CloseHandle (hObject=0xf8) returned 1 [0058.487] CloseHandle (hObject=0xfc) returned 1 [0058.488] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json.dvodltmf")) returned 0 [0058.489] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json.dvodltmf")) returned 0x2020 [0058.489] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826bae40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2bd, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0058.489] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826bae40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2bd, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0058.489] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0058.489] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json")) returned 1 [0058.490] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json")) returned 0xffffffff [0058.490] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826bae40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2bd, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0058.490] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0058.490] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826c2370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826c7190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0058.490] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826c2370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826c7190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0058.490] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826c2370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826c7190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0058.490] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826c7190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36b, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0058.490] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0058.491] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0058.491] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x36b [0058.491] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0058.491] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0058.576] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x36b, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x36b, lpOverlapped=0x0) returned 1 [0058.578] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x370, lpOverlapped=0x0) returned 1 [0058.579] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0058.599] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.608] CloseHandle (hObject=0xfc) returned 1 [0058.608] CloseHandle (hObject=0xf8) returned 1 [0058.610] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json.dvodltmf")) returned 0 [0058.610] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json.dvodltmf")) returned 0x2020 [0058.610] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826c7190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36b, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0058.610] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826c7190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36b, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0058.610] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0058.610] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json")) returned 1 [0058.611] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json")) returned 0xffffffff [0058.611] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826c7190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36b, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0058.612] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0058.612] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ce6c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d0dd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826d0dd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1 [0058.612] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ce6c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d0dd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826d0dd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0058.612] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ce6c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d0dd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826d0dd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0058.612] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826d0dd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d34e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0058.612] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0058.613] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0058.613] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x269 [0058.613] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0058.613] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0058.704] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x269, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x269, lpOverlapped=0x0) returned 1 [0058.705] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x270, lpOverlapped=0x0) returned 1 [0058.706] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0058.726] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.736] CloseHandle (hObject=0xf8) returned 1 [0058.736] CloseHandle (hObject=0xfc) returned 1 [0058.737] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json.dvodltmf")) returned 0 [0058.738] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json.dvodltmf")) returned 0x2020 [0058.738] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826d0dd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d34e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0058.738] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826d0dd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d34e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0058.738] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0058.738] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json")) returned 1 [0058.739] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json")) returned 0xffffffff [0058.739] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826d0dd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d34e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0058.739] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0058.739] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826d8300, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826df830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826df830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0058.739] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826d8300, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826df830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826df830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0058.739] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826d8300, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826df830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826df830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0058.739] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826df830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826e1f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0058.740] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0058.740] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0058.740] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x269 [0058.740] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0058.740] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0058.827] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x269, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x269, lpOverlapped=0x0) returned 1 [0058.839] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x270, lpOverlapped=0x0) returned 1 [0058.840] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0058.860] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.870] CloseHandle (hObject=0xfc) returned 1 [0058.870] CloseHandle (hObject=0xf8) returned 1 [0058.871] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json.dvodltmf")) returned 0 [0058.872] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json.dvodltmf")) returned 0x2020 [0058.872] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826df830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826e1f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0058.872] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826df830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826e1f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0058.872] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0058.872] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json")) returned 1 [0058.873] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json")) returned 0xffffffff [0058.873] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826df830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826e1f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0058.873] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0058.873] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826e9470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826ebb80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0058.873] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826e9470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826ebb80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0058.874] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826e9470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826ebb80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0058.874] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826ebb80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b8, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0058.874] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0058.875] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0058.875] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b8 [0058.875] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0058.875] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0058.960] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2b8, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x2b8, lpOverlapped=0x0) returned 1 [0058.962] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x2c0, lpOverlapped=0x0) returned 1 [0058.963] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0058.987] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.997] CloseHandle (hObject=0xf8) returned 1 [0058.997] CloseHandle (hObject=0xfc) returned 1 [0058.998] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json.dvodltmf")) returned 0 [0058.998] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json.dvodltmf")) returned 0x2020 [0058.998] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826ebb80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b8, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0058.999] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826ebb80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b8, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0058.999] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0058.999] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json")) returned 1 [0059.000] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json")) returned 0xffffffff [0059.000] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826ebb80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b8, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0059.000] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0059.000] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826f30b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826f7ed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="es_419", cAlternateFileName="")) returned 1 [0059.000] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826f30b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826f7ed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0059.000] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826f30b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826f7ed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0059.000] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826f7ed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0059.000] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0059.001] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0059.001] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29b [0059.001] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0059.001] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0059.086] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x29b, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x29b, lpOverlapped=0x0) returned 1 [0059.088] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x2a0, lpOverlapped=0x0) returned 1 [0059.089] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0059.108] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.118] CloseHandle (hObject=0xfc) returned 1 [0059.118] CloseHandle (hObject=0xf8) returned 1 [0059.119] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json.dvodltmf")) returned 0 [0059.120] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json.dvodltmf")) returned 0x2020 [0059.120] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826f7ed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x2dee78, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0059.120] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826f7ed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x2dee78, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0059.120] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0059.120] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json")) returned 1 [0059.121] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json")) returned 0xffffffff [0059.121] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826f7ed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0059.121] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0059.121] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ff400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82701b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82701b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0059.121] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ff400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82701b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82701b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0059.122] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ff400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82701b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82701b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0059.122] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82701b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82704220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x261, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0059.122] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0059.122] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0059.123] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x261 [0059.123] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0059.123] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0059.209] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x261, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x261, lpOverlapped=0x0) returned 1 [0059.210] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x270, lpOverlapped=0x0) returned 1 [0059.211] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0059.231] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.240] CloseHandle (hObject=0xf8) returned 1 [0059.241] CloseHandle (hObject=0xfc) returned 1 [0059.242] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json.dvodltmf")) returned 0 [0059.242] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json.dvodltmf")) returned 0x2020 [0059.242] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82701b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82704220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x261, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0059.243] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82701b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82704220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x261, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0059.243] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0059.243] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json")) returned 1 [0059.244] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json")) returned 0xffffffff [0059.244] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82701b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82704220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x261, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0059.244] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0059.244] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82709040, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8270de60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0059.244] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82709040, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8270de60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0059.244] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82709040, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8270de60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0059.244] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8270de60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a1, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0059.245] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0059.245] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0059.245] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2a1 [0059.245] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0059.245] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0059.331] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2a1, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x2a1, lpOverlapped=0x0) returned 1 [0059.333] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x2b0, lpOverlapped=0x0) returned 1 [0059.334] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0059.357] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.367] CloseHandle (hObject=0xfc) returned 1 [0059.367] CloseHandle (hObject=0xf8) returned 1 [0059.368] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json.dvodltmf")) returned 0 [0059.369] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json.dvodltmf")) returned 0x2020 [0059.369] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8270de60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a1, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0059.369] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8270de60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a1, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0059.369] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0059.369] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json")) returned 1 [0059.370] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json")) returned 0xffffffff [0059.370] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8270de60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a1, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0059.370] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0059.370] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82715390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82717aa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0059.370] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82715390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82717aa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0059.371] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82715390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82717aa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0059.371] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82717aa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b4, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0059.371] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0059.372] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0059.372] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b4 [0059.372] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0059.372] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0059.462] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2b4, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x2b4, lpOverlapped=0x0) returned 1 [0059.464] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x2c0, lpOverlapped=0x0) returned 1 [0059.465] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0059.485] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.494] CloseHandle (hObject=0xf8) returned 1 [0059.495] CloseHandle (hObject=0xfc) returned 1 [0059.496] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json.dvodltmf")) returned 0 [0059.496] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json.dvodltmf")) returned 0x2020 [0059.496] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82717aa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b4, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0059.496] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82717aa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b4, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0059.496] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0059.496] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json")) returned 1 [0059.497] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json")) returned 0xffffffff [0059.497] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82717aa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b4, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0059.497] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0059.498] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8271efd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827216e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827216e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0059.498] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8271efd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827216e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827216e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0059.498] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8271efd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827216e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827216e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0059.498] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827216e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82723df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c4, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0059.498] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0059.498] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0059.498] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c4 [0059.498] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0059.499] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0059.583] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2c4, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x2c4, lpOverlapped=0x0) returned 1 [0059.585] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x2d0, lpOverlapped=0x0) returned 1 [0059.586] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0059.606] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.615] CloseHandle (hObject=0xfc) returned 1 [0059.616] CloseHandle (hObject=0xf8) returned 1 [0059.617] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json.dvodltmf")) returned 0 [0059.617] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json.dvodltmf")) returned 0x2020 [0059.617] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827216e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82723df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c4, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0059.617] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827216e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82723df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c4, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0059.617] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0059.618] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json")) returned 1 [0059.618] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json")) returned 0xffffffff [0059.619] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827216e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82723df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c4, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0059.619] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0059.619] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82728c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8272da30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0059.619] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82728c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8272da30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0059.619] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82728c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8272da30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0059.619] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8272da30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ad, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0059.619] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0059.620] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0059.620] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ad [0059.620] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0059.621] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0059.710] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3ad, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x3ad, lpOverlapped=0x0) returned 1 [0059.712] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x3b0, lpOverlapped=0x0) returned 1 [0059.713] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0059.732] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.741] CloseHandle (hObject=0xf8) returned 1 [0059.742] CloseHandle (hObject=0xfc) returned 1 [0059.743] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json.dvodltmf")) returned 0 [0059.753] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json.dvodltmf")) returned 0x2020 [0059.753] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8272da30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ad, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0059.754] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8272da30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ad, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0059.754] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0059.754] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json")) returned 1 [0059.754] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json")) returned 0xffffffff [0059.754] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8272da30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ad, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0059.754] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0059.754] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827412b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827439c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827439c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0059.754] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827412b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827439c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827439c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0059.755] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827412b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827439c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827439c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0059.755] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827439c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827460d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x279, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0059.755] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0059.755] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0059.755] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x279 [0059.755] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0059.756] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0059.840] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x279, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x279, lpOverlapped=0x0) returned 1 [0059.851] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x280, lpOverlapped=0x0) returned 1 [0059.852] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0059.872] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.881] CloseHandle (hObject=0xfc) returned 1 [0059.881] CloseHandle (hObject=0xf8) returned 1 [0059.883] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json.dvodltmf")) returned 0 [0059.883] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json.dvodltmf")) returned 0x2020 [0059.883] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827439c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827460d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x279, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0059.883] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827439c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827460d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x279, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0059.884] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0059.884] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json")) returned 1 [0059.885] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json")) returned 0xffffffff [0059.885] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827439c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827460d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x279, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0059.885] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0059.885] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8274aef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274d600, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8274d600, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0059.885] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8274aef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274d600, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8274d600, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0059.885] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8274aef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274d600, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8274d600, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0059.885] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8274d600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274fd10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0059.885] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0059.886] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0059.887] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c6 [0059.887] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0059.887] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0059.975] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2c6, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x2c6, lpOverlapped=0x0) returned 1 [0059.977] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x2d0, lpOverlapped=0x0) returned 1 [0059.978] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0059.998] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0060.008] CloseHandle (hObject=0xf8) returned 1 [0060.008] CloseHandle (hObject=0xfc) returned 1 [0060.009] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json.dvodltmf")) returned 0 [0060.010] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json.dvodltmf")) returned 0x2020 [0060.010] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8274d600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274fd10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0060.010] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8274d600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274fd10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0060.010] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0060.010] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json")) returned 1 [0060.011] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json")) returned 0xffffffff [0060.011] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8274d600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274fd10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0060.011] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0060.011] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82752420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0060.012] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82752420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0060.012] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82752420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0060.012] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0060.012] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0060.012] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0060.012] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x269 [0060.012] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0060.013] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0060.100] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x269, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x269, lpOverlapped=0x0) returned 1 [0060.102] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x270, lpOverlapped=0x0) returned 1 [0060.102] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0060.122] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0060.131] CloseHandle (hObject=0xfc) returned 1 [0060.132] CloseHandle (hObject=0xf8) returned 1 [0060.135] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json.dvodltmf")) returned 0 [0060.136] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json.dvodltmf")) returned 0x2020 [0060.136] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0060.136] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0060.136] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0060.136] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json")) returned 1 [0060.137] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json")) returned 0xffffffff [0060.137] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0060.137] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0060.137] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82759950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8275c060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0060.137] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82759950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8275c060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0060.137] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82759950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8275c060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0060.137] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8275c060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x26e, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0060.137] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0060.138] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0060.138] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x26e [0060.139] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0060.139] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0060.224] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x26e, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x26e, lpOverlapped=0x0) returned 1 [0060.227] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x270, lpOverlapped=0x0) returned 1 [0060.228] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0060.247] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0060.256] CloseHandle (hObject=0xf8) returned 1 [0060.256] CloseHandle (hObject=0xfc) returned 1 [0060.257] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json.dvodltmf")) returned 0 [0060.258] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json.dvodltmf")) returned 0x2020 [0060.258] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8275c060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x26e, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0060.258] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8275c060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x26e, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0060.258] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0060.258] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json")) returned 1 [0060.259] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json")) returned 0xffffffff [0060.259] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8275c060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x26e, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0060.259] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0060.259] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82763590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82765ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0060.259] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82763590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82765ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0060.260] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82763590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82765ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0060.260] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82765ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30a, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0060.260] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0060.260] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0060.260] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x30a [0060.260] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0060.260] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0060.346] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x30a, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x30a, lpOverlapped=0x0) returned 1 [0060.348] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x310, lpOverlapped=0x0) returned 1 [0060.349] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0060.373] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0060.382] CloseHandle (hObject=0xfc) returned 1 [0060.383] CloseHandle (hObject=0xf8) returned 1 [0060.384] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json.dvodltmf")) returned 0 [0060.384] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json.dvodltmf")) returned 0x2020 [0060.384] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82765ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30a, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0060.385] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82765ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30a, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0060.385] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0060.385] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json")) returned 1 [0060.386] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json")) returned 0xffffffff [0060.386] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82765ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30a, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0060.386] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0060.386] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8276d1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8276f8e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0060.386] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8276d1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8276f8e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0060.386] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8276d1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8276f8e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0060.386] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8276f8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29d, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0060.386] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0060.388] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0060.388] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29d [0060.388] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0060.388] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0060.478] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x29d, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x29d, lpOverlapped=0x0) returned 1 [0060.479] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x2a0, lpOverlapped=0x0) returned 1 [0060.480] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0060.500] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0060.510] CloseHandle (hObject=0xf8) returned 1 [0060.511] CloseHandle (hObject=0xfc) returned 1 [0060.514] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json.dvodltmf")) returned 0 [0060.515] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json.dvodltmf")) returned 0x2020 [0060.515] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8276f8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29d, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0060.515] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8276f8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29d, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0060.515] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0060.515] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json")) returned 1 [0060.516] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json")) returned 0xffffffff [0060.517] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8276f8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29d, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0060.517] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0060.517] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82776e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82779520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0060.517] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82776e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82779520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0060.517] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82776e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82779520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0060.517] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82779520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ae, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0060.517] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0060.518] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0060.518] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ae [0060.518] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0060.518] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0060.603] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2ae, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x2ae, lpOverlapped=0x0) returned 1 [0060.605] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x2b0, lpOverlapped=0x0) returned 1 [0060.606] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0060.626] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0060.636] CloseHandle (hObject=0xfc) returned 1 [0060.636] CloseHandle (hObject=0xf8) returned 1 [0060.637] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json.dvodltmf")) returned 0 [0060.638] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json.dvodltmf")) returned 0x2020 [0060.638] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82779520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ae, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0060.638] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82779520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ae, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0060.638] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0060.638] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json")) returned 1 [0060.639] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json")) returned 0xffffffff [0060.639] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82779520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ae, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0060.639] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0060.639] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8277e340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82783160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0060.639] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8277e340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82783160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0060.639] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8277e340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82783160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0060.640] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82783160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2bb, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0060.640] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0060.640] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0060.641] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2bb [0060.641] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0060.641] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0060.734] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2bb, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x2bb, lpOverlapped=0x0) returned 1 [0060.736] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x2c0, lpOverlapped=0x0) returned 1 [0060.737] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0060.756] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0060.766] CloseHandle (hObject=0xf8) returned 1 [0060.766] CloseHandle (hObject=0xfc) returned 1 [0060.767] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json.dvodltmf")) returned 0 [0060.767] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json.dvodltmf")) returned 0x2020 [0060.767] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82783160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2bb, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0060.767] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82783160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2bb, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0060.767] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0060.767] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json")) returned 1 [0060.768] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json")) returned 0xffffffff [0060.768] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82783160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2bb, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0060.768] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0060.769] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82787f80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8278a690, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="nb", cAlternateFileName="")) returned 1 [0060.769] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82787f80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8278a690, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0060.769] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82787f80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8278a690, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0060.769] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8278a690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0060.769] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0060.769] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0060.769] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x284 [0060.769] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0060.770] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0060.886] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x284, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x284, lpOverlapped=0x0) returned 1 [0060.888] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x290, lpOverlapped=0x0) returned 1 [0060.889] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0060.908] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0060.918] CloseHandle (hObject=0xfc) returned 1 [0060.918] CloseHandle (hObject=0xf8) returned 1 [0060.919] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json.dvodltmf")) returned 0 [0060.919] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json.dvodltmf")) returned 0x2020 [0060.920] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8278a690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0060.920] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8278a690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0060.920] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0060.920] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json")) returned 1 [0060.921] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json")) returned 0xffffffff [0060.921] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8278a690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0060.921] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0060.921] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82791bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827942d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827942d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0060.921] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82791bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827942d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827942d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0060.922] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82791bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827942d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827942d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0060.922] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827942d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827969e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0060.922] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0060.923] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0060.924] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x282 [0060.924] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0060.924] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0061.012] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x282, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x282, lpOverlapped=0x0) returned 1 [0061.014] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x290, lpOverlapped=0x0) returned 1 [0061.015] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0061.035] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0061.045] CloseHandle (hObject=0xf8) returned 1 [0061.045] CloseHandle (hObject=0xfc) returned 1 [0061.046] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json.dvodltmf")) returned 0 [0061.047] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json.dvodltmf")) returned 0x2020 [0061.047] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827942d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827969e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0061.047] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827942d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827969e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0061.047] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0061.047] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json")) returned 1 [0061.049] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json")) returned 0xffffffff [0061.049] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827942d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827969e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0061.049] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0061.049] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8279b800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8279df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0061.049] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8279b800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8279df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0061.049] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8279b800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8279df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0061.049] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8279df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0061.049] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0061.050] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0061.050] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29a [0061.050] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0061.050] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0061.135] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x29a, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x29a, lpOverlapped=0x0) returned 1 [0061.137] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x2a0, lpOverlapped=0x0) returned 1 [0061.138] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0061.158] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0061.175] CloseHandle (hObject=0xfc) returned 1 [0061.176] CloseHandle (hObject=0xf8) returned 1 [0061.182] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json.dvodltmf")) returned 0 [0061.183] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json.dvodltmf")) returned 0x2020 [0061.183] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8279df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0061.183] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8279df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0061.183] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0061.183] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json")) returned 1 [0061.185] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json")) returned 0xffffffff [0061.185] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8279df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0061.185] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0061.185] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827a2d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827a5440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0061.185] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827a2d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827a5440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0061.185] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827a2d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827a5440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0061.186] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827a5440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0061.186] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0061.197] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0061.197] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29b [0061.197] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0061.198] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0061.287] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x29b, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x29b, lpOverlapped=0x0) returned 1 [0061.299] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x2a0, lpOverlapped=0x0) returned 1 [0061.300] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0061.326] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0061.337] CloseHandle (hObject=0xf8) returned 1 [0061.337] CloseHandle (hObject=0xfc) returned 1 [0061.338] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json.dvodltmf")) returned 0 [0061.338] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json.dvodltmf")) returned 0x2020 [0061.338] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827a5440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0061.339] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827a5440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0061.339] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0061.339] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json")) returned 1 [0061.340] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json")) returned 0xffffffff [0061.340] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827a5440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0061.340] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0061.340] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827aa260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827af080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827af080, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0061.340] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827aa260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827af080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827af080, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0061.340] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827aa260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827af080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827af080, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0061.340] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827af080, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827af080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x295, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0061.340] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0061.341] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0061.341] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x295 [0061.341] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0061.341] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0061.483] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x295, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x295, lpOverlapped=0x0) returned 1 [0061.683] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x2a0, lpOverlapped=0x0) returned 1 [0061.684] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0061.704] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0061.718] CloseHandle (hObject=0xfc) returned 1 [0061.718] CloseHandle (hObject=0xf8) returned 1 [0061.719] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json.dvodltmf")) returned 0 [0061.720] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json.dvodltmf")) returned 0x2020 [0061.720] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827af080, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827af080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x295, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0061.720] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827af080, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827af080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x295, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0061.720] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0061.721] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json")) returned 1 [0061.722] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json")) returned 0xffffffff [0061.722] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827af080, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827af080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x295, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0061.722] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0061.722] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827b3ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827b65b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827b65b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0061.722] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827b3ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827b65b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827b65b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0061.723] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827b3ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827b65b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827b65b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0061.723] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827b65b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827b8cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29c, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0061.723] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0061.724] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0061.724] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29c [0061.724] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0061.724] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0061.845] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x29c, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x29c, lpOverlapped=0x0) returned 1 [0061.847] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x2a0, lpOverlapped=0x0) returned 1 [0061.848] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0061.878] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0061.890] CloseHandle (hObject=0xf8) returned 1 [0061.890] CloseHandle (hObject=0xfc) returned 1 [0061.891] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json.dvodltmf")) returned 0 [0061.892] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json.dvodltmf")) returned 0x2020 [0061.892] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827b65b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827b8cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29c, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0061.892] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827b65b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827b8cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29c, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0061.892] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0061.892] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json")) returned 1 [0061.894] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json")) returned 0xffffffff [0061.894] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827b65b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827b8cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29c, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0061.894] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0061.894] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827c7720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827cc540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827cc540, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0061.894] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827c7720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827cc540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827cc540, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0061.894] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827c7720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827cc540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827cc540, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0061.894] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827cc540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827cec50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30f, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0061.894] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0061.895] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0061.896] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x30f [0061.896] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0061.896] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0062.006] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x30f, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x30f, lpOverlapped=0x0) returned 1 [0062.008] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x310, lpOverlapped=0x0) returned 1 [0062.009] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0062.028] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0062.038] CloseHandle (hObject=0xfc) returned 1 [0062.038] CloseHandle (hObject=0xf8) returned 1 [0062.039] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json.dvodltmf")) returned 0 [0062.040] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json.dvodltmf")) returned 0x2020 [0062.040] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827cc540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827cec50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30f, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0062.040] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827cc540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827cec50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30f, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0062.040] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0062.040] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json")) returned 1 [0062.041] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json")) returned 0xffffffff [0062.041] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827cc540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827cec50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30f, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0062.041] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0062.041] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827e4be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827e72f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827e72f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0062.041] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827e4be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827e72f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827e72f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0062.042] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827e4be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827e72f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827e72f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0062.042] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827e72f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827e9a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29f, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0062.042] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0062.042] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0062.043] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29f [0062.043] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0062.043] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0062.129] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x29f, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x29f, lpOverlapped=0x0) returned 1 [0062.132] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x2a0, lpOverlapped=0x0) returned 1 [0062.133] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0062.152] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0062.162] CloseHandle (hObject=0xf8) returned 1 [0062.162] CloseHandle (hObject=0xfc) returned 1 [0062.163] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json.dvodltmf")) returned 0 [0062.164] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json.dvodltmf")) returned 0x2020 [0062.164] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827e72f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827e9a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29f, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0062.164] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827e72f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827e9a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29f, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0062.164] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0062.164] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json")) returned 1 [0062.165] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json")) returned 0xffffffff [0062.165] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827e72f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827e9a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29f, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0062.165] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0062.165] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827f5d50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827fab70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827fab70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0062.165] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827f5d50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827fab70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827fab70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0062.166] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827f5d50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827fab70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827fab70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0062.166] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827fab70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827fd280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0062.166] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0062.166] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0062.166] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x282 [0062.166] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0062.166] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0062.252] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x282, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x282, lpOverlapped=0x0) returned 1 [0062.257] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x290, lpOverlapped=0x0) returned 1 [0062.258] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0062.278] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0062.287] CloseHandle (hObject=0xfc) returned 1 [0062.287] CloseHandle (hObject=0xf8) returned 1 [0062.289] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json.dvodltmf")) returned 0 [0062.289] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json.dvodltmf")) returned 0x2020 [0062.289] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827fab70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827fd280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0062.289] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827fab70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827fd280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0062.289] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0062.289] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json")) returned 1 [0062.290] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json")) returned 0xffffffff [0062.290] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827fab70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827fd280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0062.290] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0062.294] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828095d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8280e3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8280e3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0062.294] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828095d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8280e3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8280e3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0062.294] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828095d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8280e3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8280e3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0062.294] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8280e3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82821c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0062.294] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0062.295] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0062.295] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x32c [0062.295] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0062.296] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0062.388] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x32c, lpOverlapped=0x0) returned 1 [0062.389] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x330, lpOverlapped=0x0) returned 1 [0062.390] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0062.410] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0062.420] CloseHandle (hObject=0xf8) returned 1 [0062.420] CloseHandle (hObject=0xfc) returned 1 [0062.421] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json.dvodltmf")) returned 0 [0062.421] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json.dvodltmf")) returned 0x2020 [0062.421] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8280e3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82821c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0062.421] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8280e3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82821c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0062.422] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0062.422] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json")) returned 1 [0062.423] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json")) returned 0xffffffff [0062.423] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8280e3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82821c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0062.423] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0062.423] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8282b8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828306d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828306d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0062.423] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8282b8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828306d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828306d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0062.423] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8282b8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828306d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828306d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0062.423] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828306d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8283ca20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x289, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0062.423] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0062.423] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0062.424] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x289 [0062.424] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0062.424] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0062.511] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x289, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x289, lpOverlapped=0x0) returned 1 [0062.513] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x290, lpOverlapped=0x0) returned 1 [0062.514] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0062.533] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0062.542] CloseHandle (hObject=0xfc) returned 1 [0062.542] CloseHandle (hObject=0xf8) returned 1 [0062.544] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json.dvodltmf")) returned 0 [0062.544] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json.dvodltmf")) returned 0x2020 [0062.544] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828306d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8283ca20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x289, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0062.544] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828306d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8283ca20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x289, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0062.544] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0062.544] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json")) returned 1 [0062.545] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json")) returned 0xffffffff [0062.545] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828306d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8283ca20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x289, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0062.545] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0062.545] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8284db90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828529b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828529b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0062.546] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8284db90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828529b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828529b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0062.546] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8284db90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828529b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828529b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0062.546] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828529b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828529b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x44b, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0062.546] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0062.547] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0062.547] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x44b [0062.547] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0062.547] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0062.633] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x44b, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x44b, lpOverlapped=0x0) returned 1 [0062.645] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x450, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x450, lpOverlapped=0x0) returned 1 [0062.646] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0062.665] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0062.675] CloseHandle (hObject=0xf8) returned 1 [0062.675] CloseHandle (hObject=0xfc) returned 1 [0062.676] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json.dvodltmf")) returned 0 [0062.677] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json.dvodltmf")) returned 0x2020 [0062.677] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828529b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828529b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x44b, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0062.677] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828529b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828529b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x44b, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0062.677] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0062.678] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json")) returned 1 [0062.679] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json")) returned 0xffffffff [0062.679] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828529b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828529b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x44b, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0062.679] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0062.679] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82863b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82866230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82866230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0062.679] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82863b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82866230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82866230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0062.679] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82863b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82866230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82866230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0062.679] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82866230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82866230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0062.679] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0062.680] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0062.680] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x28a [0062.680] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0062.680] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0062.767] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x28a, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x28a, lpOverlapped=0x0) returned 1 [0062.770] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x290, lpOverlapped=0x0) returned 1 [0062.771] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0062.793] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0062.803] CloseHandle (hObject=0xfc) returned 1 [0062.803] CloseHandle (hObject=0xf8) returned 1 [0062.804] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json.dvodltmf")) returned 0 [0062.804] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json.dvodltmf")) returned 0x2020 [0062.804] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82866230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82866230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0062.805] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82866230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82866230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0062.805] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0062.805] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json")) returned 1 [0062.806] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json")) returned 0xffffffff [0062.806] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82866230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82866230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0062.806] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0062.806] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8286b050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8286d760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8286d760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0062.806] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8286b050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8286d760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8286d760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0062.806] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8286b050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8286d760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8286d760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0062.806] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8286d760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8286d760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x315, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0062.806] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0062.808] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0062.808] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x315 [0062.808] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0062.809] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0062.894] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x315, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x315, lpOverlapped=0x0) returned 1 [0062.906] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x320, lpOverlapped=0x0) returned 1 [0062.907] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0062.927] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0062.937] CloseHandle (hObject=0xf8) returned 1 [0062.937] CloseHandle (hObject=0xfc) returned 1 [0062.941] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json.dvodltmf")) returned 0 [0062.941] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json.dvodltmf")) returned 0x2020 [0062.941] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8286d760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8286d760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x315, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0062.942] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8286d760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8286d760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x315, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0062.942] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0062.942] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json")) returned 1 [0062.943] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json")) returned 0xffffffff [0062.943] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8286d760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8286d760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x315, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0062.943] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0062.943] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82872580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82874c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82874c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0062.943] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82872580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82874c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82874c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0062.943] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82872580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82874c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82874c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0062.943] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82874c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82874c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0062.943] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0062.943] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0062.944] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d0 [0062.944] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0062.944] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0063.032] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2d0, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x2d0, lpOverlapped=0x0) returned 1 [0063.034] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x2e0, lpOverlapped=0x0) returned 1 [0063.035] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0063.055] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0063.064] CloseHandle (hObject=0xfc) returned 1 [0063.067] CloseHandle (hObject=0xf8) returned 1 [0063.069] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json.dvodltmf")) returned 0 [0063.069] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json.dvodltmf")) returned 0x2020 [0063.069] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82874c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82874c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0063.069] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82874c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82874c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0063.069] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0063.070] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json")) returned 1 [0063.070] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json")) returned 0xffffffff [0063.071] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82874c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82874c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0063.071] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0063.071] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82879ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8287e8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8287e8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0063.071] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82879ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8287e8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8287e8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0063.071] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82879ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8287e8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8287e8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0063.071] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8287e8d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8287e8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0063.071] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0063.071] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0063.072] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x253 [0063.072] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0063.072] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0063.158] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x253, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x253, lpOverlapped=0x0) returned 1 [0063.165] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x260, lpOverlapped=0x0) returned 1 [0063.166] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0063.186] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0063.197] CloseHandle (hObject=0xf8) returned 1 [0063.197] CloseHandle (hObject=0xfc) returned 1 [0063.198] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json.dvodltmf")) returned 0 [0063.198] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json.dvodltmf")) returned 0x2020 [0063.198] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8287e8d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8287e8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0063.199] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8287e8d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8287e8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0063.199] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0063.199] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json")) returned 1 [0063.200] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json")) returned 0xffffffff [0063.200] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8287e8d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8287e8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0063.200] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0063.200] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828836f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82885e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82885e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0063.200] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828836f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82885e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82885e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0063.200] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828836f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82885e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82885e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0063.200] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82885e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82885e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0063.200] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0063.201] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0063.201] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x280 [0063.201] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0063.201] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0063.287] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x280, lpOverlapped=0x0) returned 1 [0063.289] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x290, lpOverlapped=0x0) returned 1 [0063.290] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0063.310] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0063.319] CloseHandle (hObject=0xfc) returned 1 [0063.319] CloseHandle (hObject=0xf8) returned 1 [0063.320] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json.dvodltmf")) returned 0 [0063.321] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json.dvodltmf")) returned 0x2020 [0063.321] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82885e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82885e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0063.321] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82885e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82885e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x2dee70, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0063.321] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0063.321] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json")) returned 1 [0063.322] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json")) returned 0xffffffff [0063.322] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82885e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82885e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0063.322] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0063.322] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828836f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82885e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82885e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0063.322] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0063.323] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828e7880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e9f90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e9f90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0063.323] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828e7880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e9f90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e9f90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0063.323] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828e7880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e9f90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e9f90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.323] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828e9f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e9f90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7bfbc00, ftLastWriteTime.dwHighDateTime=0x1d297b0, nFileSizeHigh=0x0, nFileSizeLow=0x2dfa, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0063.323] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0063.323] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0063.324] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2dfa [0063.324] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0063.324] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0063.433] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2dfa, lpNumberOfBytesRead=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18df70*=0x2dfa, lpOverlapped=0x0) returned 1 [0063.435] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2e00, lpNumberOfBytesWritten=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18df70*=0x2e00, lpOverlapped=0x0) returned 1 [0063.436] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0063.456] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0063.466] CloseHandle (hObject=0x100) returned 1 [0063.466] CloseHandle (hObject=0xf8) returned 1 [0063.467] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json.dvodltmf")) returned 0 [0063.468] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json.dvodltmf")) returned 0x2020 [0063.468] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json", lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828e9f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e9f90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7bfbc00, ftLastWriteTime.dwHighDateTime=0x1d297b0, nFileSizeHigh=0x0, nFileSizeLow=0x2dfa, dwReserved0=0x2dee78, dwReserved1=0x18dfe4, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0x2e84d8 [0063.468] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828e9f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e9f90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7bfbc00, ftLastWriteTime.dwHighDateTime=0x1d297b0, nFileSizeHigh=0x0, nFileSizeLow=0x2dfa, dwReserved0=0x2dee78, dwReserved1=0x18dfe4, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0063.468] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0063.468] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json")) returned 1 [0063.469] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json")) returned 0xffffffff [0063.469] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828e9f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e9f90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7bfbc00, ftLastWriteTime.dwHighDateTime=0x1d297b0, nFileSizeHigh=0x0, nFileSizeLow=0x2dfa, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0063.469] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0063.469] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828e7880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e9f90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e9f90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0063.469] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0063.469] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82651e90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e7880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e7880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69726373, dwReserved1=0x6a2e7470, cFileName="1.0.0.2_0", cAlternateFileName="100~1.2_0")) returned 0 [0063.470] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0063.470] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x814d6d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e6b4, cFileName="pjkljhegncpnkpknbcohdijeoejaedia", cAlternateFileName="PJKLJH~1")) returned 1 [0063.470] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x814d6d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64736e6f, dwReserved1=0x6a736a2e, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0063.470] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x814d6d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64736e6f, dwReserved1=0x6a736a2e, cFileName="..", cAlternateFileName="")) returned 1 [0063.470] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64736e6f, dwReserved1=0x6a736a2e, cFileName="8.1_0", cAlternateFileName="")) returned 1 [0063.470] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0063.472] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="..", cAlternateFileName="")) returned 1 [0063.472] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x180f, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="128.png", cAlternateFileName="")) returned 1 [0063.473] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0063.473] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0063.474] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x180f [0063.474] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0063.474] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0063.573] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x180f, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0x180f, lpOverlapped=0x0) returned 1 [0063.576] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1810, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0x1810, lpOverlapped=0x0) returned 1 [0063.577] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0063.635] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0063.644] CloseHandle (hObject=0xf4) returned 1 [0063.644] CloseHandle (hObject=0xf8) returned 1 [0063.645] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.dvodltmf")) returned 0 [0063.646] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.dvodltmf")) returned 0x2020 [0063.646] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x180f, dwReserved0=0x2dee40, dwReserved1=0x18e24c, cFileName="128.png", cAlternateFileName="")) returned 0x2e8498 [0063.646] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x180f, dwReserved0=0x2dee40, dwReserved1=0x18e24c, cFileName="128.png", cAlternateFileName="")) returned 0 [0063.646] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0063.646] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png")) returned 1 [0063.647] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png")) returned 0xffffffff [0063.647] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x869b0fb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x310, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0063.647] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0063.647] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0063.648] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x310 [0063.648] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0063.648] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0063.761] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x310, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0x310, lpOverlapped=0x0) returned 1 [0063.813] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0x320, lpOverlapped=0x0) returned 1 [0063.814] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0063.833] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0063.842] CloseHandle (hObject=0xf8) returned 1 [0063.843] CloseHandle (hObject=0xf4) returned 1 [0063.844] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json.dvodltmf")) returned 0 [0063.857] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json.dvodltmf")) returned 0x2020 [0063.857] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x869b0fb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x310, dwReserved0=0x2dee50, dwReserved1=0x18e24c, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 0x2e8498 [0063.857] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x869b0fb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x310, dwReserved0=0x2dee50, dwReserved1=0x18e24c, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 0 [0063.857] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0063.857] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json")) returned 1 [0063.858] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json")) returned 0xffffffff [0063.858] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="_locales", cAlternateFileName="")) returned 1 [0063.858] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0063.861] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.861] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0063.861] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0065, dwReserved1=0x6a0065, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0063.862] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0065, dwReserved1=0x6a0065, cFileName="..", cAlternateFileName="")) returned 1 [0063.862] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x138, dwReserved0=0x6f0065, dwReserved1=0x6a0065, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0063.862] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0063.863] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0063.863] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x138 [0063.863] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0063.863] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0063.948] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x138, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x138, lpOverlapped=0x0) returned 1 [0063.950] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x140, lpOverlapped=0x0) returned 1 [0063.950] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0063.979] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0063.989] CloseHandle (hObject=0x100) returned 1 [0063.989] CloseHandle (hObject=0xfc) returned 1 [0063.990] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json.dvodltmf")) returned 0 [0063.991] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json.dvodltmf")) returned 0x2020 [0063.991] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x138, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0063.991] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x138, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0063.991] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0063.991] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json")) returned 1 [0063.992] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json")) returned 0xffffffff [0063.992] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x138, dwReserved0=0x6f0065, dwReserved1=0x6a0065, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0063.992] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0063.994] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0063.994] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0063.994] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0063.994] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0063.994] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0063.994] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0063.995] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x124 [0063.995] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0063.995] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0064.079] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x124, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x124, lpOverlapped=0x0) returned 1 [0064.080] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x130, lpOverlapped=0x0) returned 1 [0064.081] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0064.100] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0064.110] CloseHandle (hObject=0xfc) returned 1 [0064.110] CloseHandle (hObject=0x100) returned 1 [0064.111] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json.dvodltmf")) returned 0 [0064.112] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json.dvodltmf")) returned 0x2020 [0064.112] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0064.112] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0064.112] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0064.112] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json")) returned 1 [0064.113] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json")) returned 0xffffffff [0064.113] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0064.113] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0064.113] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0064.113] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0064.114] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0064.114] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0064.114] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0064.115] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0064.115] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfe [0064.115] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0064.116] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0064.199] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xfe, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xfe, lpOverlapped=0x0) returned 1 [0064.200] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x100, lpOverlapped=0x0) returned 1 [0064.201] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0064.221] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0064.230] CloseHandle (hObject=0x100) returned 1 [0064.230] CloseHandle (hObject=0xfc) returned 1 [0064.231] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json.dvodltmf")) returned 0 [0064.232] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json.dvodltmf")) returned 0x2020 [0064.232] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0064.232] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0064.232] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0064.232] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json")) returned 1 [0064.233] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json")) returned 0xffffffff [0064.233] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0064.233] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0064.233] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0064.233] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0064.234] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0064.234] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0064.234] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0064.235] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0064.235] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf9 [0064.235] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0064.236] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0064.318] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xf9, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xf9, lpOverlapped=0x0) returned 1 [0064.319] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x100, lpOverlapped=0x0) returned 1 [0064.320] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0064.339] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0064.357] CloseHandle (hObject=0xfc) returned 1 [0064.357] CloseHandle (hObject=0x100) returned 1 [0064.358] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json.dvodltmf")) returned 0 [0064.359] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json.dvodltmf")) returned 0x2020 [0064.359] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0064.359] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0064.359] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0064.359] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json")) returned 1 [0064.360] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json")) returned 0xffffffff [0064.360] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0064.360] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0064.360] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0064.360] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0064.361] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0064.361] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0064.361] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0064.362] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0064.362] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xec [0064.362] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0064.363] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0064.448] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xec, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xec, lpOverlapped=0x0) returned 1 [0064.449] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0064.450] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0064.469] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0064.479] CloseHandle (hObject=0x100) returned 1 [0064.479] CloseHandle (hObject=0xfc) returned 1 [0064.480] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json.dvodltmf")) returned 0 [0064.480] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json.dvodltmf")) returned 0x2020 [0064.480] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0064.481] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0064.481] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0064.481] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json")) returned 1 [0064.482] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json")) returned 0xffffffff [0064.482] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0064.482] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0064.482] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0064.482] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0064.483] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0064.483] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xef, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0064.483] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0064.483] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0064.483] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xef [0064.483] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0064.484] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0064.567] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xef, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xef, lpOverlapped=0x0) returned 1 [0064.568] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0064.569] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0064.588] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0064.597] CloseHandle (hObject=0xfc) returned 1 [0064.598] CloseHandle (hObject=0x100) returned 1 [0064.599] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json.dvodltmf")) returned 0 [0064.599] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json.dvodltmf")) returned 0x2020 [0064.599] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xef, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0064.599] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xef, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0064.599] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0064.600] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json")) returned 1 [0064.600] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json")) returned 0xffffffff [0064.600] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xef, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0064.601] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0064.601] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0064.601] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0064.602] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0064.602] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0064.602] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0064.603] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0064.603] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14c [0064.603] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0064.604] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0064.689] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x14c, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x14c, lpOverlapped=0x0) returned 1 [0064.690] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x150, lpOverlapped=0x0) returned 1 [0064.691] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0064.711] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0064.720] CloseHandle (hObject=0x100) returned 1 [0064.721] CloseHandle (hObject=0xfc) returned 1 [0064.722] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json.dvodltmf")) returned 0 [0064.722] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json.dvodltmf")) returned 0x2020 [0064.722] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0064.722] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0064.722] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0064.722] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json")) returned 1 [0064.723] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json")) returned 0xffffffff [0064.723] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0064.723] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0064.724] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1 [0064.724] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0064.724] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0064.724] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0064.724] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0064.724] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0064.724] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd7 [0064.724] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0064.725] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0064.820] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd7, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd7, lpOverlapped=0x0) returned 1 [0064.821] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0064.822] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0064.842] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0064.855] CloseHandle (hObject=0xfc) returned 1 [0064.856] CloseHandle (hObject=0x100) returned 1 [0064.857] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json.dvodltmf")) returned 0 [0064.857] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json.dvodltmf")) returned 0x2020 [0064.857] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0064.857] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0064.857] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0064.857] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json")) returned 1 [0064.858] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json")) returned 0xffffffff [0064.858] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0064.858] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0064.859] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0064.859] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0064.859] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0064.859] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10d, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0064.859] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0064.860] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0064.860] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10d [0064.860] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0064.861] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0064.945] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x10d, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x10d, lpOverlapped=0x0) returned 1 [0064.946] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0064.947] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0064.966] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0064.976] CloseHandle (hObject=0x100) returned 1 [0064.977] CloseHandle (hObject=0xfc) returned 1 [0064.978] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json.dvodltmf")) returned 0 [0064.979] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json.dvodltmf")) returned 0x2020 [0064.979] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10d, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0064.979] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10d, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0064.979] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0064.979] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json")) returned 1 [0064.980] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json")) returned 0xffffffff [0064.980] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10d, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0064.980] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0064.980] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0064.980] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0064.989] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0064.989] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0064.989] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0064.990] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0064.990] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x100 [0064.990] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0064.991] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0065.074] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x100, lpOverlapped=0x0) returned 1 [0065.075] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0065.076] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0065.097] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0065.106] CloseHandle (hObject=0xfc) returned 1 [0065.107] CloseHandle (hObject=0x100) returned 1 [0065.108] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json.dvodltmf")) returned 0 [0065.108] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json.dvodltmf")) returned 0x2020 [0065.108] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0065.109] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0065.109] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0065.109] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json")) returned 1 [0065.110] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json")) returned 0xffffffff [0065.110] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0065.110] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0065.110] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0065.110] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0065.111] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0065.111] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0065.111] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0065.112] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0065.112] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xea [0065.112] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0065.112] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0065.197] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xea, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xea, lpOverlapped=0x0) returned 1 [0065.198] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0065.199] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0065.219] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0065.228] CloseHandle (hObject=0x100) returned 1 [0065.228] CloseHandle (hObject=0xfc) returned 1 [0065.230] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json.dvodltmf")) returned 0 [0065.230] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json.dvodltmf")) returned 0x2020 [0065.230] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0065.230] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0065.230] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0065.230] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json")) returned 1 [0065.231] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json")) returned 0xffffffff [0065.231] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0065.231] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0065.232] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0065.232] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0065.232] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0065.232] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0065.232] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0065.232] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0065.232] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10c [0065.233] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0065.233] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0065.316] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x10c, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x10c, lpOverlapped=0x0) returned 1 [0065.318] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0065.318] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0065.338] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0065.352] CloseHandle (hObject=0xfc) returned 1 [0065.352] CloseHandle (hObject=0x100) returned 1 [0065.355] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json.dvodltmf")) returned 0 [0065.355] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json.dvodltmf")) returned 0x2020 [0065.355] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0065.355] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0065.355] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0065.355] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json")) returned 1 [0065.356] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json")) returned 0xffffffff [0065.356] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0065.356] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0065.357] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0065.357] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0065.357] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0065.357] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0065.357] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0065.357] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0065.357] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x121 [0065.357] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0065.358] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0065.447] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x121, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x121, lpOverlapped=0x0) returned 1 [0065.448] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x130, lpOverlapped=0x0) returned 1 [0065.449] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0065.468] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0065.478] CloseHandle (hObject=0x100) returned 1 [0065.478] CloseHandle (hObject=0xfc) returned 1 [0065.479] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json.dvodltmf")) returned 0 [0065.480] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json.dvodltmf")) returned 0x2020 [0065.480] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0065.480] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0065.480] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0065.480] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json")) returned 1 [0065.481] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json")) returned 0xffffffff [0065.481] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0065.481] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0065.481] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0065.481] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0065.481] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0065.482] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0065.482] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0065.482] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0065.482] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe6 [0065.482] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0065.483] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0065.566] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe6, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xe6, lpOverlapped=0x0) returned 1 [0065.567] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0065.568] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0065.588] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0065.597] CloseHandle (hObject=0xfc) returned 1 [0065.598] CloseHandle (hObject=0x100) returned 1 [0065.599] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json.dvodltmf")) returned 0 [0065.599] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json.dvodltmf")) returned 0x2020 [0065.599] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0065.599] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0065.599] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0065.599] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json")) returned 1 [0065.600] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json")) returned 0xffffffff [0065.600] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0065.600] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0065.600] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0065.601] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0065.601] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0065.601] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0065.601] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0065.601] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0065.601] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe2 [0065.601] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0065.602] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0065.687] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xe2, lpOverlapped=0x0) returned 1 [0065.688] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0065.689] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0065.708] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0065.718] CloseHandle (hObject=0x100) returned 1 [0065.718] CloseHandle (hObject=0xfc) returned 1 [0065.719] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json.dvodltmf")) returned 0 [0065.719] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json.dvodltmf")) returned 0x2020 [0065.720] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0065.720] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0065.720] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0065.720] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json")) returned 1 [0065.721] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json")) returned 0xffffffff [0065.721] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0065.721] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0065.721] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0065.721] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0065.721] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0065.721] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0065.721] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0065.722] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0065.722] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf2 [0065.722] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0065.722] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0065.821] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xf2, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xf2, lpOverlapped=0x0) returned 1 [0065.822] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x100, lpOverlapped=0x0) returned 1 [0065.823] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0065.843] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0065.852] CloseHandle (hObject=0xfc) returned 1 [0065.852] CloseHandle (hObject=0x100) returned 1 [0065.857] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json.dvodltmf")) returned 0 [0065.858] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json.dvodltmf")) returned 0x2020 [0065.858] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0065.858] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0065.858] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0065.858] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json")) returned 1 [0065.859] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json")) returned 0xffffffff [0065.859] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0065.859] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0065.859] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0065.859] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0065.859] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0065.859] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0065.859] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0065.860] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0065.861] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x100 [0065.861] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0065.861] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0065.947] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x100, lpOverlapped=0x0) returned 1 [0065.948] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0065.949] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0065.969] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0065.978] CloseHandle (hObject=0x100) returned 1 [0065.978] CloseHandle (hObject=0xfc) returned 1 [0065.979] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json.dvodltmf")) returned 0 [0065.980] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json.dvodltmf")) returned 0x2020 [0065.980] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0065.980] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0065.980] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0065.980] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json")) returned 1 [0065.981] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json")) returned 0xffffffff [0065.981] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0065.981] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0065.981] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0065.981] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0065.982] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0065.982] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0065.982] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0065.982] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0065.983] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10f [0065.983] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0065.983] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0066.076] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x10f, lpOverlapped=0x0) returned 1 [0066.077] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0066.078] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0066.098] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.107] CloseHandle (hObject=0xfc) returned 1 [0066.108] CloseHandle (hObject=0x100) returned 1 [0066.109] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json.dvodltmf")) returned 0 [0066.109] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json.dvodltmf")) returned 0x2020 [0066.109] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0066.109] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0066.109] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0066.109] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json")) returned 1 [0066.110] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json")) returned 0xffffffff [0066.110] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0066.110] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0066.111] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0066.111] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0066.111] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0066.111] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0066.111] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0066.111] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0066.111] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x100 [0066.111] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0066.112] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0066.196] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x100, lpOverlapped=0x0) returned 1 [0066.197] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0066.198] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0066.217] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.227] CloseHandle (hObject=0x100) returned 1 [0066.227] CloseHandle (hObject=0xfc) returned 1 [0066.228] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json.dvodltmf")) returned 0 [0066.228] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json.dvodltmf")) returned 0x2020 [0066.228] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0066.229] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0066.229] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0066.229] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json")) returned 1 [0066.230] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json")) returned 0xffffffff [0066.230] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0066.230] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0066.230] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0066.230] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0066.230] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0066.230] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0066.230] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0066.231] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0066.231] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfd [0066.231] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0066.232] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0066.315] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xfd, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xfd, lpOverlapped=0x0) returned 1 [0066.315] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x100, lpOverlapped=0x0) returned 1 [0066.316] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0066.336] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.349] CloseHandle (hObject=0xfc) returned 1 [0066.350] CloseHandle (hObject=0x100) returned 1 [0066.350] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json.dvodltmf")) returned 0 [0066.351] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json.dvodltmf")) returned 0x2020 [0066.351] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0066.351] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0066.351] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0066.351] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json")) returned 1 [0066.352] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json")) returned 0xffffffff [0066.352] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0066.352] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0066.352] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0066.352] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0066.353] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0066.353] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0066.353] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0066.353] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0066.353] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xee [0066.353] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0066.353] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0066.443] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xee, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xee, lpOverlapped=0x0) returned 1 [0066.444] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0066.445] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0066.464] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.474] CloseHandle (hObject=0x100) returned 1 [0066.474] CloseHandle (hObject=0xfc) returned 1 [0066.475] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json.dvodltmf")) returned 0 [0066.475] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json.dvodltmf")) returned 0x2020 [0066.475] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0066.476] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0066.476] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0066.476] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json")) returned 1 [0066.477] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json")) returned 0xffffffff [0066.477] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0066.477] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0066.477] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0066.477] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0066.477] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0066.477] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0066.477] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0066.477] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0066.478] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe8 [0066.478] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0066.478] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0066.562] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xe8, lpOverlapped=0x0) returned 1 [0066.563] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0066.564] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0066.583] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.593] CloseHandle (hObject=0xfc) returned 1 [0066.593] CloseHandle (hObject=0x100) returned 1 [0066.594] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json.dvodltmf")) returned 0 [0066.594] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json.dvodltmf")) returned 0x2020 [0066.594] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0066.594] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0066.594] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0066.595] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json")) returned 1 [0066.595] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json")) returned 0xffffffff [0066.596] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0066.596] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0066.596] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0066.596] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0066.596] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0066.596] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0066.596] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0066.596] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0066.597] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd2 [0066.597] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0066.597] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0066.683] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd2, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd2, lpOverlapped=0x0) returned 1 [0066.684] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0066.685] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0066.704] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.714] CloseHandle (hObject=0x100) returned 1 [0066.714] CloseHandle (hObject=0xfc) returned 1 [0066.715] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json.dvodltmf")) returned 0 [0066.716] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json.dvodltmf")) returned 0x2020 [0066.716] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0066.716] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0066.716] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0066.716] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json")) returned 1 [0066.717] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json")) returned 0xffffffff [0066.717] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0066.717] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0066.717] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0066.717] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0066.718] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0066.718] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0066.718] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0066.718] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0066.718] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x108 [0066.718] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0066.719] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0066.804] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x108, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x108, lpOverlapped=0x0) returned 1 [0066.806] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0066.807] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0066.829] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.839] CloseHandle (hObject=0xfc) returned 1 [0066.840] CloseHandle (hObject=0x100) returned 1 [0066.841] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json.dvodltmf")) returned 0 [0066.841] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json.dvodltmf")) returned 0x2020 [0066.841] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0066.842] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0066.842] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0066.842] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json")) returned 1 [0066.843] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json")) returned 0xffffffff [0066.843] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0066.843] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0066.843] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0066.843] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0066.844] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0066.844] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0066.844] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0066.844] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0066.844] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0066.844] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0066.845] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0066.929] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xde, lpOverlapped=0x0) returned 1 [0066.930] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0066.931] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0066.951] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.960] CloseHandle (hObject=0x100) returned 1 [0066.961] CloseHandle (hObject=0xfc) returned 1 [0066.962] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json.dvodltmf")) returned 0 [0066.962] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json.dvodltmf")) returned 0x2020 [0066.962] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0066.962] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0066.962] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0066.963] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json")) returned 1 [0066.963] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json")) returned 0xffffffff [0066.963] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0066.964] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0066.964] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0066.964] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0066.964] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0066.964] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0066.964] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0066.964] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0066.965] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdf [0066.965] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0066.965] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0067.050] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xdf, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xdf, lpOverlapped=0x0) returned 1 [0067.050] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0067.051] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0067.083] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.093] CloseHandle (hObject=0xfc) returned 1 [0067.094] CloseHandle (hObject=0x100) returned 1 [0067.095] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json.dvodltmf")) returned 0 [0067.096] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json.dvodltmf")) returned 0x2020 [0067.096] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0067.097] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0067.097] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0067.097] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json")) returned 1 [0067.098] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json")) returned 0xffffffff [0067.098] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0067.098] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0067.098] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0067.098] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0067.099] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0067.099] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0067.099] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0067.099] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0067.100] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x109 [0067.100] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0067.100] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0067.184] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x109, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x109, lpOverlapped=0x0) returned 1 [0067.185] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0067.186] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0067.205] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.215] CloseHandle (hObject=0x100) returned 1 [0067.215] CloseHandle (hObject=0xfc) returned 1 [0067.216] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json.dvodltmf")) returned 0 [0067.217] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json.dvodltmf")) returned 0x2020 [0067.217] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0067.217] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0067.217] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0067.217] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json")) returned 1 [0067.218] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json")) returned 0xffffffff [0067.218] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0067.218] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0067.218] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0067.218] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0067.218] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0067.218] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0067.218] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0067.219] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0067.219] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11e [0067.219] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0067.219] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0067.302] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x11e, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x11e, lpOverlapped=0x0) returned 1 [0067.303] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x120, lpOverlapped=0x0) returned 1 [0067.304] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0067.324] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.333] CloseHandle (hObject=0xfc) returned 1 [0067.333] CloseHandle (hObject=0x100) returned 1 [0067.334] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json.dvodltmf")) returned 0 [0067.335] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json.dvodltmf")) returned 0x2020 [0067.335] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0067.335] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0067.335] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0067.335] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json")) returned 1 [0067.336] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json")) returned 0xffffffff [0067.336] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0067.336] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0067.336] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="se", cAlternateFileName="")) returned 1 [0067.336] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0067.336] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0067.337] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0067.337] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0067.337] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0067.337] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd2 [0067.337] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0067.337] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0067.430] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd2, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xd2, lpOverlapped=0x0) returned 1 [0067.431] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0067.432] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0067.452] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.461] CloseHandle (hObject=0x100) returned 1 [0067.462] CloseHandle (hObject=0xfc) returned 1 [0067.480] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json.dvodltmf")) returned 0 [0067.481] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json.dvodltmf")) returned 0x2020 [0067.482] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0067.482] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0067.482] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0067.482] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json")) returned 1 [0067.483] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json")) returned 0xffffffff [0067.483] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0067.483] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0067.483] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0067.483] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0067.484] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0067.484] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0067.484] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0067.484] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0067.485] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0067.485] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0067.485] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0067.573] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xde, lpOverlapped=0x0) returned 1 [0067.574] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xe0, lpOverlapped=0x0) returned 1 [0067.575] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0067.595] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.604] CloseHandle (hObject=0xfc) returned 1 [0067.605] CloseHandle (hObject=0x100) returned 1 [0067.606] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json.dvodltmf")) returned 0 [0067.606] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json.dvodltmf")) returned 0x2020 [0067.606] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0067.606] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0067.607] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0067.607] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json")) returned 1 [0067.608] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json")) returned 0xffffffff [0067.608] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0067.608] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0067.608] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0067.608] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0067.608] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0067.608] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0067.608] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0067.608] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0067.609] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xea [0067.609] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0067.609] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0067.696] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xea, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xea, lpOverlapped=0x0) returned 1 [0067.697] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0067.698] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0067.718] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.728] CloseHandle (hObject=0x100) returned 1 [0067.728] CloseHandle (hObject=0xfc) returned 1 [0067.729] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json.dvodltmf")) returned 0 [0067.730] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json.dvodltmf")) returned 0x2020 [0067.730] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0067.730] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0067.730] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0067.730] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json")) returned 1 [0067.731] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json")) returned 0xffffffff [0067.731] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0067.731] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0067.731] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0067.731] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0067.732] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0067.732] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x127, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0067.732] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0067.732] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0067.732] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x127 [0067.732] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0067.732] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0067.840] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x127, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x127, lpOverlapped=0x0) returned 1 [0067.841] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x130, lpOverlapped=0x0) returned 1 [0067.842] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0067.866] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.880] CloseHandle (hObject=0xfc) returned 1 [0067.881] CloseHandle (hObject=0x100) returned 1 [0067.882] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json.dvodltmf")) returned 0 [0067.882] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json.dvodltmf")) returned 0x2020 [0067.882] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x127, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0067.883] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x127, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0067.883] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0067.883] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json")) returned 1 [0067.884] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json")) returned 0xffffffff [0067.884] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x127, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0067.884] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0067.884] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0067.884] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0067.884] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0067.884] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x144, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0067.885] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0067.885] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0067.885] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x144 [0067.885] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0067.886] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0067.980] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x144, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x144, lpOverlapped=0x0) returned 1 [0067.982] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x150, lpOverlapped=0x0) returned 1 [0067.982] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0068.002] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.012] CloseHandle (hObject=0x100) returned 1 [0068.012] CloseHandle (hObject=0xfc) returned 1 [0068.013] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json.dvodltmf")) returned 0 [0068.014] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json.dvodltmf")) returned 0x2020 [0068.014] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x144, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0068.014] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x144, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0068.014] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0068.014] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json")) returned 1 [0068.015] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json")) returned 0xffffffff [0068.015] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x144, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0068.015] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0068.015] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0068.015] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0068.016] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0068.016] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0068.016] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0068.016] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0068.017] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xea [0068.017] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0068.017] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0068.112] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xea, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xea, lpOverlapped=0x0) returned 1 [0068.113] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0068.114] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0068.134] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.143] CloseHandle (hObject=0xfc) returned 1 [0068.143] CloseHandle (hObject=0x100) returned 1 [0068.144] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json.dvodltmf")) returned 0 [0068.145] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json.dvodltmf")) returned 0x2020 [0068.145] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0068.145] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0068.145] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0068.145] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json")) returned 1 [0068.146] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json")) returned 0xffffffff [0068.146] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0068.146] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0068.146] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0068.146] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0068.147] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0068.147] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0068.147] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0068.147] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0068.147] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x130 [0068.147] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0068.148] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0068.234] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x130, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x130, lpOverlapped=0x0) returned 1 [0068.235] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x140, lpOverlapped=0x0) returned 1 [0068.236] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0068.256] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.265] CloseHandle (hObject=0x100) returned 1 [0068.266] CloseHandle (hObject=0xfc) returned 1 [0068.267] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json.dvodltmf")) returned 0 [0068.267] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json.dvodltmf")) returned 0x2020 [0068.267] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0068.267] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0068.267] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0068.268] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json")) returned 1 [0068.268] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json")) returned 0xffffffff [0068.268] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0068.269] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0068.269] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0068.269] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0068.269] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0068.269] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0068.269] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0068.269] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0068.269] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe8 [0068.270] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0068.270] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0068.402] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xe8, lpOverlapped=0x0) returned 1 [0068.403] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0xf0, lpOverlapped=0x0) returned 1 [0068.404] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0068.423] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.495] CloseHandle (hObject=0xfc) returned 1 [0068.495] CloseHandle (hObject=0x100) returned 1 [0068.496] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json.dvodltmf")) returned 0 [0068.497] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json.dvodltmf")) returned 0x2020 [0068.497] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0068.497] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0068.497] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0068.497] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json")) returned 1 [0068.498] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json")) returned 0xffffffff [0068.498] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0068.498] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0068.498] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0068.498] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0068.499] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0068.499] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0068.499] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0068.499] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0068.499] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x102 [0068.499] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0068.500] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0068.693] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x102, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x102, lpOverlapped=0x0) returned 1 [0068.695] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x110, lpOverlapped=0x0) returned 1 [0068.696] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0068.715] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.725] CloseHandle (hObject=0x100) returned 1 [0068.725] CloseHandle (hObject=0xfc) returned 1 [0068.726] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json.dvodltmf")) returned 0 [0068.726] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json.dvodltmf")) returned 0x2020 [0068.727] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0068.727] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0068.727] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0068.727] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json")) returned 1 [0068.746] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json")) returned 0xffffffff [0068.747] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0068.747] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0068.747] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0068.747] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0068.747] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0068.747] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0068.747] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0068.747] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0068.748] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf9 [0068.748] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0068.748] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0069.039] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xf9, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0xf9, lpOverlapped=0x0) returned 1 [0069.049] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x100, lpOverlapped=0x0) returned 1 [0069.050] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0069.069] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.079] CloseHandle (hObject=0xfc) returned 1 [0069.079] CloseHandle (hObject=0x100) returned 1 [0069.080] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json.dvodltmf")) returned 0 [0069.081] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json.dvodltmf")) returned 0x2020 [0069.081] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0069.081] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x2dee68, dwReserved1=0x18dd7c, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0069.081] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0069.081] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json")) returned 1 [0069.082] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json")) returned 0xffffffff [0069.082] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0069.082] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0069.082] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0069.082] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0069.082] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ae0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ae0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0069.082] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ae0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ae0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0069.083] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ae0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ae0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.083] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ae0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86adfb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xdd12c400, ftLastWriteTime.dwHighDateTime=0x1d0683e, nFileSizeHigh=0x0, nFileSizeLow=0x2686, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0069.083] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0069.083] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0069.083] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2686 [0069.083] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0069.084] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0069.190] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2686, lpNumberOfBytesRead=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18df70*=0x2686, lpOverlapped=0x0) returned 1 [0069.192] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2690, lpNumberOfBytesWritten=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18df70*=0x2690, lpOverlapped=0x0) returned 1 [0069.193] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0069.213] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.223] CloseHandle (hObject=0xf8) returned 1 [0069.223] CloseHandle (hObject=0x100) returned 1 [0069.224] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json.dvodltmf")) returned 0 [0069.224] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json.dvodltmf")) returned 0x2020 [0069.224] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json", lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ae0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86adfb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xdd12c400, ftLastWriteTime.dwHighDateTime=0x1d0683e, nFileSizeHigh=0x0, nFileSizeLow=0x2686, dwReserved0=0x2dee70, dwReserved1=0x18dfe4, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0x2e84d8 [0069.225] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ae0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86adfb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xdd12c400, ftLastWriteTime.dwHighDateTime=0x1d0683e, nFileSizeHigh=0x0, nFileSizeLow=0x2686, dwReserved0=0x2dee70, dwReserved1=0x18dfe4, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0069.225] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0069.225] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json")) returned 1 [0069.226] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json")) returned 0xffffffff [0069.226] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ae0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86adfb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xdd12c400, ftLastWriteTime.dwHighDateTime=0x1d0683e, nFileSizeHigh=0x0, nFileSizeLow=0x2686, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0069.226] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0069.226] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ae0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ae0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0069.226] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0069.226] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64736e6f, dwReserved1=0x6a736a2e, cFileName="8.1_0", cAlternateFileName="")) returned 0 [0069.227] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0069.227] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8399f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839a6a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839a6a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e6b4, cFileName="pkedcjkdefgpdelpbcmbmeomcjbeemfm", cAlternateFileName="PKEDCJ~1")) returned 1 [0069.227] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8399f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839a6a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839a6a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64736e6f, dwReserved1=0x6a736a2e, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0069.228] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8399f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839a6a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839a6a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64736e6f, dwReserved1=0x6a736a2e, cFileName="..", cAlternateFileName="")) returned 1 [0069.229] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836e0310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64736e6f, dwReserved1=0x6a736a2e, cFileName="5817.313.0.5_0", cAlternateFileName="581731~1.5_0")) returned 1 [0069.229] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836e0310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0069.230] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836e0310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="..", cAlternateFileName="")) returned 1 [0069.231] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83637bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8363f0f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x8c0bf, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="angular.js", cAlternateFileName="")) returned 1 [0069.231] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0069.232] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0069.232] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8c0bf [0069.232] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0069.233] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0069.319] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x8c0bf, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0x8c0bf, lpOverlapped=0x0) returned 1 [0069.330] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x8c0c0, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0x8c0c0, lpOverlapped=0x0) returned 1 [0069.362] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0069.382] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.391] CloseHandle (hObject=0xf4) returned 1 [0069.392] CloseHandle (hObject=0x100) returned 1 [0069.398] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.dvodltmf")) returned 0 [0069.399] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.dvodltmf")) returned 0x2020 [0069.399] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83637bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8363f0f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x8c0bf, dwReserved0=0x2dee58, dwReserved1=0x18e24c, cFileName="angular.js", cAlternateFileName="")) returned 0x2e8498 [0069.399] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83637bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8363f0f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x8c0bf, dwReserved0=0x2dee58, dwReserved1=0x18e24c, cFileName="angular.js", cAlternateFileName="")) returned 0 [0069.399] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0069.399] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js")) returned 1 [0069.405] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js")) returned 0xffffffff [0069.405] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83641800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83643f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xa89c, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="background_script.js", cAlternateFileName="BACKGR~1.JS")) returned 1 [0069.405] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0069.406] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0069.406] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa89c [0069.406] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0069.407] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0069.528] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa89c, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0xa89c, lpOverlapped=0x0) returned 1 [0069.607] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa8a0, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0xa8a0, lpOverlapped=0x0) returned 1 [0069.608] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0069.629] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.639] CloseHandle (hObject=0x100) returned 1 [0069.639] CloseHandle (hObject=0xf4) returned 1 [0069.640] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.dvodltmf")) returned 0 [0069.641] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.dvodltmf")) returned 0x2020 [0069.641] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83641800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83643f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xa89c, dwReserved0=0x2dee70, dwReserved1=0x18e24c, cFileName="background_script.js", cAlternateFileName="BACKGR~1.JS")) returned 0x2e8498 [0069.641] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83641800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83643f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xa89c, dwReserved0=0x2dee70, dwReserved1=0x18e24c, cFileName="background_script.js", cAlternateFileName="BACKGR~1.JS")) returned 0 [0069.641] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0069.641] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js")) returned 1 [0069.643] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js")) returned 0xffffffff [0069.643] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83646620, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83648d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x181aa, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="cast_game_sender.js", cAlternateFileName="CAST_G~1.JS")) returned 1 [0069.643] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0069.643] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0069.643] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x181aa [0069.643] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0069.644] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0069.764] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x181aa, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0x181aa, lpOverlapped=0x0) returned 1 [0069.836] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x181b0, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0x181b0, lpOverlapped=0x0) returned 1 [0069.839] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0069.859] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.868] CloseHandle (hObject=0xf4) returned 1 [0069.868] CloseHandle (hObject=0x100) returned 1 [0069.906] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.dvodltmf")) returned 0 [0069.907] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.dvodltmf")) returned 0x2020 [0069.907] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83646620, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83648d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x181aa, dwReserved0=0x2dee68, dwReserved1=0x18e24c, cFileName="cast_game_sender.js", cAlternateFileName="CAST_G~1.JS")) returned 0x2e8498 [0069.907] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83646620, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83648d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x181aa, dwReserved0=0x2dee68, dwReserved1=0x18e24c, cFileName="cast_game_sender.js", cAlternateFileName="CAST_G~1.JS")) returned 0 [0069.907] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0069.907] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js")) returned 1 [0069.909] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js")) returned 0xffffffff [0069.909] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8364db50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8364db50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x111e1, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="cast_route_details.html", cAlternateFileName="CAST_R~1.HTM")) returned 1 [0069.909] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0069.909] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0069.909] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x111e1 [0069.909] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0069.910] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0070.005] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x111e1, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0x111e1, lpOverlapped=0x0) returned 1 [0070.012] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x111f0, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0x111f0, lpOverlapped=0x0) returned 1 [0070.014] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0070.033] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0070.046] CloseHandle (hObject=0x100) returned 1 [0070.046] CloseHandle (hObject=0xf4) returned 1 [0070.048] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.dvodltmf")) returned 0 [0070.048] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.dvodltmf")) returned 0x2020 [0070.048] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8364db50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8364db50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x111e1, dwReserved0=0x2dee70, dwReserved1=0x18e24c, cFileName="cast_route_details.html", cAlternateFileName="CAST_R~1.HTM")) returned 0x2e8498 [0070.048] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8364db50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8364db50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x111e1, dwReserved0=0x2dee70, dwReserved1=0x18e24c, cFileName="cast_route_details.html", cAlternateFileName="CAST_R~1.HTM")) returned 0 [0070.048] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0070.048] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html")) returned 1 [0070.050] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html")) returned 0xffffffff [0070.050] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83652970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83657790, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3a258, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="cast_route_details.js", cAlternateFileName="CAST_R~1.JS")) returned 1 [0070.050] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0070.050] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0070.050] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a258 [0070.050] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0070.051] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0070.135] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3a258, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0x3a258, lpOverlapped=0x0) returned 1 [0070.185] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3a260, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0x3a260, lpOverlapped=0x0) returned 1 [0070.190] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0070.209] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0070.219] CloseHandle (hObject=0xf4) returned 1 [0070.219] CloseHandle (hObject=0x100) returned 1 [0070.222] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.dvodltmf")) returned 0 [0070.222] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.dvodltmf")) returned 0x2020 [0070.222] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83652970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83657790, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3a258, dwReserved0=0x2dee70, dwReserved1=0x18e24c, cFileName="cast_route_details.js", cAlternateFileName="CAST_R~1.JS")) returned 0x2e8498 [0070.222] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83652970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83657790, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3a258, dwReserved0=0x2dee70, dwReserved1=0x18e24c, cFileName="cast_route_details.js", cAlternateFileName="CAST_R~1.JS")) returned 0 [0070.222] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0070.223] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js")) returned 1 [0070.225] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js")) returned 0xffffffff [0070.225] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8365ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836613d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xce17, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="cast_sender.js", cAlternateFileName="CAST_S~1.JS")) returned 1 [0070.225] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0070.239] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0070.239] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xce17 [0070.239] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0070.239] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0070.353] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xce17, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0xce17, lpOverlapped=0x0) returned 1 [0070.385] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xce20, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0xce20, lpOverlapped=0x0) returned 1 [0070.387] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0070.407] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0070.417] CloseHandle (hObject=0x100) returned 1 [0070.417] CloseHandle (hObject=0xf4) returned 1 [0070.418] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.dvodltmf")) returned 0 [0070.419] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.dvodltmf")) returned 0x2020 [0070.419] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8365ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836613d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xce17, dwReserved0=0x2dee60, dwReserved1=0x18e24c, cFileName="cast_sender.js", cAlternateFileName="CAST_S~1.JS")) returned 0x2e8498 [0070.419] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8365ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836613d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xce17, dwReserved0=0x2dee60, dwReserved1=0x18e24c, cFileName="cast_sender.js", cAlternateFileName="CAST_S~1.JS")) returned 0 [0070.420] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0070.420] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js")) returned 1 [0070.421] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js")) returned 0xffffffff [0070.422] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83663ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836884d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836884d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="cast_setup", cAlternateFileName="CAST_S~1")) returned 1 [0070.422] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83663ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836884d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836884d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0070.423] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83663ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836884d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836884d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.424] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836661f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836661f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x1a1d, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="cast_app.css", cAlternateFileName="")) returned 1 [0070.424] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0070.424] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0070.424] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a1d [0070.424] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0070.425] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0070.525] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1a1d, lpNumberOfBytesRead=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18df70*=0x1a1d, lpOverlapped=0x0) returned 1 [0070.527] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18df70*=0x1a20, lpOverlapped=0x0) returned 1 [0070.528] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0070.548] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0070.557] CloseHandle (hObject=0x100) returned 1 [0070.558] CloseHandle (hObject=0xf8) returned 1 [0070.559] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.dvodltmf")) returned 0 [0070.559] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.dvodltmf")) returned 0x2020 [0070.559] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css", lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836661f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836661f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x1a1d, dwReserved0=0x2dee70, dwReserved1=0x18dfe4, cFileName="cast_app.css", cAlternateFileName="")) returned 0x2e84d8 [0070.559] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836661f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836661f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x1a1d, dwReserved0=0x2dee70, dwReserved1=0x18dfe4, cFileName="cast_app.css", cAlternateFileName="")) returned 0 [0070.560] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0070.560] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css")) returned 1 [0070.561] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css")) returned 0xffffffff [0070.561] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8366b010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8366d720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x221da, dwReserved0=0x2ded10, dwReserved1=0x18df7c, cFileName="cast_app.js", cAlternateFileName="")) returned 1 [0070.561] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0070.561] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0070.561] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x221da [0070.561] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0070.562] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0070.655] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x221da, lpNumberOfBytesRead=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18df70*=0x221da, lpOverlapped=0x0) returned 1 [0070.659] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x221e0, lpNumberOfBytesWritten=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18df70*=0x221e0, lpOverlapped=0x0) returned 1 [0070.663] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0070.683] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0070.692] CloseHandle (hObject=0xf8) returned 1 [0070.693] CloseHandle (hObject=0x100) returned 1 [0070.696] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.dvodltmf")) returned 0 [0070.697] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.dvodltmf")) returned 0x2020 [0070.697] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js", lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8366b010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8366d720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x221da, dwReserved0=0x2dee70, dwReserved1=0x18dfe4, cFileName="cast_app.js", cAlternateFileName="")) returned 0x2e84d8 [0070.697] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8366b010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8366d720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x221da, dwReserved0=0x2dee70, dwReserved1=0x18dfe4, cFileName="cast_app.js", cAlternateFileName="")) returned 0 [0070.697] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0070.698] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js")) returned 1 [0070.699] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js")) returned 0xffffffff [0070.699] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8366fe30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8366fe30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x2ded10, dwReserved1=0x18df7c, cFileName="cast_app_redirect.js", cAlternateFileName="CAST_A~1.JS")) returned 1 [0070.699] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0070.701] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0070.701] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf2 [0070.701] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0070.701] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0070.800] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xf2, lpNumberOfBytesRead=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18df70*=0xf2, lpOverlapped=0x0) returned 1 [0070.801] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18df70*=0x100, lpOverlapped=0x0) returned 1 [0070.802] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0070.822] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0070.831] CloseHandle (hObject=0x100) returned 1 [0070.831] CloseHandle (hObject=0xf8) returned 1 [0070.832] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.dvodltmf")) returned 0 [0070.833] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.dvodltmf")) returned 0x2020 [0070.833] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js", lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8366fe30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8366fe30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x2dee80, dwReserved1=0x18dfe4, cFileName="cast_app_redirect.js", cAlternateFileName="CAST_A~1.JS")) returned 0x2e84d8 [0070.833] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8366fe30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8366fe30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x2dee80, dwReserved1=0x18dfe4, cFileName="cast_app_redirect.js", cAlternateFileName="CAST_A~1.JS")) returned 0 [0070.833] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0070.833] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js")) returned 1 [0070.835] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js")) returned 0xffffffff [0070.835] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83674c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83674c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x1bef, dwReserved0=0x2ded10, dwReserved1=0x18df7c, cFileName="chromecast_logo_grey.png", cAlternateFileName="CHROME~1.PNG")) returned 1 [0070.835] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0070.835] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0070.835] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1bef [0070.835] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0070.836] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0070.922] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1bef, lpNumberOfBytesRead=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18df70*=0x1bef, lpOverlapped=0x0) returned 1 [0070.967] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1bf0, lpNumberOfBytesWritten=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18df70*=0x1bf0, lpOverlapped=0x0) returned 1 [0070.969] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0070.992] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.003] CloseHandle (hObject=0xf8) returned 1 [0071.004] CloseHandle (hObject=0x100) returned 1 [0071.005] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.dvodltmf")) returned 0 [0071.006] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.dvodltmf")) returned 0x2020 [0071.006] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png", lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83674c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83674c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x1bef, dwReserved0=0x2dee88, dwReserved1=0x18dfe4, cFileName="chromecast_logo_grey.png", cAlternateFileName="CHROME~1.PNG")) returned 0x2e84d8 [0071.006] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83674c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83674c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x1bef, dwReserved0=0x2dee88, dwReserved1=0x18dfe4, cFileName="chromecast_logo_grey.png", cAlternateFileName="CHROME~1.PNG")) returned 0 [0071.006] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0071.006] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png")) returned 1 [0071.007] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png")) returned 0xffffffff [0071.007] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83679a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83679a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x2ded10, dwReserved1=0x18df7c, cFileName="devices.html", cAlternateFileName="DEVICE~1.HTM")) returned 1 [0071.007] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0071.007] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0071.008] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b [0071.008] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0071.008] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0071.094] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3b, lpNumberOfBytesRead=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18df70*=0x3b, lpOverlapped=0x0) returned 1 [0071.095] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18df70*=0x40, lpOverlapped=0x0) returned 1 [0071.096] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0071.116] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.125] CloseHandle (hObject=0x100) returned 1 [0071.125] CloseHandle (hObject=0xf8) returned 1 [0071.126] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.dvodltmf")) returned 0 [0071.127] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.dvodltmf")) returned 0x2020 [0071.127] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html", lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83679a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83679a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x2dee70, dwReserved1=0x18dfe4, cFileName="devices.html", cAlternateFileName="DEVICE~1.HTM")) returned 0x2e84d8 [0071.127] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83679a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83679a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x2dee70, dwReserved1=0x18dfe4, cFileName="devices.html", cAlternateFileName="DEVICE~1.HTM")) returned 0 [0071.127] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0071.127] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html")) returned 1 [0071.128] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html")) returned 0xffffffff [0071.128] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8367c180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8367c180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x2ded10, dwReserved1=0x18df7c, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0071.128] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0071.129] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0071.129] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x828 [0071.129] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0071.130] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0071.225] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x828, lpNumberOfBytesRead=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18df70*=0x828, lpOverlapped=0x0) returned 1 [0071.227] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18df70*=0x830, lpOverlapped=0x0) returned 1 [0071.228] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0071.247] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.257] CloseHandle (hObject=0xf8) returned 1 [0071.257] CloseHandle (hObject=0x100) returned 1 [0071.258] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.dvodltmf")) returned 0 [0071.259] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.dvodltmf")) returned 0x2020 [0071.259] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html", lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8367c180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8367c180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x2dee70, dwReserved1=0x18dfe4, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 0x2e84d8 [0071.259] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8367c180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8367c180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x2dee70, dwReserved1=0x18dfe4, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 0 [0071.259] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0071.259] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html")) returned 1 [0071.260] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html")) returned 0xffffffff [0071.260] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83685dc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83685dc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x2ded10, dwReserved1=0x18df7c, cFileName="offers.html", cAlternateFileName="OFFERS~1.HTM")) returned 1 [0071.260] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0071.261] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0071.261] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b [0071.261] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0071.262] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0071.348] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3b, lpNumberOfBytesRead=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18df70*=0x3b, lpOverlapped=0x0) returned 1 [0071.349] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18df70*=0x40, lpOverlapped=0x0) returned 1 [0071.350] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0071.377] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.393] CloseHandle (hObject=0x100) returned 1 [0071.393] CloseHandle (hObject=0xf8) returned 1 [0071.394] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.dvodltmf")) returned 0 [0071.394] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.dvodltmf")) returned 0x2020 [0071.394] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html", lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83685dc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83685dc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x2dee70, dwReserved1=0x18dfe4, cFileName="offers.html", cAlternateFileName="OFFERS~1.HTM")) returned 0x2e84d8 [0071.395] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83685dc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83685dc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x2dee70, dwReserved1=0x18dfe4, cFileName="offers.html", cAlternateFileName="OFFERS~1.HTM")) returned 0 [0071.395] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0071.395] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html")) returned 1 [0071.396] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html")) returned 0xffffffff [0071.396] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836884d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8368abe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x2ded10, dwReserved1=0x18df7c, cFileName="setup.html", cAlternateFileName="SETUP~1.HTM")) returned 1 [0071.396] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0071.396] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0071.397] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b [0071.397] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0071.397] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0071.491] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3b, lpNumberOfBytesRead=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18df70*=0x3b, lpOverlapped=0x0) returned 1 [0071.492] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18df70*=0x40, lpOverlapped=0x0) returned 1 [0071.493] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0071.512] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.522] CloseHandle (hObject=0xf8) returned 1 [0071.522] CloseHandle (hObject=0x100) returned 1 [0071.523] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.dvodltmf")) returned 0 [0071.523] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.dvodltmf")) returned 0x2020 [0071.524] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html", lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836884d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8368abe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x2dee70, dwReserved1=0x18dfe4, cFileName="setup.html", cAlternateFileName="SETUP~1.HTM")) returned 0x2e84d8 [0071.524] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836884d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8368abe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x2dee70, dwReserved1=0x18dfe4, cFileName="setup.html", cAlternateFileName="SETUP~1.HTM")) returned 0 [0071.524] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0071.524] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html")) returned 1 [0071.525] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html")) returned 0xffffffff [0071.525] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836884d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8368abe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x2ded10, dwReserved1=0x18df7c, cFileName="setup.html", cAlternateFileName="SETUP~1.HTM")) returned 0 [0071.525] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0071.525] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8368d2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83694820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83694820, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f676f6c, dwReserved1=0x6572675f, cFileName="cloud_route_details", cAlternateFileName="CLOUD_~1")) returned 1 [0071.525] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8368d2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83694820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83694820, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18df7c, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0071.525] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8368d2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83694820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83694820, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18df7c, cFileName="..", cAlternateFileName="")) returned 1 [0071.525] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8368fa00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8368fa00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x174c, dwReserved0=0x2ded10, dwReserved1=0x18df7c, cFileName="view.html", cAlternateFileName="VIEW~1.HTM")) returned 1 [0071.525] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0071.526] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0071.526] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x174c [0071.526] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0071.526] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0071.612] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x174c, lpNumberOfBytesRead=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18df70*=0x174c, lpOverlapped=0x0) returned 1 [0071.614] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18df70*=0x1750, lpOverlapped=0x0) returned 1 [0071.615] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0071.637] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.647] CloseHandle (hObject=0x100) returned 1 [0071.647] CloseHandle (hObject=0xf8) returned 1 [0071.648] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.dvodltmf")) returned 0 [0071.648] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.dvodltmf")) returned 0x2020 [0071.648] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html", lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8368fa00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8368fa00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x174c, dwReserved0=0x2dee80, dwReserved1=0x18dfe4, cFileName="view.html", cAlternateFileName="VIEW~1.HTM")) returned 0x2e84d8 [0071.649] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8368fa00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8368fa00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x174c, dwReserved0=0x2dee80, dwReserved1=0x18dfe4, cFileName="view.html", cAlternateFileName="VIEW~1.HTM")) returned 0 [0071.649] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0071.649] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html")) returned 1 [0071.650] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html")) returned 0xffffffff [0071.650] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83694820, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83694820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x945, dwReserved0=0x2ded10, dwReserved1=0x18df7c, cFileName="view.js", cAlternateFileName="")) returned 1 [0071.650] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0071.651] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0071.723] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x945 [0071.723] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0071.723] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0071.829] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x945, lpNumberOfBytesRead=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18df70*=0x945, lpOverlapped=0x0) returned 1 [0071.830] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18df70*=0x950, lpOverlapped=0x0) returned 1 [0071.831] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0071.851] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.861] CloseHandle (hObject=0xf8) returned 1 [0071.861] CloseHandle (hObject=0x100) returned 1 [0071.862] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.dvodltmf")) returned 0 [0071.862] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.dvodltmf")) returned 0x2020 [0071.863] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js", lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83694820, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83694820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x945, dwReserved0=0x2dee78, dwReserved1=0x18dfe4, cFileName="view.js", cAlternateFileName="")) returned 0x2e84d8 [0071.863] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83694820, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83694820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x945, dwReserved0=0x2dee78, dwReserved1=0x18dfe4, cFileName="view.js", cAlternateFileName="")) returned 0 [0071.863] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0071.863] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js")) returned 1 [0071.864] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js")) returned 0xffffffff [0071.864] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83694820, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83694820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x945, dwReserved0=0x2ded10, dwReserved1=0x18df7c, cFileName="view.js", cAlternateFileName="")) returned 0 [0071.864] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0071.864] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83696f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83699640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xc878, dwReserved0=0x6f676f6c, dwReserved1=0x6572675f, cFileName="common.js", cAlternateFileName="")) returned 1 [0071.865] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0071.865] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0071.865] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc878 [0071.865] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0071.865] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0071.953] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xc878, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0xc878, lpOverlapped=0x0) returned 1 [0071.956] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc880, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0xc880, lpOverlapped=0x0) returned 1 [0071.958] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0071.977] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.987] CloseHandle (hObject=0xf4) returned 1 [0071.987] CloseHandle (hObject=0x100) returned 1 [0071.989] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.dvodltmf")) returned 0 [0071.989] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.dvodltmf")) returned 0x2020 [0071.990] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83696f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83699640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xc878, dwReserved0=0x2dee58, dwReserved1=0x18e24c, cFileName="common.js", cAlternateFileName="")) returned 0x2e8498 [0071.990] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83696f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83699640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xc878, dwReserved0=0x2dee58, dwReserved1=0x18e24c, cFileName="common.js", cAlternateFileName="")) returned 0 [0071.990] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0071.990] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js")) returned 1 [0071.991] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js")) returned 0xffffffff [0071.991] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8369bd50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8369bd50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xc26, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="feedback.css", cAlternateFileName="")) returned 1 [0071.991] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0071.991] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0071.992] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc26 [0071.992] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0071.992] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0072.077] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xc26, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0xc26, lpOverlapped=0x0) returned 1 [0072.079] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0xc30, lpOverlapped=0x0) returned 1 [0072.080] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0072.100] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.109] CloseHandle (hObject=0x100) returned 1 [0072.109] CloseHandle (hObject=0xf4) returned 1 [0072.110] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.dvodltmf")) returned 0 [0072.111] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.dvodltmf")) returned 0x2020 [0072.111] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8369bd50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8369bd50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xc26, dwReserved0=0x2dee60, dwReserved1=0x18e24c, cFileName="feedback.css", cAlternateFileName="")) returned 0x2e8498 [0072.111] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8369bd50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8369bd50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xc26, dwReserved0=0x2dee60, dwReserved1=0x18e24c, cFileName="feedback.css", cAlternateFileName="")) returned 0 [0072.111] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0072.111] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css")) returned 1 [0072.112] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css")) returned 0xffffffff [0072.112] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836a0b70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836a0b70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x38a8, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="feedback.html", cAlternateFileName="FEEDBA~1.HTM")) returned 1 [0072.112] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0072.113] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0072.113] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x38a8 [0072.113] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0072.114] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0072.199] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x38a8, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0x38a8, lpOverlapped=0x0) returned 1 [0072.223] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x38b0, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0x38b0, lpOverlapped=0x0) returned 1 [0072.224] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0072.244] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.254] CloseHandle (hObject=0xf4) returned 1 [0072.254] CloseHandle (hObject=0x100) returned 1 [0072.255] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.dvodltmf")) returned 0 [0072.256] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.dvodltmf")) returned 0x2020 [0072.256] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836a0b70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836a0b70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x38a8, dwReserved0=0x2dee60, dwReserved1=0x18e24c, cFileName="feedback.html", cAlternateFileName="FEEDBA~1.HTM")) returned 0x2e8498 [0072.256] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836a0b70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836a0b70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x38a8, dwReserved0=0x2dee60, dwReserved1=0x18e24c, cFileName="feedback.html", cAlternateFileName="FEEDBA~1.HTM")) returned 0 [0072.256] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0072.256] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html")) returned 1 [0072.257] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html")) returned 0xffffffff [0072.257] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836a5990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836a5990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x2b20, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="feedback_script.js", cAlternateFileName="FEEDBA~1.JS")) returned 1 [0072.257] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0072.258] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0072.259] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b20 [0072.259] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0072.259] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0072.344] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2b20, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0x2b20, lpOverlapped=0x0) returned 1 [0072.346] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2b30, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0x2b30, lpOverlapped=0x0) returned 1 [0072.347] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0072.372] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.381] CloseHandle (hObject=0x100) returned 1 [0072.382] CloseHandle (hObject=0xf4) returned 1 [0072.383] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js.dvodltmf")) returned 0 [0072.383] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js.dvodltmf")) returned 0x2020 [0072.383] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836a5990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836a5990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x2b20, dwReserved0=0x2dee68, dwReserved1=0x18e24c, cFileName="feedback_script.js", cAlternateFileName="FEEDBA~1.JS")) returned 0x2e8498 [0072.383] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836a5990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836a5990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x2b20, dwReserved0=0x2dee68, dwReserved1=0x18e24c, cFileName="feedback_script.js", cAlternateFileName="FEEDBA~1.JS")) returned 0 [0072.383] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0072.384] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js")) returned 1 [0072.385] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js")) returned 0xffffffff [0072.385] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836af5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8395fd70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0072.385] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0072.385] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0072.385] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8f8 [0072.385] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0072.385] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0072.471] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x8f8, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0x8f8, lpOverlapped=0x0) returned 1 [0072.473] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0x900, lpOverlapped=0x0) returned 1 [0072.474] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0072.494] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.504] CloseHandle (hObject=0xf4) returned 1 [0072.504] CloseHandle (hObject=0x100) returned 1 [0072.505] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json.dvodltmf")) returned 0 [0072.505] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json.dvodltmf")) returned 0x2020 [0072.505] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836af5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8395fd70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x2dee60, dwReserved1=0x18e24c, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 0x2e8498 [0072.506] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836af5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8395fd70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x2dee60, dwReserved1=0x18e24c, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 0 [0072.506] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0072.506] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json")) returned 1 [0072.507] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json")) returned 0xffffffff [0072.507] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836b1ce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836b43f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x46039, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="material_css_min.css", cAlternateFileName="MATERI~1.CSS")) returned 1 [0072.507] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0072.507] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0072.507] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46039 [0072.507] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0072.508] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0072.593] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x46039, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0x46039, lpOverlapped=0x0) returned 1 [0072.600] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x46040, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0x46040, lpOverlapped=0x0) returned 1 [0072.606] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0072.626] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.636] CloseHandle (hObject=0x100) returned 1 [0072.636] CloseHandle (hObject=0xf4) returned 1 [0072.640] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css.dvodltmf")) returned 0 [0072.640] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css.dvodltmf")) returned 0x2020 [0072.640] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836b1ce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836b43f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x46039, dwReserved0=0x2dee70, dwReserved1=0x18e24c, cFileName="material_css_min.css", cAlternateFileName="MATERI~1.CSS")) returned 0x2e8498 [0072.641] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836b1ce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836b43f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x46039, dwReserved0=0x2dee70, dwReserved1=0x18e24c, cFileName="material_css_min.css", cAlternateFileName="MATERI~1.CSS")) returned 0 [0072.641] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0072.641] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css")) returned 1 [0072.644] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css")) returned 0xffffffff [0072.644] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836b6b00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836b9210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x7c33, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="mirroring_cast_streaming.js", cAlternateFileName="MIRROR~1.JS")) returned 1 [0072.644] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0072.644] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0072.645] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7c33 [0072.645] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0072.645] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0072.732] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x7c33, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0x7c33, lpOverlapped=0x0) returned 1 [0072.734] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x7c40, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0x7c40, lpOverlapped=0x0) returned 1 [0072.735] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0072.755] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.765] CloseHandle (hObject=0xf4) returned 1 [0072.765] CloseHandle (hObject=0x100) returned 1 [0072.766] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js.dvodltmf")) returned 0 [0072.767] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js.dvodltmf")) returned 0x2020 [0072.767] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836b6b00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836b9210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x7c33, dwReserved0=0x2dee78, dwReserved1=0x18e24c, cFileName="mirroring_cast_streaming.js", cAlternateFileName="MIRROR~1.JS")) returned 0x2e8498 [0072.767] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836b6b00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836b9210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x7c33, dwReserved0=0x2dee78, dwReserved1=0x18e24c, cFileName="mirroring_cast_streaming.js", cAlternateFileName="MIRROR~1.JS")) returned 0 [0072.767] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0072.767] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js")) returned 1 [0072.772] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js")) returned 0xffffffff [0072.772] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836c2e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836c5560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x2adeb, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="mirroring_common.js", cAlternateFileName="MIRROR~2.JS")) returned 1 [0072.772] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0072.772] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0072.772] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2adeb [0072.772] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0072.773] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0072.858] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2adeb, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0x2adeb, lpOverlapped=0x0) returned 1 [0072.862] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2adf0, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0x2adf0, lpOverlapped=0x0) returned 1 [0072.866] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0072.885] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.895] CloseHandle (hObject=0x100) returned 1 [0072.895] CloseHandle (hObject=0xf4) returned 1 [0072.898] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js.dvodltmf")) returned 0 [0072.898] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js.dvodltmf")) returned 0x2020 [0072.898] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836c2e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836c5560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x2adeb, dwReserved0=0x2dee68, dwReserved1=0x18e24c, cFileName="mirroring_common.js", cAlternateFileName="MIRROR~2.JS")) returned 0x2e8498 [0072.898] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836c2e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836c5560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x2adeb, dwReserved0=0x2dee68, dwReserved1=0x18e24c, cFileName="mirroring_common.js", cAlternateFileName="MIRROR~2.JS")) returned 0 [0072.898] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0072.899] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js")) returned 1 [0072.901] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js")) returned 0xffffffff [0072.901] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836ca380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836cf1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x794cf, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="mirroring_hangouts.js", cAlternateFileName="MIRROR~3.JS")) returned 1 [0072.901] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0072.902] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0072.903] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x794cf [0072.903] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0072.903] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0072.988] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x794cf, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0x794cf, lpOverlapped=0x0) returned 1 [0072.998] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x794d0, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0x794d0, lpOverlapped=0x0) returned 1 [0073.007] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0073.029] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.041] CloseHandle (hObject=0xf4) returned 1 [0073.041] CloseHandle (hObject=0x100) returned 1 [0073.046] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js.dvodltmf")) returned 0 [0073.047] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js.dvodltmf")) returned 0x2020 [0073.047] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836ca380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836cf1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x794cf, dwReserved0=0x2dee70, dwReserved1=0x18e24c, cFileName="mirroring_hangouts.js", cAlternateFileName="MIRROR~3.JS")) returned 0x2e8498 [0073.047] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836ca380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836cf1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x794cf, dwReserved0=0x2dee70, dwReserved1=0x18e24c, cFileName="mirroring_hangouts.js", cAlternateFileName="MIRROR~3.JS")) returned 0 [0073.047] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0073.048] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js")) returned 1 [0073.052] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js")) returned 0xffffffff [0073.052] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836d3fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836d66d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x941, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="mirroring_webrtc.js", cAlternateFileName="MIRROR~4.JS")) returned 1 [0073.052] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0073.052] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0073.053] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x941 [0073.053] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0073.053] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0073.138] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x941, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0x941, lpOverlapped=0x0) returned 1 [0073.139] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0x950, lpOverlapped=0x0) returned 1 [0073.140] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0073.160] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.169] CloseHandle (hObject=0x100) returned 1 [0073.169] CloseHandle (hObject=0xf4) returned 1 [0073.170] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js.dvodltmf")) returned 0 [0073.171] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js.dvodltmf")) returned 0x2020 [0073.171] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836d3fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836d66d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x941, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="mirroring_webrtc.js", cAlternateFileName="MIRROR~4.JS")) returned 0x2e8498 [0073.171] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836d3fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836d66d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x941, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="mirroring_webrtc.js", cAlternateFileName="MIRROR~4.JS")) returned 0 [0073.171] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0073.171] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js")) returned 1 [0073.172] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js")) returned 0xffffffff [0073.172] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e6790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83624340, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83624340, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="_locales", cAlternateFileName="")) returned 1 [0073.172] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e6790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83624340, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83624340, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x134, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0073.174] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e6790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83624340, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83624340, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x134, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.174] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e8ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833eb5b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x134, dwReserved1=0x0, cFileName="am", cAlternateFileName="")) returned 1 [0073.175] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e8ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833eb5b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740072, dwReserved1=0x2e0063, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0073.175] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e8ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833eb5b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740072, dwReserved1=0x2e0063, cFileName="..", cAlternateFileName="")) returned 1 [0073.175] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833eb5b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397d230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4827, dwReserved0=0x740072, dwReserved1=0x2e0063, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.175] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0073.176] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0073.176] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4827 [0073.176] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0073.176] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0073.263] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4827, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x4827, lpOverlapped=0x0) returned 1 [0073.272] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4830, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x4830, lpOverlapped=0x0) returned 1 [0073.273] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0073.293] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.303] CloseHandle (hObject=0xf8) returned 1 [0073.303] CloseHandle (hObject=0xfc) returned 1 [0073.304] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json.dvodltmf")) returned 0 [0073.304] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json.dvodltmf")) returned 0x2020 [0073.305] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833eb5b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397d230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4827, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0073.305] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833eb5b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397d230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4827, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0073.305] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0073.305] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json")) returned 1 [0073.306] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json")) returned 0xffffffff [0073.306] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833eb5b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397d230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4827, dwReserved0=0x740072, dwReserved1=0x2e0063, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0073.306] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0073.306] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833f7900, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833fee30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0073.306] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833f7900, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833fee30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0073.306] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833f7900, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833fee30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0073.306] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833fee30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x45bf, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.307] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0073.307] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0073.307] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x45bf [0073.307] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0073.307] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0073.398] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x45bf, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x45bf, lpOverlapped=0x0) returned 1 [0073.399] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x45c0, lpOverlapped=0x0) returned 1 [0073.401] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0073.420] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.430] CloseHandle (hObject=0xfc) returned 1 [0073.430] CloseHandle (hObject=0xf8) returned 1 [0073.431] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json.dvodltmf")) returned 0 [0073.432] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json.dvodltmf")) returned 0x2020 [0073.432] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833fee30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x45bf, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0073.432] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833fee30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x45bf, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0073.432] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0073.432] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json")) returned 1 [0073.433] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json")) returned 0xffffffff [0073.433] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833fee30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x45bf, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0073.433] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0073.433] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83403c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83406360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83406360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0073.433] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83403c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83406360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83406360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0073.434] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83403c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83406360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83406360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0073.434] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83406360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83408a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4b63, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.434] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0073.435] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0073.435] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4b63 [0073.435] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0073.435] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0073.520] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4b63, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x4b63, lpOverlapped=0x0) returned 1 [0073.522] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4b70, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x4b70, lpOverlapped=0x0) returned 1 [0073.523] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0073.543] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.552] CloseHandle (hObject=0xf8) returned 1 [0073.553] CloseHandle (hObject=0xfc) returned 1 [0073.554] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json.dvodltmf")) returned 0 [0073.554] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json.dvodltmf")) returned 0x2020 [0073.554] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83406360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83408a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4b63, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0073.554] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83406360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83408a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4b63, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0073.554] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0073.554] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json")) returned 1 [0073.555] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json")) returned 0xffffffff [0073.555] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83406360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83408a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4b63, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0073.555] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0073.556] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8340b180, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="bn", cAlternateFileName="")) returned 1 [0073.556] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8340b180, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0073.556] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8340b180, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0073.556] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52cb, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.556] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0073.556] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0073.557] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x52cb [0073.557] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0073.557] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0073.643] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x52cb, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x52cb, lpOverlapped=0x0) returned 1 [0073.649] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x52d0, lpOverlapped=0x0) returned 1 [0073.652] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0073.671] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.681] CloseHandle (hObject=0xfc) returned 1 [0073.681] CloseHandle (hObject=0xf8) returned 1 [0073.683] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json.dvodltmf")) returned 0 [0073.684] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json.dvodltmf")) returned 0x2020 [0073.684] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52cb, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0073.684] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52cb, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0073.684] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0073.684] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json")) returned 1 [0073.686] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json")) returned 0xffffffff [0073.686] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52cb, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0073.686] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0073.686] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340ffa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834126b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834126b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0073.686] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340ffa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834126b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834126b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0073.687] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340ffa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834126b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834126b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0073.687] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834126b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83414dc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x405d, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.687] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0073.688] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0073.688] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x405d [0073.688] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0073.689] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0073.798] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x405d, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x405d, lpOverlapped=0x0) returned 1 [0073.801] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4060, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x4060, lpOverlapped=0x0) returned 1 [0073.802] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0073.821] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.833] CloseHandle (hObject=0xf8) returned 1 [0073.833] CloseHandle (hObject=0xfc) returned 1 [0073.837] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json.dvodltmf")) returned 0 [0073.838] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json.dvodltmf")) returned 0x2020 [0073.838] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834126b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83414dc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x405d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0073.838] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834126b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83414dc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x405d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0073.838] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0073.838] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json")) returned 1 [0073.839] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json")) returned 0xffffffff [0073.839] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834126b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83414dc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x405d, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0073.839] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0073.840] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83419be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8341c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8341c2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0073.840] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83419be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8341c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8341c2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0073.840] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83419be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8341c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8341c2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0073.840] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8341c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83421110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4029, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.840] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0073.840] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0073.840] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4029 [0073.841] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0073.841] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0073.937] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4029, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x4029, lpOverlapped=0x0) returned 1 [0073.939] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4030, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x4030, lpOverlapped=0x0) returned 1 [0073.940] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0073.959] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.968] CloseHandle (hObject=0xfc) returned 1 [0073.969] CloseHandle (hObject=0xf8) returned 1 [0073.970] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json.dvodltmf")) returned 0 [0073.970] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json.dvodltmf")) returned 0x2020 [0073.970] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8341c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83421110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4029, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0073.970] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8341c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83421110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4029, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0073.970] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0073.971] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json")) returned 1 [0073.972] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json")) returned 0xffffffff [0073.972] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8341c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83421110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4029, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0073.972] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0073.972] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83425f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83428640, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0073.972] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83425f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83428640, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0073.972] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83425f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83428640, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0073.972] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83428640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f79, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.972] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0073.973] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0073.974] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f79 [0073.974] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0073.974] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0074.058] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3f79, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x3f79, lpOverlapped=0x0) returned 1 [0074.061] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3f80, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x3f80, lpOverlapped=0x0) returned 1 [0074.063] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0074.086] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.096] CloseHandle (hObject=0xf8) returned 1 [0074.096] CloseHandle (hObject=0xfc) returned 1 [0074.097] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json.dvodltmf")) returned 0 [0074.098] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json.dvodltmf")) returned 0x2020 [0074.098] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83428640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f79, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0074.098] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83428640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f79, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0074.098] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0074.098] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json")) returned 1 [0074.099] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json")) returned 0xffffffff [0074.099] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83428640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f79, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0074.099] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0074.100] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8342d460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8342fb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8342fb70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0074.100] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8342d460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8342fb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8342fb70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0074.100] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8342d460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8342fb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8342fb70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0074.100] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8342fb70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83432280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x406f, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.100] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0074.100] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0074.101] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x406f [0074.101] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0074.101] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0074.199] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x406f, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x406f, lpOverlapped=0x0) returned 1 [0074.203] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4070, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x4070, lpOverlapped=0x0) returned 1 [0074.205] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0074.227] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.237] CloseHandle (hObject=0xfc) returned 1 [0074.237] CloseHandle (hObject=0xf8) returned 1 [0074.239] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json.dvodltmf")) returned 0 [0074.240] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json.dvodltmf")) returned 0x2020 [0074.240] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8342fb70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83432280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x406f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0074.240] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8342fb70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83432280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x406f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0074.240] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0074.240] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json")) returned 1 [0074.242] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json")) returned 0xffffffff [0074.242] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8342fb70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83432280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x406f, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0074.242] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0074.242] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83434990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834370a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834370a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0074.242] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83434990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834370a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834370a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0074.243] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83434990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834370a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834370a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0074.243] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834370a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834397b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4afe, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.243] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0074.244] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0074.244] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4afe [0074.244] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0074.244] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0074.340] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4afe, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x4afe, lpOverlapped=0x0) returned 1 [0074.342] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4b00, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x4b00, lpOverlapped=0x0) returned 1 [0074.344] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0074.374] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.384] CloseHandle (hObject=0xf8) returned 1 [0074.384] CloseHandle (hObject=0xfc) returned 1 [0074.385] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json.dvodltmf")) returned 0 [0074.385] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json.dvodltmf")) returned 0x2020 [0074.386] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834370a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834397b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4afe, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0074.386] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834370a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834397b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4afe, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0074.386] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0074.386] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json")) returned 1 [0074.387] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json")) returned 0xffffffff [0074.387] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834370a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834397b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4afe, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0074.387] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0074.387] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8343bec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83440ce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1 [0074.387] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8343bec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83440ce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0074.388] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8343bec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83440ce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0074.388] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8343e5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d7a, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.388] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0074.388] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0074.388] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d7a [0074.388] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0074.389] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0074.480] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3d7a, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x3d7a, lpOverlapped=0x0) returned 1 [0074.482] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x3d80, lpOverlapped=0x0) returned 1 [0074.483] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0074.502] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.512] CloseHandle (hObject=0xfc) returned 1 [0074.512] CloseHandle (hObject=0xf8) returned 1 [0074.513] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json.dvodltmf")) returned 0 [0074.514] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json.dvodltmf")) returned 0x2020 [0074.514] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8343e5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d7a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0074.514] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8343e5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d7a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0074.514] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0074.514] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json")) returned 1 [0074.515] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json")) returned 0xffffffff [0074.515] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8343e5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d7a, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0074.515] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0074.516] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8344a920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8344d030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0074.516] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8344a920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8344d030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0074.516] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8344a920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8344d030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0074.516] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8344d030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x404b, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.516] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0074.517] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0074.517] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x404b [0074.517] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0074.517] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0074.601] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x404b, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x404b, lpOverlapped=0x0) returned 1 [0074.603] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x4050, lpOverlapped=0x0) returned 1 [0074.604] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0074.624] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.635] CloseHandle (hObject=0xf8) returned 1 [0074.635] CloseHandle (hObject=0xfc) returned 1 [0074.636] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json.dvodltmf")) returned 0 [0074.637] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json.dvodltmf")) returned 0x2020 [0074.637] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8344d030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x404b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0074.637] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8344d030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x404b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0074.637] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0074.637] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json")) returned 1 [0074.638] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json")) returned 0xffffffff [0074.638] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8344d030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x404b, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0074.638] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0074.638] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83451e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83454560, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0074.639] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83451e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83454560, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0074.639] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83451e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83454560, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0074.639] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83454560, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e85, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.639] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0074.639] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0074.639] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e85 [0074.639] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0074.640] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0074.726] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3e85, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x3e85, lpOverlapped=0x0) returned 1 [0074.727] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3e90, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x3e90, lpOverlapped=0x0) returned 1 [0074.728] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0074.747] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.757] CloseHandle (hObject=0xfc) returned 1 [0074.757] CloseHandle (hObject=0xf8) returned 1 [0074.758] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json.dvodltmf")) returned 0 [0074.759] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json.dvodltmf")) returned 0x2020 [0074.759] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83454560, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e85, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0074.759] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83454560, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e85, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0074.759] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0074.759] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json")) returned 1 [0074.760] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json")) returned 0xffffffff [0074.760] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83454560, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e85, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0074.760] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0074.761] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83459380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8345ba90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="fa", cAlternateFileName="")) returned 1 [0074.761] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83459380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8345ba90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0074.761] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83459380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8345ba90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0074.761] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8345ba90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x46f5, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.761] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0074.763] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0074.763] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46f5 [0074.763] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0074.763] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0074.849] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x46f5, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x46f5, lpOverlapped=0x0) returned 1 [0074.851] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4700, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x4700, lpOverlapped=0x0) returned 1 [0074.852] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0074.871] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.882] CloseHandle (hObject=0xf8) returned 1 [0074.882] CloseHandle (hObject=0xfc) returned 1 [0074.884] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json.dvodltmf")) returned 0 [0074.884] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json.dvodltmf")) returned 0x2020 [0074.884] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8345ba90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x46f5, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0074.884] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8345ba90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x46f5, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0074.884] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0074.885] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json")) returned 1 [0074.886] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json")) returned 0xffffffff [0074.886] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8345ba90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x46f5, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0074.886] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0074.886] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834608b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83462fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0074.886] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834608b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83462fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0074.886] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834608b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83462fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0074.886] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83462fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f4c, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.886] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0074.886] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0074.887] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f4c [0074.887] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0074.887] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0074.980] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3f4c, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x3f4c, lpOverlapped=0x0) returned 1 [0074.982] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3f50, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x3f50, lpOverlapped=0x0) returned 1 [0074.983] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0075.002] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.012] CloseHandle (hObject=0xfc) returned 1 [0075.012] CloseHandle (hObject=0xf8) returned 1 [0075.014] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json.dvodltmf")) returned 0 [0075.014] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json.dvodltmf")) returned 0x2020 [0075.014] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83462fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f4c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0075.015] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83462fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f4c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0075.015] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0075.015] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json")) returned 1 [0075.016] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json")) returned 0xffffffff [0075.016] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83462fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f4c, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0075.016] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0075.016] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83467de0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8346cc00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8346cc00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0075.016] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83467de0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8346cc00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8346cc00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0075.017] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83467de0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8346cc00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8346cc00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0075.017] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8346cc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83471a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4082, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0075.017] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0075.018] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0075.018] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4082 [0075.018] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0075.019] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0075.115] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4082, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x4082, lpOverlapped=0x0) returned 1 [0075.117] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4090, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x4090, lpOverlapped=0x0) returned 1 [0075.119] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0075.142] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.152] CloseHandle (hObject=0xf8) returned 1 [0075.152] CloseHandle (hObject=0xfc) returned 1 [0075.153] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json.dvodltmf")) returned 0 [0075.154] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json.dvodltmf")) returned 0x2020 [0075.154] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8346cc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83471a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4082, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0075.154] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8346cc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83471a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4082, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0075.154] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0075.154] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json")) returned 1 [0075.155] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json")) returned 0xffffffff [0075.155] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8346cc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83471a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4082, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0075.155] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0075.156] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83476840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83478f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0075.156] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83476840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83478f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0075.156] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83476840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83478f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0075.156] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83478f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x419f, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0075.156] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0075.156] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0075.157] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x419f [0075.157] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0075.157] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0075.242] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x419f, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x419f, lpOverlapped=0x0) returned 1 [0075.244] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x41a0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x41a0, lpOverlapped=0x0) returned 1 [0075.245] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0075.265] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.274] CloseHandle (hObject=0xfc) returned 1 [0075.274] CloseHandle (hObject=0xf8) returned 1 [0075.275] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json.dvodltmf")) returned 0 [0075.276] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json.dvodltmf")) returned 0x2020 [0075.276] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83478f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x419f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0075.276] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83478f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x419f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0075.276] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0075.276] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json")) returned 1 [0075.277] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json")) returned 0xffffffff [0075.277] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83478f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x419f, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0075.277] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0075.278] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8347dd70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83480480, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="gu", cAlternateFileName="")) returned 1 [0075.278] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8347dd70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83480480, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0075.278] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8347dd70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83480480, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0075.278] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83480480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5079, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0075.278] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0075.287] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0075.287] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5079 [0075.288] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0075.288] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0075.382] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x5079, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x5079, lpOverlapped=0x0) returned 1 [0075.384] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x5080, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x5080, lpOverlapped=0x0) returned 1 [0075.385] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0075.405] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.415] CloseHandle (hObject=0xf8) returned 1 [0075.415] CloseHandle (hObject=0xfc) returned 1 [0075.416] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json.dvodltmf")) returned 0 [0075.417] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json.dvodltmf")) returned 0x2020 [0075.417] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83480480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5079, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0075.417] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83480480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5079, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0075.417] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0075.417] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json")) returned 1 [0075.418] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json")) returned 0xffffffff [0075.418] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83480480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5079, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0075.418] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0075.418] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834852a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834879b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0075.419] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834852a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834879b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0075.419] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834852a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834879b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0075.419] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834879b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x50f7, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0075.419] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0075.419] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0075.419] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x50f7 [0075.419] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0075.420] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0075.510] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x50f7, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x50f7, lpOverlapped=0x0) returned 1 [0075.512] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x5100, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x5100, lpOverlapped=0x0) returned 1 [0075.513] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0075.533] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.542] CloseHandle (hObject=0xfc) returned 1 [0075.543] CloseHandle (hObject=0xf8) returned 1 [0075.544] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json.dvodltmf")) returned 0 [0075.544] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json.dvodltmf")) returned 0x2020 [0075.544] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834879b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x50f7, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0075.545] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834879b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x50f7, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0075.545] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0075.545] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json")) returned 1 [0075.546] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json")) returned 0xffffffff [0075.546] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834879b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x50f7, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0075.546] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0075.547] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8348c7d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8348eee0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0075.547] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8348c7d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8348eee0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0075.547] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8348c7d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8348eee0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0075.547] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8348eee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ff2, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0075.547] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0075.548] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0075.548] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ff2 [0075.548] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0075.548] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0075.636] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3ff2, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x3ff2, lpOverlapped=0x0) returned 1 [0075.637] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x4000, lpOverlapped=0x0) returned 1 [0075.639] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0075.658] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.667] CloseHandle (hObject=0xf8) returned 1 [0075.667] CloseHandle (hObject=0xfc) returned 1 [0075.669] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json.dvodltmf")) returned 0 [0075.669] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json.dvodltmf")) returned 0x2020 [0075.669] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8348eee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ff2, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0075.669] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8348eee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ff2, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0075.669] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0075.670] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json")) returned 1 [0075.671] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json")) returned 0xffffffff [0075.671] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8348eee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ff2, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0075.671] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0075.671] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83496410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83498b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83498b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0075.671] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83496410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83498b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83498b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0075.671] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83496410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83498b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83498b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0075.671] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83498b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8349d940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40d4, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0075.671] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0075.672] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0075.672] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40d4 [0075.672] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0075.672] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0075.774] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x40d4, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x40d4, lpOverlapped=0x0) returned 1 [0075.786] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x40e0, lpOverlapped=0x0) returned 1 [0075.787] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0075.807] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.816] CloseHandle (hObject=0xfc) returned 1 [0075.817] CloseHandle (hObject=0xf8) returned 1 [0075.818] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json.dvodltmf")) returned 0 [0075.819] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json.dvodltmf")) returned 0x2020 [0075.819] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83498b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8349d940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40d4, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0075.819] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83498b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8349d940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40d4, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0075.819] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0075.819] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json")) returned 1 [0075.820] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json")) returned 0xffffffff [0075.820] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83498b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8349d940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40d4, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0075.820] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0075.820] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a2760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a4e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0075.820] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a2760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a4e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0075.821] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a2760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a4e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0075.821] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a4e70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e5d, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0075.821] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0075.822] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0075.822] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e5d [0075.822] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0075.823] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0075.912] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3e5d, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x3e5d, lpOverlapped=0x0) returned 1 [0075.914] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3e60, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x3e60, lpOverlapped=0x0) returned 1 [0075.915] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0075.934] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.944] CloseHandle (hObject=0xf8) returned 1 [0075.944] CloseHandle (hObject=0xfc) returned 1 [0075.946] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json.dvodltmf")) returned 0 [0075.946] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json.dvodltmf")) returned 0x2020 [0075.946] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a4e70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e5d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0075.946] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a4e70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e5d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0075.946] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0075.946] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json")) returned 1 [0075.947] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json")) returned 0xffffffff [0075.947] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a4e70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e5d, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0075.948] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0075.948] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a7580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0075.948] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a7580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0075.948] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a7580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0075.948] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f0c, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0075.948] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0075.948] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0075.949] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f0c [0075.949] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0075.949] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0076.035] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3f0c, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x3f0c, lpOverlapped=0x0) returned 1 [0076.037] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3f10, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x3f10, lpOverlapped=0x0) returned 1 [0076.038] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0076.058] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.068] CloseHandle (hObject=0xfc) returned 1 [0076.068] CloseHandle (hObject=0xf8) returned 1 [0076.070] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json.dvodltmf")) returned 0 [0076.070] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json.dvodltmf")) returned 0x2020 [0076.070] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f0c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0076.070] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f0c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0076.070] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0076.070] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json")) returned 1 [0076.072] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json")) returned 0xffffffff [0076.072] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f0c, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0076.072] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0076.072] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834aeab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b11c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834b11c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="iw", cAlternateFileName="")) returned 1 [0076.072] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834aeab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b11c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834b11c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0076.072] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834aeab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b11c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834b11c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0076.072] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834b11c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b38d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x5074, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0076.072] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0076.073] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0076.073] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5074 [0076.073] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0076.074] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0076.163] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x5074, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x5074, lpOverlapped=0x0) returned 1 [0076.165] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x5080, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x5080, lpOverlapped=0x0) returned 1 [0076.166] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0076.186] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.196] CloseHandle (hObject=0xf8) returned 1 [0076.196] CloseHandle (hObject=0xfc) returned 1 [0076.197] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json.dvodltmf")) returned 0 [0076.198] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json.dvodltmf")) returned 0x2020 [0076.198] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834b11c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b38d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x5074, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0076.198] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834b11c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b38d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x5074, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0076.198] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0076.198] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json")) returned 1 [0076.199] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json")) returned 0xffffffff [0076.199] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834b11c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b38d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x5074, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0076.199] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0076.200] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834b86f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bae00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834bae00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0076.200] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834b86f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bae00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834bae00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0076.200] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834b86f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bae00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834bae00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0076.200] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834bae00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bd510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x447a, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0076.200] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0076.200] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0076.201] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x447a [0076.201] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0076.201] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0076.297] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x447a, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x447a, lpOverlapped=0x0) returned 1 [0076.299] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4480, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x4480, lpOverlapped=0x0) returned 1 [0076.301] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0076.321] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.330] CloseHandle (hObject=0xfc) returned 1 [0076.331] CloseHandle (hObject=0xf8) returned 1 [0076.332] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json.dvodltmf")) returned 0 [0076.332] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json.dvodltmf")) returned 0x2020 [0076.332] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834bae00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bd510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x447a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0076.332] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834bae00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bd510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x447a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0076.333] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0076.333] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json")) returned 1 [0076.334] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json")) returned 0xffffffff [0076.334] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834bae00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bd510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x447a, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0076.334] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0076.334] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834c4a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c7150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834c7150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="kn", cAlternateFileName="")) returned 1 [0076.334] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834c4a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c7150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834c7150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0076.334] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834c4a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c7150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834c7150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0076.334] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834c7150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c9860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x55a3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0076.334] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0076.335] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0076.336] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x55a3 [0076.336] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0076.336] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0076.426] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x55a3, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x55a3, lpOverlapped=0x0) returned 1 [0076.429] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x55b0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x55b0, lpOverlapped=0x0) returned 1 [0076.430] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0076.449] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.459] CloseHandle (hObject=0xf8) returned 1 [0076.459] CloseHandle (hObject=0xfc) returned 1 [0076.466] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json.dvodltmf")) returned 0 [0076.466] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json.dvodltmf")) returned 0x2020 [0076.466] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834c7150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c9860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x55a3, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0076.467] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834c7150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c9860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x55a3, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0076.467] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0076.467] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json")) returned 1 [0076.468] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json")) returned 0xffffffff [0076.468] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834c7150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c9860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x55a3, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0076.468] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0076.468] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834cbf70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ce680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ce680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0076.468] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834cbf70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ce680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ce680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0076.469] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834cbf70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ce680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ce680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0076.469] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ce680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d0d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x403a, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0076.469] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0076.469] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0076.469] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x403a [0076.469] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0076.469] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0076.555] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x403a, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x403a, lpOverlapped=0x0) returned 1 [0076.557] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x4040, lpOverlapped=0x0) returned 1 [0076.558] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0076.578] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.588] CloseHandle (hObject=0xfc) returned 1 [0076.588] CloseHandle (hObject=0xf8) returned 1 [0076.589] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json.dvodltmf")) returned 0 [0076.590] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json.dvodltmf")) returned 0x2020 [0076.590] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ce680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d0d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x403a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0076.590] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ce680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d0d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x403a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0076.590] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0076.591] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json")) returned 1 [0076.592] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json")) returned 0xffffffff [0076.592] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ce680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d0d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x403a, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0076.592] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0076.592] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834d34a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d5bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834d5bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0076.592] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834d34a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d5bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834d5bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0076.592] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834d34a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d5bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834d5bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0076.592] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834d5bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d82c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x416b, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0076.592] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0076.593] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0076.594] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x416b [0076.594] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0076.594] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0076.696] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x416b, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x416b, lpOverlapped=0x0) returned 1 [0076.698] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x4170, lpOverlapped=0x0) returned 1 [0076.699] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0076.719] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.729] CloseHandle (hObject=0xf8) returned 1 [0076.729] CloseHandle (hObject=0xfc) returned 1 [0076.730] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json.dvodltmf")) returned 0 [0076.731] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json.dvodltmf")) returned 0x2020 [0076.731] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834d5bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d82c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x416b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0076.731] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834d5bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d82c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x416b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0076.731] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0076.731] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json")) returned 1 [0076.732] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json")) returned 0xffffffff [0076.733] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834d5bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d82c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x416b, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0076.733] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0076.733] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834da9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834dd0e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834dd0e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0076.733] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834da9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834dd0e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834dd0e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0076.733] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834da9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834dd0e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834dd0e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0076.733] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834dd0e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834df7f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x41bf, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0076.733] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0076.733] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0076.734] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x41bf [0076.734] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0076.734] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0076.821] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x41bf, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x41bf, lpOverlapped=0x0) returned 1 [0076.960] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x41c0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x41c0, lpOverlapped=0x0) returned 1 [0076.961] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0076.981] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.991] CloseHandle (hObject=0xfc) returned 1 [0076.991] CloseHandle (hObject=0xf8) returned 1 [0076.992] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json.dvodltmf")) returned 0 [0076.993] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json.dvodltmf")) returned 0x2020 [0076.993] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834dd0e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834df7f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x41bf, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0076.993] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834dd0e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834df7f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x41bf, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0076.993] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0076.993] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json")) returned 1 [0076.994] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json")) returned 0xffffffff [0076.994] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834dd0e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834df7f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x41bf, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0076.994] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0076.994] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834e9430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ebb40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="ml", cAlternateFileName="")) returned 1 [0076.994] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834e9430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ebb40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0076.995] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834e9430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ebb40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0076.995] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ebb40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x583f, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0076.995] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0076.996] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0076.996] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x583f [0076.996] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0076.996] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0077.089] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x583f, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x583f, lpOverlapped=0x0) returned 1 [0077.098] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x5840, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x5840, lpOverlapped=0x0) returned 1 [0077.099] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0077.119] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.129] CloseHandle (hObject=0xf8) returned 1 [0077.129] CloseHandle (hObject=0xfc) returned 1 [0077.130] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json.dvodltmf")) returned 0 [0077.131] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json.dvodltmf")) returned 0x2020 [0077.131] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ebb40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x583f, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0077.131] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ebb40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x583f, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0077.131] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0077.131] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json")) returned 1 [0077.133] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json")) returned 0xffffffff [0077.133] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ebb40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x583f, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0077.133] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0077.133] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834f0960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834f3070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="mr", cAlternateFileName="")) returned 1 [0077.133] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834f0960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834f3070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0077.133] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834f0960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834f3070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0077.133] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834f3070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5224, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0077.133] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0077.133] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0077.134] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5224 [0077.134] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0077.134] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0077.220] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x5224, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x5224, lpOverlapped=0x0) returned 1 [0077.262] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x5230, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x5230, lpOverlapped=0x0) returned 1 [0077.263] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0077.283] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.292] CloseHandle (hObject=0xfc) returned 1 [0077.293] CloseHandle (hObject=0xf8) returned 1 [0077.303] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json.dvodltmf")) returned 0 [0077.304] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json.dvodltmf")) returned 0x2020 [0077.304] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834f3070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5224, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0077.304] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834f3070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5224, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0077.304] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0077.304] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json")) returned 1 [0077.305] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json")) returned 0xffffffff [0077.305] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834f3070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5224, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0077.305] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0077.306] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834fccb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ff3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1 [0077.306] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834fccb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ff3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0077.306] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834fccb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ff3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0077.306] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ff3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f8b, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0077.306] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0077.307] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0077.307] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f8b [0077.307] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0077.308] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0077.400] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3f8b, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x3f8b, lpOverlapped=0x0) returned 1 [0077.402] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3f90, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x3f90, lpOverlapped=0x0) returned 1 [0077.403] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0077.423] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.432] CloseHandle (hObject=0xf8) returned 1 [0077.433] CloseHandle (hObject=0xfc) returned 1 [0077.434] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json.dvodltmf")) returned 0 [0077.434] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json.dvodltmf")) returned 0x2020 [0077.434] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ff3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f8b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0077.435] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ff3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f8b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0077.435] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0077.435] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json")) returned 1 [0077.436] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json")) returned 0xffffffff [0077.436] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ff3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f8b, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0077.436] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0077.436] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835041e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835068f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="nb", cAlternateFileName="")) returned 1 [0077.436] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835041e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835068f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0077.436] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835041e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835068f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0077.437] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835068f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ebc, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0077.437] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0077.437] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0077.437] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ebc [0077.437] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0077.438] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0077.530] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3ebc, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x3ebc, lpOverlapped=0x0) returned 1 [0077.531] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3ec0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x3ec0, lpOverlapped=0x0) returned 1 [0077.536] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0077.556] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.565] CloseHandle (hObject=0xfc) returned 1 [0077.566] CloseHandle (hObject=0xf8) returned 1 [0077.568] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json.dvodltmf")) returned 0 [0077.569] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json.dvodltmf")) returned 0x2020 [0077.569] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835068f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ebc, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0077.569] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835068f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ebc, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0077.569] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0077.569] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json")) returned 1 [0077.570] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json")) returned 0xffffffff [0077.570] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835068f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ebc, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0077.570] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0077.570] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835794e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8357bbf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0077.570] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835794e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8357bbf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0077.571] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835794e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8357bbf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0077.571] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8357bbf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f45, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0077.571] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0077.572] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0077.572] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f45 [0077.572] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0077.572] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0077.662] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3f45, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x3f45, lpOverlapped=0x0) returned 1 [0077.663] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3f50, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x3f50, lpOverlapped=0x0) returned 1 [0077.665] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0077.685] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.694] CloseHandle (hObject=0xf8) returned 1 [0077.694] CloseHandle (hObject=0xfc) returned 1 [0077.696] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json.dvodltmf")) returned 0 [0077.696] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json.dvodltmf")) returned 0x2020 [0077.696] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8357bbf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f45, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0077.696] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8357bbf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f45, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0077.696] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0077.696] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json")) returned 1 [0077.697] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json")) returned 0xffffffff [0077.697] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8357bbf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f45, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0077.700] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0077.700] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83580a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83583120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0077.700] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83580a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83583120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0077.700] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83580a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83583120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0077.700] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83583120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fd7, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0077.701] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0077.701] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0077.701] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3fd7 [0077.701] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0077.701] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0077.809] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3fd7, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x3fd7, lpOverlapped=0x0) returned 1 [0077.810] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3fe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x3fe0, lpOverlapped=0x0) returned 1 [0077.811] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0077.831] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.841] CloseHandle (hObject=0xfc) returned 1 [0077.841] CloseHandle (hObject=0xf8) returned 1 [0077.842] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json.dvodltmf")) returned 0 [0077.843] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json.dvodltmf")) returned 0x2020 [0077.843] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83583120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fd7, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0077.843] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83583120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fd7, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0077.843] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0077.843] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json")) returned 1 [0077.844] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json")) returned 0xffffffff [0077.844] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83583120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fd7, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0077.845] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0077.845] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8358f470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359b7c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8359b7c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="pt", cAlternateFileName="")) returned 1 [0077.845] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8358f470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359b7c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8359b7c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0077.845] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8358f470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359b7c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8359b7c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0077.845] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8359b7c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359ded0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0077.845] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0077.846] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0077.846] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3fdc [0077.846] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0077.847] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0077.933] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3fdc, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x3fdc, lpOverlapped=0x0) returned 1 [0077.934] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3fe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x3fe0, lpOverlapped=0x0) returned 1 [0077.936] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0077.956] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.965] CloseHandle (hObject=0xf8) returned 1 [0077.966] CloseHandle (hObject=0xfc) returned 1 [0077.967] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json.dvodltmf")) returned 0 [0077.967] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json.dvodltmf")) returned 0x2020 [0077.967] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8359b7c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359ded0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0077.968] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8359b7c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359ded0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0077.968] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0077.968] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json")) returned 1 [0077.969] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json")) returned 0xffffffff [0077.969] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8359b7c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359ded0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0077.969] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0077.969] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835969a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a05e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0077.969] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835969a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a05e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0077.969] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835969a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a05e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0077.970] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835a05e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0077.970] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0077.970] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0077.970] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3fdc [0077.970] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0077.970] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0078.066] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3fdc, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x3fdc, lpOverlapped=0x0) returned 1 [0078.068] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3fe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x3fe0, lpOverlapped=0x0) returned 1 [0078.069] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0078.089] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.099] CloseHandle (hObject=0xfc) returned 1 [0078.099] CloseHandle (hObject=0xf8) returned 1 [0078.100] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\messages.json.dvodltmf")) returned 0 [0078.101] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\messages.json.dvodltmf")) returned 0x2020 [0078.101] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835a05e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0078.101] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835a05e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0078.101] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0078.101] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\messages.json")) returned 1 [0078.102] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\messages.json")) returned 0xffffffff [0078.102] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835a05e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0078.102] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0078.102] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835990b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a5400, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0078.102] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835990b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a5400, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0078.103] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835990b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a5400, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0078.103] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835a5400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0078.103] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0078.104] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0078.104] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3fdc [0078.104] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0078.104] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0078.190] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3fdc, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x3fdc, lpOverlapped=0x0) returned 1 [0078.192] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3fe0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x3fe0, lpOverlapped=0x0) returned 1 [0078.193] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0078.213] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.223] CloseHandle (hObject=0xf8) returned 1 [0078.223] CloseHandle (hObject=0xfc) returned 1 [0078.226] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\messages.json.dvodltmf")) returned 0 [0078.227] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\messages.json.dvodltmf")) returned 0x2020 [0078.227] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835a5400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0078.227] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835a5400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0078.227] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0078.227] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\messages.json")) returned 1 [0078.228] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\messages.json")) returned 0xffffffff [0078.228] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835a5400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0078.228] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0078.229] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835aa220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b1750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b1750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0078.229] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835aa220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b1750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b1750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0078.229] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835aa220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b1750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b1750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0078.229] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835b1750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b3e60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40db, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0078.229] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0078.229] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0078.230] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40db [0078.230] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0078.230] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0078.314] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x40db, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x40db, lpOverlapped=0x0) returned 1 [0078.323] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x40e0, lpOverlapped=0x0) returned 1 [0078.325] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0078.345] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.360] CloseHandle (hObject=0xfc) returned 1 [0078.360] CloseHandle (hObject=0xf8) returned 1 [0078.361] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json.dvodltmf")) returned 0 [0078.362] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json.dvodltmf")) returned 0x2020 [0078.362] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835b1750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b3e60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40db, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0078.362] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835b1750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b3e60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40db, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0078.362] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0078.362] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json")) returned 1 [0078.363] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json")) returned 0xffffffff [0078.363] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835b1750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b3e60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40db, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0078.363] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0078.363] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835b6570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b8c80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b8c80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0078.363] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835b6570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b8c80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b8c80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0078.364] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835b6570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b8c80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b8c80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0078.364] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835b8c80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835bb390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x490e, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0078.364] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0078.372] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0078.373] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x490e [0078.373] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0078.373] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0078.462] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x490e, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x490e, lpOverlapped=0x0) returned 1 [0078.467] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4910, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x4910, lpOverlapped=0x0) returned 1 [0078.468] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0078.487] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.497] CloseHandle (hObject=0xf8) returned 1 [0078.497] CloseHandle (hObject=0xfc) returned 1 [0078.499] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json.dvodltmf")) returned 0 [0078.499] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json.dvodltmf")) returned 0x2020 [0078.499] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835b8c80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835bb390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x490e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0078.499] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835b8c80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835bb390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x490e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0078.499] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0078.500] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json")) returned 1 [0078.501] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json")) returned 0xffffffff [0078.501] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835b8c80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835bb390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x490e, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0078.501] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0078.501] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c01b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c01b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0078.501] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c01b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c01b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0078.501] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c01b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c01b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0078.501] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c28c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40fd, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0078.501] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0078.502] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0078.502] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40fd [0078.502] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0078.502] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0078.587] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x40fd, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x40fd, lpOverlapped=0x0) returned 1 [0078.589] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x4100, lpOverlapped=0x0) returned 1 [0078.590] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0078.610] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.619] CloseHandle (hObject=0xfc) returned 1 [0078.620] CloseHandle (hObject=0xf8) returned 1 [0078.623] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json.dvodltmf")) returned 0 [0078.624] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json.dvodltmf")) returned 0x2020 [0078.624] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c28c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40fd, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0078.624] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c28c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40fd, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0078.624] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0078.624] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json")) returned 1 [0078.626] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json")) returned 0xffffffff [0078.626] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c28c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40fd, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0078.627] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0078.627] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c4fd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c9df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0078.627] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c4fd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c9df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0078.627] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c4fd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c9df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0078.627] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835c9df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x407a, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0078.627] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0078.628] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0078.628] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x407a [0078.628] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0078.629] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0078.713] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x407a, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x407a, lpOverlapped=0x0) returned 1 [0078.715] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4080, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x4080, lpOverlapped=0x0) returned 1 [0078.716] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0078.735] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.745] CloseHandle (hObject=0xf8) returned 1 [0078.745] CloseHandle (hObject=0xfc) returned 1 [0078.746] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json.dvodltmf")) returned 0 [0078.747] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json.dvodltmf")) returned 0x2020 [0078.747] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835c9df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x407a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0078.747] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835c9df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x407a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0078.747] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0078.747] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json")) returned 1 [0078.748] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json")) returned 0xffffffff [0078.748] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835c9df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x407a, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0078.748] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0078.749] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835cec10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835cec10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0078.749] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835cec10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835cec10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0078.749] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835cec10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835cec10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0078.749] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835d1320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x49c1, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0078.749] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0078.749] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0078.749] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x49c1 [0078.750] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0078.750] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0078.833] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x49c1, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x49c1, lpOverlapped=0x0) returned 1 [0078.834] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x49d0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x49d0, lpOverlapped=0x0) returned 1 [0078.835] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0078.854] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.864] CloseHandle (hObject=0xfc) returned 1 [0078.864] CloseHandle (hObject=0xf8) returned 1 [0078.865] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json.dvodltmf")) returned 0 [0078.865] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json.dvodltmf")) returned 0x2020 [0078.865] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835d1320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x49c1, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0078.865] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835d1320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x49c1, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0078.865] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0078.866] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json")) returned 1 [0078.867] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json")) returned 0xffffffff [0078.867] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835d1320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x49c1, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0078.867] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0078.867] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835daf60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dd670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0078.867] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835daf60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dd670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0078.867] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835daf60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dd670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0078.867] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e96, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0078.867] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0078.868] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0078.868] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e96 [0078.868] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0078.869] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0078.952] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3e96, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x3e96, lpOverlapped=0x0) returned 1 [0078.954] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3ea0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x3ea0, lpOverlapped=0x0) returned 1 [0078.955] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0078.975] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.985] CloseHandle (hObject=0xf8) returned 1 [0078.985] CloseHandle (hObject=0xfc) returned 1 [0078.986] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json.dvodltmf")) returned 0 [0078.986] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json.dvodltmf")) returned 0x2020 [0078.986] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e96, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0078.987] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e96, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0078.987] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0078.987] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json")) returned 1 [0078.988] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json")) returned 0xffffffff [0078.988] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e96, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0078.988] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0078.988] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dfd80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="sw", cAlternateFileName="")) returned 1 [0078.988] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dfd80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0078.988] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dfd80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0078.989] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835dfd80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e8b, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0078.989] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0078.989] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0078.989] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e8b [0078.989] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0078.989] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0079.084] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3e8b, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x3e8b, lpOverlapped=0x0) returned 1 [0079.086] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3e90, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x3e90, lpOverlapped=0x0) returned 1 [0079.088] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0079.108] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.117] CloseHandle (hObject=0xfc) returned 1 [0079.118] CloseHandle (hObject=0xf8) returned 1 [0079.119] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json.dvodltmf")) returned 0 [0079.120] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json.dvodltmf")) returned 0x2020 [0079.121] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835dfd80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e8b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0079.121] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835dfd80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e8b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0079.121] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0079.121] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json")) returned 1 [0079.122] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json")) returned 0xffffffff [0079.122] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835dfd80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e8b, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0079.122] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0079.122] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835e4ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835e72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="ta", cAlternateFileName="")) returned 1 [0079.123] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835e4ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835e72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0079.123] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835e4ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835e72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0079.123] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835e72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e99c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x563d, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0079.123] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0079.124] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0079.125] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x563d [0079.125] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0079.125] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0079.215] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x563d, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x563d, lpOverlapped=0x0) returned 1 [0079.217] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x5640, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x5640, lpOverlapped=0x0) returned 1 [0079.218] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0079.238] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.248] CloseHandle (hObject=0xf8) returned 1 [0079.248] CloseHandle (hObject=0xfc) returned 1 [0079.249] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json.dvodltmf")) returned 0 [0079.250] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json.dvodltmf")) returned 0x2020 [0079.250] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835e72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e99c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x563d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0079.250] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835e72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e99c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x563d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0079.250] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0079.250] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json")) returned 1 [0079.252] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json")) returned 0xffffffff [0079.252] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835e72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e99c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x563d, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0079.252] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0079.252] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835ec0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f0ef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="te", cAlternateFileName="")) returned 1 [0079.252] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835ec0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f0ef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0079.252] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835ec0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f0ef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0079.252] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835f0ef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5593, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0079.252] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0079.252] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0079.253] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5593 [0079.253] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0079.253] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0079.339] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x5593, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x5593, lpOverlapped=0x0) returned 1 [0079.352] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x55a0, lpOverlapped=0x0) returned 1 [0079.354] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0079.383] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.393] CloseHandle (hObject=0xfc) returned 1 [0079.393] CloseHandle (hObject=0xf8) returned 1 [0079.394] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json.dvodltmf")) returned 0 [0079.395] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json.dvodltmf")) returned 0x2020 [0079.395] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835f0ef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5593, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0079.395] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835f0ef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5593, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0079.395] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0079.395] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json")) returned 1 [0079.396] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json")) returned 0xffffffff [0079.396] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835f0ef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5593, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0079.396] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0079.397] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835f5d10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f8420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f8420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0079.397] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835f5d10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f8420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f8420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0079.397] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835f5d10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f8420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f8420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0079.397] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835f8420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835fab30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4f64, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0079.397] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0079.398] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0079.398] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4f64 [0079.398] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0079.399] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0079.487] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4f64, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x4f64, lpOverlapped=0x0) returned 1 [0079.489] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4f70, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x4f70, lpOverlapped=0x0) returned 1 [0079.490] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0079.510] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.520] CloseHandle (hObject=0xf8) returned 1 [0079.520] CloseHandle (hObject=0xfc) returned 1 [0079.521] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json.dvodltmf")) returned 0 [0079.522] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json.dvodltmf")) returned 0x2020 [0079.522] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835f8420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835fab30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4f64, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0079.522] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835f8420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835fab30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4f64, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0079.522] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0079.522] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json")) returned 1 [0079.523] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json")) returned 0xffffffff [0079.523] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835f8420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835fab30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4f64, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0079.523] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0079.524] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835fd240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835ff950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835ff950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0079.524] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835fd240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835ff950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835ff950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0079.524] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835fd240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835ff950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835ff950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0079.524] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835ff950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83602060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x404e, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0079.524] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0079.524] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0079.525] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x404e [0079.525] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0079.525] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0079.610] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x404e, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x404e, lpOverlapped=0x0) returned 1 [0079.611] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x4050, lpOverlapped=0x0) returned 1 [0079.613] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0079.634] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.644] CloseHandle (hObject=0xfc) returned 1 [0079.644] CloseHandle (hObject=0xf8) returned 1 [0079.645] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json.dvodltmf")) returned 0 [0079.645] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json.dvodltmf")) returned 0x2020 [0079.645] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835ff950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83602060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x404e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0079.646] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835ff950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83602060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x404e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0079.646] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0079.646] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json")) returned 1 [0079.647] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json")) returned 0xffffffff [0079.647] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835ff950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83602060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x404e, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0079.647] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0079.647] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8360bca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8360e3b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8360e3b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0079.647] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8360bca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8360e3b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8360e3b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0079.647] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8360bca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8360e3b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8360e3b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0079.648] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8360e3b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83610ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48f1, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0079.648] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0079.648] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0079.649] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x48f1 [0079.649] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0079.649] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0079.734] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x48f1, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x48f1, lpOverlapped=0x0) returned 1 [0079.737] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4900, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x4900, lpOverlapped=0x0) returned 1 [0079.738] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0079.759] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.768] CloseHandle (hObject=0xf8) returned 1 [0079.769] CloseHandle (hObject=0xfc) returned 1 [0079.770] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json.dvodltmf")) returned 0 [0079.770] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json.dvodltmf")) returned 0x2020 [0079.770] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8360e3b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83610ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48f1, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0079.770] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8360e3b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83610ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48f1, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0079.770] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0079.771] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json")) returned 1 [0079.772] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json")) returned 0xffffffff [0079.772] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8360e3b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83610ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48f1, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0079.772] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0079.772] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836158e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83617ff0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0079.772] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836158e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83617ff0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0079.772] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836158e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83617ff0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0079.782] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83617ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x426b, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0079.782] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0079.782] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0079.783] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x426b [0079.783] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0079.783] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0079.869] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x426b, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x426b, lpOverlapped=0x0) returned 1 [0079.871] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4270, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x4270, lpOverlapped=0x0) returned 1 [0079.872] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0079.892] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.901] CloseHandle (hObject=0xfc) returned 1 [0079.902] CloseHandle (hObject=0xf8) returned 1 [0079.903] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json.dvodltmf")) returned 0 [0079.903] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json.dvodltmf")) returned 0x2020 [0079.903] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83617ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x426b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0079.904] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83617ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x426b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0079.904] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0079.904] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json")) returned 1 [0079.905] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json")) returned 0xffffffff [0079.905] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83617ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x426b, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0079.905] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0079.907] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8361ce10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8361f520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="zh", cAlternateFileName="")) returned 1 [0079.907] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8361ce10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8361f520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0079.907] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8361ce10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8361f520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0079.907] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8361f520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8399a6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d11, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0079.907] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0079.908] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0079.908] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d11 [0079.908] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0079.908] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0079.993] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3d11, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x3d11, lpOverlapped=0x0) returned 1 [0079.995] WriteFile (in: hFile=0xfc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3d20, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x3d20, lpOverlapped=0x0) returned 1 [0079.996] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0080.016] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.032] CloseHandle (hObject=0xf8) returned 1 [0080.032] CloseHandle (hObject=0xfc) returned 1 [0080.033] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json.dvodltmf")) returned 0 [0080.034] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json.dvodltmf")) returned 0x2020 [0080.034] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8361f520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8399a6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d11, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0080.034] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8361f520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8399a6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d11, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0080.034] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0080.034] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json")) returned 1 [0080.035] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json")) returned 0xffffffff [0080.035] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8361f520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8399a6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d11, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0080.035] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0080.035] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83624340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8362b870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0080.035] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83624340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8362b870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0080.035] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83624340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8362b870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="..", cAlternateFileName="")) returned 1 [0080.036] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8362b870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8399a6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d72, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0080.036] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0080.036] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\messages.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0080.036] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d72 [0080.036] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0080.036] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0080.119] ReadFile (in: hFile=0xfc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3d72, lpNumberOfBytesRead=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18dd08*=0x3d72, lpOverlapped=0x0) returned 1 [0080.121] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x18dd08, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18dd08*=0x3d80, lpOverlapped=0x0) returned 1 [0080.122] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0080.141] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.150] CloseHandle (hObject=0xfc) returned 1 [0080.150] CloseHandle (hObject=0xf8) returned 1 [0080.151] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\messages.json.dvodltmf")) returned 0 [0080.152] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\messages.json.dvodltmf")) returned 0x2020 [0080.152] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json", lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8362b870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8399a6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d72, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x2e8518 [0080.152] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18dc04 | out: lpFindFileData=0x18dc04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8362b870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8399a6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d72, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0080.152] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0080.152] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\messages.json")) returned 1 [0080.153] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\messages.json")) returned 0xffffffff [0080.153] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8362b870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8399a6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d72, dwReserved0=0x2ded10, dwReserved1=0x18dd14, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0080.153] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0080.153] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83624340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8362b870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0080.154] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0080.154] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836ddc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839fe880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839fe880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0080.154] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836ddc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839fe880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839fe880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0080.154] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836ddc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839fe880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839fe880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.154] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x839fe880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839fe880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839fe880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7299, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 1 [0080.154] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0080.154] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0080.156] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7299 [0080.156] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0080.157] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0080.241] ReadFile (in: hFile=0x100, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x7299, lpNumberOfBytesRead=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18df70*=0x7299, lpOverlapped=0x0) returned 1 [0080.243] WriteFile (in: hFile=0xf8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x72a0, lpNumberOfBytesWritten=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18df70*=0x72a0, lpOverlapped=0x0) returned 1 [0080.244] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0080.268] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.278] CloseHandle (hObject=0x100) returned 1 [0080.278] CloseHandle (hObject=0xf8) returned 1 [0080.280] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json.dvodltmf")) returned 0 [0080.280] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json.dvodltmf")) returned 0x2020 [0080.280] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json", lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x839fe880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839fe880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839fe880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7299, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 0x2e84d8 [0080.280] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x839fe880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839fe880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839fe880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7299, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 0 [0080.280] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0080.281] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json")) returned 1 [0080.282] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json")) returned 0xffffffff [0080.282] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836e0310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3e39, dwReserved0=0x2ded10, dwReserved1=0x18df7c, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0080.282] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0080.282] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0080.282] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e39 [0080.282] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0080.283] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0080.382] ReadFile (in: hFile=0xf8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3e39, lpNumberOfBytesRead=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18df70*=0x3e39, lpOverlapped=0x0) returned 1 [0080.384] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3e40, lpNumberOfBytesWritten=0x18df70, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18df70*=0x3e40, lpOverlapped=0x0) returned 1 [0080.385] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0080.405] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.415] CloseHandle (hObject=0xf8) returned 1 [0080.415] CloseHandle (hObject=0x100) returned 1 [0080.416] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json.dvodltmf")) returned 0 [0080.417] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json.dvodltmf")) returned 0x2020 [0080.417] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json", lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836e0310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3e39, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0x2e84d8 [0080.417] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18de6c | out: lpFindFileData=0x18de6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836e0310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3e39, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0080.417] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0080.417] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json")) returned 1 [0080.418] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json")) returned 0xffffffff [0080.418] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836e0310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3e39, dwReserved0=0x2ded10, dwReserved1=0x18df7c, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0080.418] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0080.418] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836ddc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839fe880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839fe880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e1e4, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0080.418] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0080.419] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836e0310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64736e6f, dwReserved1=0x6a736a2e, cFileName="5817.313.0.5_0", cAlternateFileName="581731~1.5_0")) returned 0 [0080.419] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0080.419] FindNextFileA (in: hFindFile=0x2e0d60, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8399f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839a6a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839a6a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e6b4, cFileName="pkedcjkdefgpdelpbcmbmeomcjbeemfm", cAlternateFileName="PKEDCJ~1")) returned 0 [0080.419] FindClose (in: hFindFile=0x2e0d60 | out: hFindFile=0x2e0d60) returned 1 [0080.419] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80cce2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80cce2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80db2b00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x6c656470, dwReserved1=0x6d636270, cFileName="Favicons", cAlternateFileName="")) returned 1 [0080.419] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80cce2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80cce2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80e97340, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c656470, dwReserved1=0x6d636270, cFileName="Favicons-journal", cAlternateFileName="FAVICO~1")) returned 1 [0080.419] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81c321d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81c321d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81c58330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b2e9, dwReserved0=0x6c656470, dwReserved1=0x6d636270, cFileName="Google Profile.ico", cAlternateFileName="GOOGLE~1.ICO")) returned 1 [0080.419] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0080.420] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0080.420] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b2e9 [0080.420] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0080.420] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0080.510] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2b2e9, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x2b2e9, lpOverlapped=0x0) returned 1 [0080.514] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2b2f0, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x2b2f0, lpOverlapped=0x0) returned 1 [0080.518] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0080.537] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.547] CloseHandle (hObject=0xf0) returned 1 [0080.547] CloseHandle (hObject=0xe8) returned 1 [0080.550] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico.dvodltmf")) returned 0 [0080.550] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico.dvodltmf")) returned 0x2020 [0080.550] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81c321d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81c321d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81c58330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b2e9, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Google Profile.ico", cAlternateFileName="GOOGLE~1.ICO")) returned 0x2e8418 [0080.550] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81c321d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81c321d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81c58330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b2e9, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Google Profile.ico", cAlternateFileName="GOOGLE~1.ICO")) returned 0 [0080.550] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0080.551] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico")) returned 1 [0080.553] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico")) returned 0xffffffff [0080.553] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802fc800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802fc800, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87f47590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19000, dwReserved0=0x2ded10, dwReserved1=0x18e91c, cFileName="History", cAlternateFileName="")) returned 1 [0080.553] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824d3190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824d3190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c3b6860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x142f, dwReserved0=0x2ded10, dwReserved1=0x18e91c, cFileName="History Provider Cache", cAlternateFileName="HISTOR~2")) returned 1 [0080.553] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802fc800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802fc800, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87f6d6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e91c, cFileName="History-journal", cAlternateFileName="HISTOR~1")) returned 1 [0080.553] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e91c, cFileName="JumpListIcons", cAlternateFileName="JUMPLI~2")) returned 1 [0080.553] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0080.554] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.554] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbc, dwReserved1=0x0, cFileName="A058.tmp", cAlternateFileName="")) returned 1 [0080.554] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\a058.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0080.554] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\a058.tmp.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0080.554] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0080.554] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0080.555] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0080.642] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x10, lpOverlapped=0x0) returned 1 [0080.643] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0080.662] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.672] CloseHandle (hObject=0xf0) returned 1 [0080.672] CloseHandle (hObject=0xe4) returned 1 [0080.673] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\a058.tmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\a058.tmp.dvodltmf")) returned 0 [0080.674] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\a058.tmp.dvodltmf")) returned 0x2020 [0080.674] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="A058.tmp", cAlternateFileName="")) returned 0x2e8458 [0080.674] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="A058.tmp", cAlternateFileName="")) returned 0 [0080.674] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0080.674] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\a058.tmp")) returned 1 [0080.674] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\a058.tmp")) returned 0xffffffff [0080.674] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e6b4, cFileName="A059.tmp", cAlternateFileName="")) returned 1 [0080.674] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\a059.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0080.675] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\a059.tmp.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0080.676] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0080.677] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0080.677] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0080.764] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x10, lpOverlapped=0x0) returned 1 [0080.765] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0080.785] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.794] CloseHandle (hObject=0xe4) returned 1 [0080.794] CloseHandle (hObject=0xf0) returned 1 [0080.794] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\a059.tmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\a059.tmp.dvodltmf")) returned 0 [0080.795] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\a059.tmp.dvodltmf")) returned 0x2020 [0080.795] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="A059.tmp", cAlternateFileName="")) returned 0x2e8458 [0080.795] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="A059.tmp", cAlternateFileName="")) returned 0 [0080.795] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0080.795] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\a059.tmp")) returned 1 [0080.795] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\a059.tmp")) returned 0xffffffff [0080.796] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e6b4, cFileName="A059.tmp", cAlternateFileName="")) returned 0 [0080.796] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0080.796] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e91c, cFileName="JumpListIconsOld", cAlternateFileName="JUMPLI~1")) returned 1 [0080.796] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e6b4, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0080.796] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e6b4, cFileName="..", cAlternateFileName="")) returned 1 [0080.796] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e6b4, cFileName="2B03.tmp", cAlternateFileName="")) returned 1 [0080.796] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\2b03.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0080.797] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\2b03.tmp.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0080.797] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0080.797] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0080.798] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0080.883] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x10, lpOverlapped=0x0) returned 1 [0080.883] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0080.905] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.914] CloseHandle (hObject=0xf0) returned 1 [0080.914] CloseHandle (hObject=0xe4) returned 1 [0080.914] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\2b03.tmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\2b03.tmp.dvodltmf")) returned 0 [0080.915] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\2b03.tmp.dvodltmf")) returned 0x2020 [0080.915] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="2B03.tmp", cAlternateFileName="")) returned 0x2e8458 [0080.915] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="2B03.tmp", cAlternateFileName="")) returned 0 [0080.915] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0080.915] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\2b03.tmp")) returned 1 [0080.915] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\2b03.tmp")) returned 0xffffffff [0080.915] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e6b4, cFileName="2B04.tmp", cAlternateFileName="")) returned 1 [0080.915] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\2b04.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0080.916] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\2b04.tmp.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0080.918] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0080.918] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0080.918] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0081.004] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x10, lpOverlapped=0x0) returned 1 [0081.005] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0081.025] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.034] CloseHandle (hObject=0xe4) returned 1 [0081.034] CloseHandle (hObject=0xf0) returned 1 [0081.034] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\2b04.tmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\2b04.tmp.dvodltmf")) returned 0 [0081.035] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\2b04.tmp.dvodltmf")) returned 0x2020 [0081.035] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="2B04.tmp", cAlternateFileName="")) returned 0x2e8458 [0081.035] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="2B04.tmp", cAlternateFileName="")) returned 0 [0081.035] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0081.035] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\2b04.tmp")) returned 1 [0081.036] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\2b04.tmp")) returned 0xffffffff [0081.036] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e6b4, cFileName="2B04.tmp", cAlternateFileName="")) returned 0 [0081.036] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0081.036] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e91c, cFileName="Local Extension Settings", cAlternateFileName="LOCALE~1")) returned 1 [0081.036] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e6b4, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0081.036] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e6b4, cFileName="..", cAlternateFileName="")) returned 1 [0081.036] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86513570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86513570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e6b4, cFileName="ghbmnnjooekpmoecnnnilnnbdlolhkhi", cAlternateFileName="GHBMNN~1")) returned 1 [0081.036] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86513570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86513570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xca, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0081.038] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86513570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86513570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xca, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.038] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86513570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86513570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86513570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xca, dwReserved1=0x0, cFileName="000003.log", cAlternateFileName="")) returned 1 [0081.038] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0081.038] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0081.039] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0081.039] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0081.039] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0081.125] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x10, lpOverlapped=0x0) returned 1 [0081.126] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0081.148] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.157] CloseHandle (hObject=0xe4) returned 1 [0081.157] CloseHandle (hObject=0xf4) returned 1 [0081.157] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log.dvodltmf")) returned 0 [0081.158] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log.dvodltmf")) returned 0x2020 [0081.158] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86513570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86513570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86513570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="000003.log", cAlternateFileName="")) returned 0x2e8498 [0081.158] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86513570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86513570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86513570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="000003.log", cAlternateFileName="")) returned 0 [0081.158] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0081.158] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log")) returned 1 [0081.159] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log")) returned 0xffffffff [0081.159] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x2ded10, dwReserved1=0x18e44c, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0081.159] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e44c, cFileName="LOCK", cAlternateFileName="")) returned 1 [0081.159] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97256fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x2ded10, dwReserved1=0x18e44c, cFileName="LOG", cAlternateFileName="")) returned 1 [0081.159] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x2ded10, dwReserved1=0x18e44c, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 1 [0081.159] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x2ded10, dwReserved1=0x18e44c, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0 [0081.159] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0081.159] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86513570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86513570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e6b4, cFileName="ghbmnnjooekpmoecnnnilnnbdlolhkhi", cAlternateFileName="GHBMNN~1")) returned 0 [0081.159] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0081.159] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83ede170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x90191d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656f6d70, dwReserved1=0x6e6e6e63, cFileName="Local Storage", cAlternateFileName="LOCALS~1")) returned 1 [0081.159] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83ede170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x90191d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31303030, dwReserved1=0x18e6b4, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0081.161] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83ede170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x90191d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31303030, dwReserved1=0x18e6b4, cFileName="..", cAlternateFileName="")) returned 1 [0081.161] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90191d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9048b8f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x31303030, dwReserved1=0x18e6b4, cFileName="chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage", cAlternateFileName="CHROME~1.LOC")) returned 1 [0081.162] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0081.162] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0081.162] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3000 [0081.162] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0081.163] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0081.249] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x3000, lpOverlapped=0x0) returned 1 [0081.251] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x3010, lpOverlapped=0x0) returned 1 [0081.252] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0081.272] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.281] CloseHandle (hObject=0xf0) returned 1 [0081.282] CloseHandle (hObject=0xf4) returned 1 [0081.282] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage.dvodltmf")) returned 0 [0081.282] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage.dvodltmf")) returned 0x2020 [0081.282] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90191d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9048b8f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage", cAlternateFileName="CHROME~1.LOC")) returned 0x2e8458 [0081.282] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90191d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9048b8f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage", cAlternateFileName="CHROME~1.LOC")) returned 0 [0081.282] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0081.283] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage")) returned 1 [0081.283] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage")) returned 0xffffffff [0081.284] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90191d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x904b1a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e6b4, cFileName="chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal", cAlternateFileName="CHROME~2.LOC")) returned 1 [0081.284] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0081.284] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0081.284] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0081.284] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0081.285] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0081.376] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x10, lpOverlapped=0x0) returned 1 [0081.377] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0081.411] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.420] CloseHandle (hObject=0xf4) returned 1 [0081.421] CloseHandle (hObject=0xf0) returned 1 [0081.421] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal.dvodltmf")) returned 0 [0081.421] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal.dvodltmf")) returned 0x2020 [0081.421] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90191d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x904b1a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal", cAlternateFileName="CHROME~2.LOC")) returned 0x2e8458 [0081.422] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90191d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x904b1a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal", cAlternateFileName="CHROME~2.LOC")) returned 0 [0081.422] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0081.422] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal")) returned 1 [0081.422] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal")) returned 0xffffffff [0081.422] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90191d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x904b1a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e6b4, cFileName="chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal", cAlternateFileName="CHROME~2.LOC")) returned 0 [0081.422] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0081.422] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80fc7e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80fc7e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8124f5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x6f69736e, dwReserved1=0x6b705f6e, cFileName="Login Data", cAlternateFileName="LOGIND~1")) returned 1 [0081.422] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80fc7e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80fc7e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8129b860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f69736e, dwReserved1=0x6b705f6e, cFileName="Login Data-journal", cAlternateFileName="LOGIND~2")) returned 1 [0081.422] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82330270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82330270, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x825f0410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x6f69736e, dwReserved1=0x6b705f6e, cFileName="Network Action Predictor", cAlternateFileName="NETWOR~1")) returned 1 [0081.422] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82330270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82330270, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8262ad90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f69736e, dwReserved1=0x6b705f6e, cFileName="Network Action Predictor-journal", cAlternateFileName="NETWOR~2")) returned 1 [0081.422] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86263d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86263d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86263d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x6f69736e, dwReserved1=0x6b705f6e, cFileName="Network Persistent State", cAlternateFileName="NETWOR~3")) returned 1 [0081.422] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81d16a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81d16a10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x94034050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x6f69736e, dwReserved1=0x6b705f6e, cFileName="Origin Bound Certs", cAlternateFileName="ORIGIN~1")) returned 1 [0081.422] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81d16a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81d16a10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9405a1b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f69736e, dwReserved1=0x6b705f6e, cFileName="Origin Bound Certs-journal", cAlternateFileName="ORIGIN~2")) returned 1 [0081.422] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c43f3e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c446910, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9d, dwReserved0=0x6f69736e, dwReserved1=0x6b705f6e, cFileName="Preferences", cAlternateFileName="PREFER~1")) returned 1 [0081.422] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f8dea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f8dea80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8129b860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x6f69736e, dwReserved1=0x6b705f6e, cFileName="previews_opt_out.db", cAlternateFileName="PREVIE~1.DB")) returned 1 [0081.422] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0081.423] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0081.423] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4000 [0081.423] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0081.423] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0081.513] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x4000, lpOverlapped=0x0) returned 1 [0081.516] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x4010, lpOverlapped=0x0) returned 1 [0081.517] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0081.537] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.546] CloseHandle (hObject=0xe8) returned 1 [0081.546] CloseHandle (hObject=0xf0) returned 1 [0081.546] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db.dvodltmf")) returned 0 [0081.547] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db.dvodltmf")) returned 0x2020 [0081.547] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f8dea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f8dea80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8129b860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="previews_opt_out.db", cAlternateFileName="PREVIE~1.DB")) returned 0x2e8418 [0081.547] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f8dea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f8dea80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8129b860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="previews_opt_out.db", cAlternateFileName="PREVIE~1.DB")) returned 0 [0081.547] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0081.547] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db")) returned 1 [0081.548] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db")) returned 0xffffffff [0081.548] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x804795c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x804795c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x812c19c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e91c, cFileName="previews_opt_out.db-journal", cAlternateFileName="PREVIE~1.DB-")) returned 1 [0081.548] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0081.549] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db-journal.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0081.549] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0081.549] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0081.549] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0081.637] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x10, lpOverlapped=0x0) returned 1 [0081.638] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0081.657] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.667] CloseHandle (hObject=0xf0) returned 1 [0081.667] CloseHandle (hObject=0xe8) returned 1 [0081.667] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db-journal"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db-journal.dvodltmf")) returned 0 [0081.667] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db-journal.dvodltmf")) returned 0x2020 [0081.667] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x804795c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x804795c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x812c19c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="previews_opt_out.db-journal", cAlternateFileName="PREVIE~1.DB-")) returned 0x2e8418 [0081.668] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x804795c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x804795c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x812c19c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="previews_opt_out.db-journal", cAlternateFileName="PREVIE~1.DB-")) returned 0 [0081.668] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0081.668] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db-journal")) returned 1 [0081.668] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db-journal")) returned 0xffffffff [0081.668] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8687f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x869fc2d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x2ded10, dwReserved1=0x18e91c, cFileName="QuotaManager", cAlternateFileName="QUOTAM~1")) returned 1 [0081.668] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8687f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e91c, cFileName="QuotaManager-journal", cAlternateFileName="QUOTAM~2")) returned 1 [0081.669] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f846500, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f846500, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x2ded10, dwReserved1=0x18e91c, cFileName="README", cAlternateFileName="")) returned 1 [0081.669] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857e1690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c3f38f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c404a60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8b43, dwReserved0=0x2ded10, dwReserved1=0x18e91c, cFileName="Secure Preferences", cAlternateFileName="SECURE~1")) returned 1 [0081.669] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8218d350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8218d350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82271b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x2ded10, dwReserved1=0x18e91c, cFileName="Shortcuts", cAlternateFileName="SHORTC~1")) returned 1 [0081.669] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8218d350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8218d350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x822e3fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e91c, cFileName="Shortcuts-journal", cAlternateFileName="SHORTC~2")) returned 1 [0081.669] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84251e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84251e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e91c, cFileName="Sync Extension Settings", cAlternateFileName="SYNCEX~1")) returned 1 [0081.669] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84251e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84251e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xce, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0081.669] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84251e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84251e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xce, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.669] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8448d2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8448d2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xce, dwReserved1=0x0, cFileName="pkedcjkdefgpdelpbcmbmeomcjbeemfm", cAlternateFileName="PKEDCJ~1")) returned 1 [0081.669] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8448d2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8448d2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75006f, dwReserved1=0x2e0074, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0081.671] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8448d2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8448d2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75006f, dwReserved1=0x2e0074, cFileName="..", cAlternateFileName="")) returned 1 [0081.671] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8448d2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8448d2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8448d2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75006f, dwReserved1=0x2e0074, cFileName="000003.log", cAlternateFileName="")) returned 1 [0081.671] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0081.671] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0081.672] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0081.672] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0081.672] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0081.759] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x10, lpOverlapped=0x0) returned 1 [0081.760] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0081.780] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.817] CloseHandle (hObject=0xf4) returned 1 [0081.818] CloseHandle (hObject=0xe4) returned 1 [0081.818] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log.dvodltmf")) returned 0 [0081.818] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log.dvodltmf")) returned 0x2020 [0081.818] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8448d2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8448d2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8448d2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="000003.log", cAlternateFileName="")) returned 0x2e8498 [0081.818] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8448d2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8448d2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8448d2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="000003.log", cAlternateFileName="")) returned 0 [0081.819] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0081.819] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log")) returned 1 [0081.819] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log")) returned 0xffffffff [0081.819] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84254520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x2ded10, dwReserved1=0x18e44c, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0081.819] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84254520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e44c, cFileName="LOCK", cAlternateFileName="")) returned 1 [0081.819] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x93935fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc3, dwReserved0=0x2ded10, dwReserved1=0x18e44c, cFileName="LOG", cAlternateFileName="")) returned 1 [0081.819] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84254520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x2ded10, dwReserved1=0x18e44c, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 1 [0081.819] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84254520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x2ded10, dwReserved1=0x18e44c, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0 [0081.819] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0081.819] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8448d2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8448d2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xce, dwReserved1=0x0, cFileName="pkedcjkdefgpdelpbcmbmeomcjbeemfm", cAlternateFileName="PKEDCJ~1")) returned 0 [0081.819] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0081.819] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d66840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d66840, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8195e7b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x6c656470, dwReserved1=0x6d636270, cFileName="Top Sites", cAlternateFileName="TOPSIT~1")) returned 1 [0081.819] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d8c9a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d8c9a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81984910, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c656470, dwReserved1=0x6d636270, cFileName="Top Sites-journal", cAlternateFileName="TOPSIT~2")) returned 1 [0081.819] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x88c2e920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x88c2e920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x88c2e920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x278, dwReserved0=0x6c656470, dwReserved1=0x6d636270, cFileName="TransportSecurity", cAlternateFileName="TRANSP~1")) returned 1 [0081.819] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80ee3600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80ee3600, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8c6cde50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x6c656470, dwReserved1=0x6d636270, cFileName="Visited Links", cAlternateFileName="VISITE~1")) returned 1 [0081.819] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x868593b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x868593b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c656470, dwReserved1=0x6d636270, cFileName="Web Applications", cAlternateFileName="WEBAPP~1")) returned 1 [0081.819] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x868593b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x868593b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31303030, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0081.820] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x868593b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x868593b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31303030, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.820] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86989eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86989eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31303030, dwReserved1=0x0, cFileName="_crx_aohghmighlieiainnegkcijnfilokake", cAlternateFileName="_CRX_A~1")) returned 1 [0081.820] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86989eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86989eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e44c, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0081.820] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86989eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86989eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ded10, dwReserved1=0x18e44c, cFileName="..", cAlternateFileName="")) returned 1 [0081.820] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8687f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8687f510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28df6, dwReserved0=0x2ded10, dwReserved1=0x18e44c, cFileName="Google Docs.ico", cAlternateFileName="GOOGLE~1.ICO")) returned 1 [0081.820] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0081.820] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0081.822] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x28df6 [0081.822] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0081.822] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0081.913] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x28df6, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x28df6, lpOverlapped=0x0) returned 1 [0081.917] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x28e00, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x28e00, lpOverlapped=0x0) returned 1 [0081.920] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0081.940] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.950] CloseHandle (hObject=0xe4) returned 1 [0081.950] CloseHandle (hObject=0xf4) returned 1 [0081.950] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico.dvodltmf")) returned 0 [0081.950] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico.dvodltmf")) returned 0x2020 [0081.951] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8687f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8687f510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28df6, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Google Docs.ico", cAlternateFileName="GOOGLE~1.ICO")) returned 0x2e8498 [0081.951] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8687f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8687f510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28df6, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Google Docs.ico", cAlternateFileName="GOOGLE~1.ICO")) returned 0 [0081.951] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0081.951] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico")) returned 1 [0081.953] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico")) returned 0xffffffff [0081.953] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86989eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86989eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x2ded10, dwReserved1=0x18e44c, cFileName="Google Docs.ico.md5", cAlternateFileName="GOOGLE~1.MD5")) returned 1 [0081.953] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico.md5"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0081.953] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico.md5.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0081.953] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10 [0081.953] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0081.954] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0082.039] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x10, lpOverlapped=0x0) returned 1 [0082.040] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x20, lpOverlapped=0x0) returned 1 [0082.041] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0082.061] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.071] CloseHandle (hObject=0xf4) returned 1 [0082.071] CloseHandle (hObject=0xe4) returned 1 [0082.071] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico.md5"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico.md5.dvodltmf")) returned 0 [0082.071] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico.md5.dvodltmf")) returned 0x2020 [0082.071] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86989eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86989eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Google Docs.ico.md5", cAlternateFileName="GOOGLE~1.MD5")) returned 0x2e8498 [0082.072] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86989eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86989eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Google Docs.ico.md5", cAlternateFileName="GOOGLE~1.MD5")) returned 0 [0082.072] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0082.072] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico.md5")) returned 1 [0082.073] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico.md5")) returned 0xffffffff [0082.073] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86989eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86989eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x2ded10, dwReserved1=0x18e44c, cFileName="Google Docs.ico.md5", cAlternateFileName="GOOGLE~1.MD5")) returned 0 [0082.073] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0082.073] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86989eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86989eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31303030, dwReserved1=0x0, cFileName="_crx_aohghmighlieiainnegkcijnfilokake", cAlternateFileName="_CRX_A~1")) returned 0 [0082.073] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0082.073] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f86c660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f86c660, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82d370c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName="Web Data", cAlternateFileName="WEBDAT~1")) returned 1 [0082.073] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f86c660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f86c660, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82d608d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName="Web Data-journal", cAlternateFileName="WEBDAT~2")) returned 1 [0082.073] FindNextFileA (in: hFindFile=0x2e0d20, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f86c660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f86c660, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82d608d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName="Web Data-journal", cAlternateFileName="WEBDAT~2")) returned 0 [0082.073] FindClose (in: hFindFile=0x2e0d20 | out: hFindFile=0x2e0d20) returned 1 [0082.073] FindNextFileA (in: hFindFile=0x2decd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x616e7275, dwReserved1=0x7474796c, cFileName="EVWhitelist", cAlternateFileName="EVWHIT~1")) returned 1 [0082.073] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0082.074] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName="..", cAlternateFileName="")) returned 1 [0082.074] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName="..", cAlternateFileName="")) returned 0 [0082.074] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0082.074] FindNextFileA (in: hFindFile=0x2decd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x616e7275, dwReserved1=0x7474796c, cFileName="FileTypePolicies", cAlternateFileName="FILETY~1")) returned 1 [0082.074] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0082.074] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName="..", cAlternateFileName="")) returned 1 [0082.074] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName="..", cAlternateFileName="")) returned 0 [0082.074] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0082.074] FindNextFileA (in: hFindFile=0x2decd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f8b8920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f8b8920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f8b8920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x616e7275, dwReserved1=0x7474796c, cFileName="First Run", cAlternateFileName="FIRSTR~1")) returned 1 [0082.074] FindNextFileA (in: hFindFile=0x2decd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85749110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c0bcce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0bf3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1082a, dwReserved0=0x616e7275, dwReserved1=0x7474796c, cFileName="Local State", cAlternateFileName="LOCALS~1")) returned 1 [0082.075] FindNextFileA (in: hFindFile=0x2decd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x616e7275, dwReserved1=0x7474796c, cFileName="OriginTrials", cAlternateFileName="ORIGIN~1")) returned 1 [0082.075] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0082.075] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName="..", cAlternateFileName="")) returned 1 [0082.075] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName="..", cAlternateFileName="")) returned 0 [0082.075] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0082.075] FindNextFileA (in: hFindFile=0x2decd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x616e7275, dwReserved1=0x7474796c, cFileName="PepperFlash", cAlternateFileName="PEPPER~1")) returned 1 [0082.075] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0082.075] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName="..", cAlternateFileName="")) returned 1 [0082.075] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName="..", cAlternateFileName="")) returned 0 [0082.075] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0082.075] FindNextFileA (in: hFindFile=0x2decd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x616e7275, dwReserved1=0x7474796c, cFileName="pnacl", cAlternateFileName="")) returned 1 [0082.075] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0082.075] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName="..", cAlternateFileName="")) returned 1 [0082.076] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName="..", cAlternateFileName="")) returned 0 [0082.076] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0082.076] FindNextFileA (in: hFindFile=0x2decd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f6e8b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x616e7275, dwReserved1=0x7474796c, cFileName="Safe Browsing Channel IDs", cAlternateFileName="SAFEBR~3")) returned 1 [0082.076] FindNextFileA (in: hFindFile=0x2decd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f94a10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x616e7275, dwReserved1=0x7474796c, cFileName="Safe Browsing Channel IDs-journal", cAlternateFileName="SAFEBR~4")) returned 1 [0082.076] FindNextFileA (in: hFindFile=0x2decd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8582d950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8582d950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x616e7275, dwReserved1=0x7474796c, cFileName="Safe Browsing Cookies", cAlternateFileName="SAFEBR~1")) returned 1 [0082.076] FindNextFileA (in: hFindFile=0x2decd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8582d950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8582d950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x616e7275, dwReserved1=0x7474796c, cFileName="Safe Browsing Cookies-journal", cAlternateFileName="SAFEBR~2")) returned 1 [0082.076] FindNextFileA (in: hFindFile=0x2decd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x616e7275, dwReserved1=0x7474796c, cFileName="SSLErrorAssistant", cAlternateFileName="SSLERR~1")) returned 1 [0082.076] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0082.076] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName="..", cAlternateFileName="")) returned 1 [0082.076] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName="..", cAlternateFileName="")) returned 0 [0082.077] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0082.077] FindNextFileA (in: hFindFile=0x2decd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x616e7275, dwReserved1=0x7474796c, cFileName="SwReporter", cAlternateFileName="SWREPO~1")) returned 1 [0082.077] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0082.077] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName="..", cAlternateFileName="")) returned 1 [0082.077] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName="..", cAlternateFileName="")) returned 0 [0082.077] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0082.077] FindNextFileA (in: hFindFile=0x2decd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x616e7275, dwReserved1=0x7474796c, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 1 [0082.077] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0082.077] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName="..", cAlternateFileName="")) returned 1 [0082.077] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName="..", cAlternateFileName="")) returned 0 [0082.077] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0082.077] FindNextFileA (in: hFindFile=0x2decd8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x616e7275, dwReserved1=0x7474796c, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 0 [0082.077] FindClose (in: hFindFile=0x2decd8 | out: hFindFile=0x2decd8) returned 1 [0082.077] FindNextFileA (in: hFindFile=0x2ddc90, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x310056, dwReserved1=0x44002e, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 0 [0082.077] FindClose (in: hFindFile=0x2ddc90 | out: hFindFile=0x2ddc90) returned 1 [0082.078] FindNextFileA (in: hFindFile=0x2dcbe0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 1 [0082.078] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61747369, dwReserved1=0x696b746e, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0082.078] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61747369, dwReserved1=0x696b746e, cFileName="..", cAlternateFileName="")) returned 1 [0082.078] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61747369, dwReserved1=0x696b746e, cFileName="..", cAlternateFileName="")) returned 0 [0082.078] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0082.078] FindNextFileA (in: hFindFile=0x2dcbe0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 0 [0082.078] FindClose (in: hFindFile=0x2dcbe0 | out: hFindFile=0x2dcbe0) returned 1 [0082.078] FindNextFileA (in: hFindFile=0x2dcc48, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18f2bc, cFileName="History", cAlternateFileName="")) returned 1 [0082.078] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="HÌ-")) returned 0xffffffff [0082.079] FindNextFileA (in: hFindFile=0x2dcc48, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9fc540, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x126775, dwReserved0=0xa0000003, dwReserved1=0x18f2bc, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1 [0082.079] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\iconcache.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0082.079] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\iconcache.db.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0082.080] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x126775 [0082.080] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0082.080] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0082.165] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x126775, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x126775, lpOverlapped=0x0) returned 1 [0082.193] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x126780, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x126780, lpOverlapped=0x0) returned 1 [0082.218] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0082.238] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.248] CloseHandle (hObject=0xdc) returned 1 [0082.248] CloseHandle (hObject=0xd8) returned 1 [0082.248] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\iconcache.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\iconcache.db.dvodltmf")) returned 0 [0082.248] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\iconcache.db.dvodltmf")) returned 0x2020 [0082.249] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9fc540, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x126775, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 0x2e8418 [0082.249] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9fc540, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x126775, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 0 [0082.249] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0082.249] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\iconcache.db")) returned 1 [0082.251] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\iconcache.db")) returned 0xffffffff [0082.251] FindNextFileA (in: hFindFile=0x2dcc48, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0082.251] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0082.251] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.251] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0082.251] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61747369, dwReserved1=0x696b746e, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0082.251] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61747369, dwReserved1=0x696b746e, cFileName="..", cAlternateFileName="")) returned 1 [0082.251] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61747369, dwReserved1=0x696b746e, cFileName="..", cAlternateFileName="")) returned 0 [0082.251] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0082.251] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1 [0082.251] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61747369, dwReserved1=0x696b746e, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0082.257] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61747369, dwReserved1=0x696b746e, cFileName="..", cAlternateFileName="")) returned 1 [0082.257] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61747369, dwReserved1=0x696b746e, cFileName="..", cAlternateFileName="")) returned 0 [0082.257] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0082.257] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70, dwReserved1=0x0, cFileName="Feeds", cAlternateFileName="")) returned 1 [0082.257] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61747369, dwReserved1=0x696b746e, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0082.261] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61747369, dwReserved1=0x696b746e, cFileName="..", cAlternateFileName="")) returned 1 [0082.261] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x6e0227e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x61747369, dwReserved1=0x696b746e, cFileName="FeedsStore.feedsdb-ms", cAlternateFileName="FEEDSS~1.FEE")) returned 1 [0082.261] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0082.261] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0082.262] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a00 [0082.262] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0082.262] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0082.350] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x1a00, lpOverlapped=0x0) returned 1 [0082.351] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1a10, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x1a10, lpOverlapped=0x0) returned 1 [0082.352] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0082.377] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.387] CloseHandle (hObject=0xec) returned 1 [0082.387] CloseHandle (hObject=0xe0) returned 1 [0082.387] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms.dvodltmf")) returned 0 [0082.388] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms.dvodltmf")) returned 0x2020 [0082.388] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x6e0227e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="FeedsStore.feedsdb-ms", cAlternateFileName="FEEDSS~1.FEE")) returned 0x2e8498 [0082.388] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x6e0227e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="FeedsStore.feedsdb-ms", cAlternateFileName="FEEDSS~1.FEE")) returned 0 [0082.388] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0082.388] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms")) returned 1 [0082.389] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms")) returned 0xffffffff [0082.389] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e73f0, dwReserved1=0x18edec, cFileName="Microsoft Feeds~", cAlternateFileName="MICROS~1")) returned 1 [0082.389] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0082.399] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.399] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfeaa2466, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa2, dwReserved1=0x0, cFileName="Microsoft at Home~.feed-ms", cAlternateFileName="MICROS~2.FEE")) returned 1 [0082.399] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0082.399] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0082.400] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7000 [0082.400] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0082.400] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0082.491] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x7000, lpOverlapped=0x0) returned 1 [0082.496] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x7010, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x7010, lpOverlapped=0x0) returned 1 [0082.497] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0082.517] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.526] CloseHandle (hObject=0xec) returned 1 [0082.526] CloseHandle (hObject=0xe8) returned 1 [0082.526] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms.dvodltmf")) returned 0 [0082.527] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms.dvodltmf")) returned 0x2020 [0082.527] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfeaa2466, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Microsoft at Home~.feed-ms", cAlternateFileName="MICROS~2.FEE")) returned 0x2e84d8 [0082.527] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfeaa2466, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Microsoft at Home~.feed-ms", cAlternateFileName="MICROS~2.FEE")) returned 0 [0082.527] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0082.527] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms")) returned 1 [0082.528] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms")) returned 0xffffffff [0082.528] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x2ddc88, dwReserved1=0x18eb84, cFileName="Microsoft at Work~.feed-ms", cAlternateFileName="MICROS~1.FEE")) returned 1 [0082.528] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0082.529] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0082.529] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7000 [0082.529] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0082.529] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0082.612] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x7000, lpOverlapped=0x0) returned 1 [0082.614] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x7010, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x7010, lpOverlapped=0x0) returned 1 [0082.616] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0082.637] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.647] CloseHandle (hObject=0xe8) returned 1 [0082.647] CloseHandle (hObject=0xec) returned 1 [0082.647] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms.dvodltmf")) returned 0 [0082.647] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms.dvodltmf")) returned 0x2020 [0082.647] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Microsoft at Work~.feed-ms", cAlternateFileName="MICROS~1.FEE")) returned 0x2e84d8 [0082.648] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Microsoft at Work~.feed-ms", cAlternateFileName="MICROS~1.FEE")) returned 0 [0082.648] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0082.648] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms")) returned 1 [0082.649] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms")) returned 0xffffffff [0082.649] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x2ddc88, dwReserved1=0x18eb84, cFileName="MSNBC News~.feed-ms", cAlternateFileName="MSNBCN~1.FEE")) returned 1 [0082.649] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0082.649] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0082.649] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7000 [0082.649] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0082.650] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0082.738] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x7000, lpOverlapped=0x0) returned 1 [0082.740] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x7010, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x7010, lpOverlapped=0x0) returned 1 [0082.741] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0082.762] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.771] CloseHandle (hObject=0xec) returned 1 [0082.771] CloseHandle (hObject=0xe8) returned 1 [0082.772] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms.dvodltmf")) returned 0 [0082.772] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms.dvodltmf")) returned 0x2020 [0082.772] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="MSNBC News~.feed-ms", cAlternateFileName="MSNBCN~1.FEE")) returned 0x2e84d8 [0082.772] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="MSNBC News~.feed-ms", cAlternateFileName="MSNBCN~1.FEE")) returned 0 [0082.772] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0082.772] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms")) returned 1 [0082.774] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms")) returned 0xffffffff [0082.774] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x2ddc88, dwReserved1=0x18eb84, cFileName="MSNBC News~.feed-ms", cAlternateFileName="MSNBCN~1.FEE")) returned 0 [0082.774] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0082.774] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 1 [0082.774] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ddc88, dwReserved1=0x18eb84, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0082.774] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ddc88, dwReserved1=0x18eb84, cFileName="..", cAlternateFileName="")) returned 1 [0082.774] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d69eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ddc88, dwReserved1=0x18eb84, cFileName="WebSlices~", cAlternateFileName="WEBSLI~1")) returned 1 [0082.774] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d69eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0082.774] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d69eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.774] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52d69eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6e0227e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0xc0, dwReserved1=0x0, cFileName="Suggested Sites~.feed-ms", cAlternateFileName="SUGGES~1.FEE")) returned 1 [0082.774] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\suggested sites~.feed-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0082.775] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\suggested sites~.feed-ms.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0082.777] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8000 [0082.777] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0082.777] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0082.862] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x8000, lpOverlapped=0x0) returned 1 [0082.864] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x8010, lpOverlapped=0x0) returned 1 [0082.866] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0082.886] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.895] CloseHandle (hObject=0xec) returned 1 [0082.895] CloseHandle (hObject=0xf0) returned 1 [0082.895] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\suggested sites~.feed-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\suggested sites~.feed-ms.dvodltmf")) returned 0 [0082.896] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\suggested sites~.feed-ms.dvodltmf")) returned 0x2020 [0082.896] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52d69eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6e0227e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Suggested Sites~.feed-ms", cAlternateFileName="SUGGES~1.FEE")) returned 0x2e8518 [0082.896] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52d69eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6e0227e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Suggested Sites~.feed-ms", cAlternateFileName="SUGGES~1.FEE")) returned 0 [0082.896] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0082.896] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\suggested sites~.feed-ms")) returned 1 [0082.897] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\suggested sites~.feed-ms")) returned 0xffffffff [0082.897] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x2dec90, dwReserved1=0x18e91c, cFileName="Web Slice Gallery~.feed-ms", cAlternateFileName="WEBSLI~1.FEE")) returned 1 [0082.898] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0082.899] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0082.900] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7000 [0082.900] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0082.900] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0082.983] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x7000, lpOverlapped=0x0) returned 1 [0082.985] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x7010, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x7010, lpOverlapped=0x0) returned 1 [0082.987] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0083.006] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.015] CloseHandle (hObject=0xf0) returned 1 [0083.016] CloseHandle (hObject=0xec) returned 1 [0083.016] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms.dvodltmf")) returned 0 [0083.016] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms.dvodltmf")) returned 0x2020 [0083.016] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Web Slice Gallery~.feed-ms", cAlternateFileName="WEBSLI~1.FEE")) returned 0x2e8518 [0083.016] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Web Slice Gallery~.feed-ms", cAlternateFileName="WEBSLI~1.FEE")) returned 0 [0083.017] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0083.017] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms")) returned 1 [0083.018] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms")) returned 0xffffffff [0083.018] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x2dec90, dwReserved1=0x18e91c, cFileName="Web Slice Gallery~.feed-ms", cAlternateFileName="WEBSLI~1.FEE")) returned 0 [0083.018] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0083.019] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d69eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ddc88, dwReserved1=0x18eb84, cFileName="WebSlices~", cAlternateFileName="WEBSLI~1")) returned 0 [0083.019] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0083.019] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 0 [0083.019] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0083.019] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d363334, dwReserved1=0x42313134, cFileName="Feeds Cache", cAlternateFileName="FEEDSC~1")) returned 1 [0083.019] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0083.021] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName="..", cAlternateFileName="")) returned 1 [0083.021] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName="1NBUR4HR", cAlternateFileName="")) returned 1 [0083.021] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c6c61, dwReserved1=0x2e7e7972, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0083.021] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c6c61, dwReserved1=0x2e7e7972, cFileName="..", cAlternateFileName="")) returned 1 [0083.021] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x656c6c61, dwReserved1=0x2e7e7972, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0083.021] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0083.022] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0083.022] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0083.022] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0083.022] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0083.107] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x43, lpOverlapped=0x0) returned 1 [0083.108] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x50, lpOverlapped=0x0) returned 1 [0083.109] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0083.129] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.138] CloseHandle (hObject=0xe8) returned 1 [0083.138] CloseHandle (hObject=0xec) returned 1 [0083.138] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini.dvodltmf")) returned 0 [0083.139] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini.dvodltmf")) returned 0x2020 [0083.139] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e84d8 [0083.139] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0083.139] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0083.139] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini")) returned 1 [0083.140] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini")) returned 0xffffffff [0083.140] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ddc88, dwReserved1=0x18eb84, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0083.140] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ddc88, dwReserved1=0x18eb84, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0 [0083.140] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0083.140] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName="6ASVN7J7", cAlternateFileName="")) returned 1 [0083.140] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ddc88, dwReserved1=0x18eb84, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0083.140] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ddc88, dwReserved1=0x18eb84, cFileName="..", cAlternateFileName="")) returned 1 [0083.141] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2ddc88, dwReserved1=0x18eb84, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0083.141] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0083.141] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0083.141] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0083.141] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0083.142] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0083.226] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x43, lpOverlapped=0x0) returned 1 [0083.227] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x50, lpOverlapped=0x0) returned 1 [0083.228] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0083.247] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.258] CloseHandle (hObject=0xec) returned 1 [0083.258] CloseHandle (hObject=0xe8) returned 1 [0083.258] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini.dvodltmf")) returned 0 [0083.259] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini.dvodltmf")) returned 0x2020 [0083.259] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e84d8 [0083.259] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0083.259] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0083.259] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini")) returned 1 [0083.260] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini")) returned 0xffffffff [0083.260] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ddc88, dwReserved1=0x18eb84, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0083.260] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ddc88, dwReserved1=0x18eb84, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0 [0083.260] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0083.260] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName="D68G7BIJ", cAlternateFileName="")) returned 1 [0083.260] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ddc88, dwReserved1=0x18eb84, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0083.261] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ddc88, dwReserved1=0x18eb84, cFileName="..", cAlternateFileName="")) returned 1 [0083.261] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2ddc88, dwReserved1=0x18eb84, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0083.261] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0083.261] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0083.262] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0083.262] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0083.262] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0083.345] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x43, lpOverlapped=0x0) returned 1 [0083.349] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x50, lpOverlapped=0x0) returned 1 [0083.350] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0083.374] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.384] CloseHandle (hObject=0xe8) returned 1 [0083.384] CloseHandle (hObject=0xec) returned 1 [0083.384] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini.dvodltmf")) returned 0 [0083.384] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini.dvodltmf")) returned 0x2020 [0083.385] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e84d8 [0083.385] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0083.385] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0083.385] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini")) returned 1 [0083.386] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini")) returned 0xffffffff [0083.386] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ddc88, dwReserved1=0x18eb84, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0083.386] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ddc88, dwReserved1=0x18eb84, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0 [0083.386] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0083.386] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0083.386] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0083.386] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0083.386] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0083.387] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0083.387] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0083.487] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x43, lpOverlapped=0x0) returned 1 [0083.488] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x50, lpOverlapped=0x0) returned 1 [0083.489] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0083.508] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.518] CloseHandle (hObject=0xe0) returned 1 [0083.518] CloseHandle (hObject=0xec) returned 1 [0083.518] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\desktop.ini.dvodltmf")) returned 0 [0083.519] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\desktop.ini.dvodltmf")) returned 0x2020 [0083.519] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8498 [0083.519] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0083.519] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0083.519] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\desktop.ini")) returned 1 [0083.520] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\desktop.ini")) returned 0xffffffff [0083.520] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2bc126f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2e73f0, dwReserved1=0x18edec, cFileName="index.dat", cAlternateFileName="")) returned 1 [0083.520] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0083.521] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0083.521] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8000 [0083.521] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0083.521] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0083.606] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x8000, lpOverlapped=0x0) returned 1 [0083.608] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x8010, lpOverlapped=0x0) returned 1 [0083.609] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0083.630] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.639] CloseHandle (hObject=0xec) returned 1 [0083.639] CloseHandle (hObject=0xe0) returned 1 [0083.639] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat.dvodltmf")) returned 0 [0083.640] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat.dvodltmf")) returned 0x2020 [0083.640] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2bc126f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0x2e8498 [0083.640] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2bc126f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0 [0083.640] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0083.640] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat")) returned 1 [0083.641] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat")) returned 0xffffffff [0083.642] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KQMHSVKD", cAlternateFileName="")) returned 1 [0083.642] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x96, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0083.642] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x96, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.642] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x96, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0083.642] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0083.642] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0083.644] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0083.644] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0083.645] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0083.729] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x43, lpOverlapped=0x0) returned 1 [0083.730] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x50, lpOverlapped=0x0) returned 1 [0083.731] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0083.750] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.760] CloseHandle (hObject=0xec) returned 1 [0083.760] CloseHandle (hObject=0xe8) returned 1 [0083.760] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini.dvodltmf")) returned 0 [0083.760] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini.dvodltmf")) returned 0x2020 [0083.760] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e84d8 [0083.760] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0083.761] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0083.761] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini")) returned 1 [0083.761] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini")) returned 0xffffffff [0083.761] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0083.761] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0x52d90010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="ieonline.microsoft[1]", cAlternateFileName="IEONLI~1.MIC")) returned 1 [0083.762] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\ieonline.microsoft[1]"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0083.762] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1].dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\ieonline.microsoft[1].dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0083.762] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0083.762] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0083.762] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0083.878] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x10, lpOverlapped=0x0) returned 1 [0083.879] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0083.898] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.908] CloseHandle (hObject=0xe8) returned 1 [0083.908] CloseHandle (hObject=0xec) returned 1 [0083.908] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\ieonline.microsoft[1]"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1].dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\ieonline.microsoft[1].dvodltmf")) returned 0 [0083.909] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1].dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\ieonline.microsoft[1].dvodltmf")) returned 0x2020 [0083.909] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0x52d90010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="ieonline.microsoft[1]", cAlternateFileName="IEONLI~1.MIC")) returned 0x2e84d8 [0083.909] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0x52d90010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="ieonline.microsoft[1]", cAlternateFileName="IEONLI~1.MIC")) returned 0 [0083.909] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0083.909] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\ieonline.microsoft[1]")) returned 1 [0083.909] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\ieonline.microsoft[1]")) returned 0xffffffff [0083.909] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0x52d90010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="ieonline.microsoft[1]", cAlternateFileName="IEONLI~1.MIC")) returned 0 [0083.909] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0083.909] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KQMHSVKD", cAlternateFileName="")) returned 0 [0083.909] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0083.909] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d363334, dwReserved1=0x42313134, cFileName="FORMS", cAlternateFileName="")) returned 1 [0083.909] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f7263, dwReserved1=0x5b74666f, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0083.910] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f7263, dwReserved1=0x5b74666f, cFileName="..", cAlternateFileName="")) returned 1 [0083.910] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d757c20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x3c0dc, dwReserved0=0x736f7263, dwReserved1=0x5b74666f, cFileName="FRMCACHE.DAT", cAlternateFileName="")) returned 1 [0083.910] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\forms\\frmcache.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0083.911] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\forms\\frmcache.dat.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0083.911] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3c0dc [0083.912] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0083.912] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0083.995] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3c0dc, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x3c0dc, lpOverlapped=0x0) returned 1 [0084.002] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3c0e0, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x3c0e0, lpOverlapped=0x0) returned 1 [0084.007] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0084.026] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.036] CloseHandle (hObject=0xe0) returned 1 [0084.036] CloseHandle (hObject=0xec) returned 1 [0084.036] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\forms\\frmcache.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\forms\\frmcache.dat.dvodltmf")) returned 0 [0084.036] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\forms\\frmcache.dat.dvodltmf")) returned 0x2020 [0084.036] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d757c20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x3c0dc, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="FRMCACHE.DAT", cAlternateFileName="")) returned 0x2e8498 [0084.037] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d757c20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x3c0dc, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="FRMCACHE.DAT", cAlternateFileName="")) returned 0 [0084.037] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0084.037] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\forms\\frmcache.dat")) returned 1 [0084.039] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\forms\\frmcache.dat")) returned 0xffffffff [0084.039] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d757c20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x3c0dc, dwReserved0=0x736f7263, dwReserved1=0x5b74666f, cFileName="FRMCACHE.DAT", cAlternateFileName="")) returned 0 [0084.039] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0084.039] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d363354, dwReserved1=0x42313134, cFileName="IME12", cAlternateFileName="")) returned 1 [0084.039] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0084.040] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.040] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0084.040] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0084.040] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d363354, dwReserved1=0x42313134, cFileName="IMJP12", cAlternateFileName="")) returned 1 [0084.040] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0084.041] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.041] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0084.041] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0084.041] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d363354, dwReserved1=0x42313134, cFileName="IMJP8_1", cAlternateFileName="")) returned 1 [0084.041] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0084.042] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.042] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0084.042] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0084.042] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d363354, dwReserved1=0x42313134, cFileName="IMJP9_0", cAlternateFileName="")) returned 1 [0084.042] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0084.042] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.043] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0084.043] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0084.043] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d363354, dwReserved1=0x42313134, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0084.043] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0084.045] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.045] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb371c2, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x2fa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="brndlog.bak", cAlternateFileName="")) returned 1 [0084.045] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0084.045] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0084.046] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2fa9 [0084.046] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0084.046] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0084.136] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2fa9, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x2fa9, lpOverlapped=0x0) returned 1 [0084.138] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2fb0, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x2fb0, lpOverlapped=0x0) returned 1 [0084.139] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0084.159] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.168] CloseHandle (hObject=0xec) returned 1 [0084.168] CloseHandle (hObject=0xe0) returned 1 [0084.168] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak.dvodltmf")) returned 0 [0084.169] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak.dvodltmf")) returned 0x2020 [0084.169] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb371c2, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x2fa9, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="brndlog.bak", cAlternateFileName="")) returned 0x2e8498 [0084.169] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb371c2, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x2fa9, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="brndlog.bak", cAlternateFileName="")) returned 0 [0084.169] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0084.169] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak")) returned 1 [0084.170] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak")) returned 0xffffffff [0084.170] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d977900, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2fb0, dwReserved0=0x2e73f0, dwReserved1=0x18edec, cFileName="brndlog.txt", cAlternateFileName="")) returned 1 [0084.170] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0084.171] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0084.172] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2fb0 [0084.172] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0084.172] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0084.255] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2fb0, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x2fb0, lpOverlapped=0x0) returned 1 [0084.257] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2fc0, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x2fc0, lpOverlapped=0x0) returned 1 [0084.258] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0084.277] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.287] CloseHandle (hObject=0xe0) returned 1 [0084.287] CloseHandle (hObject=0xec) returned 1 [0084.287] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.dvodltmf")) returned 0 [0084.289] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.dvodltmf")) returned 0x2020 [0084.289] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d977900, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2fb0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="brndlog.txt", cAlternateFileName="")) returned 0x2e8498 [0084.290] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d977900, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2fb0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="brndlog.txt", cAlternateFileName="")) returned 0 [0084.290] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0084.290] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt")) returned 1 [0084.291] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt")) returned 0xffffffff [0084.291] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e73f0, dwReserved1=0x18edec, cFileName="DOMStore", cAlternateFileName="")) returned 1 [0084.291] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0084.292] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.292] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa6, dwReserved1=0x0, cFileName="3LKBQZJ3", cAlternateFileName="")) returned 1 [0084.292] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0084.292] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.292] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0084.292] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0084.292] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa6, dwReserved1=0x0, cFileName="8NES5H33", cAlternateFileName="")) returned 1 [0084.292] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0084.292] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.292] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d941010, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="get.adobe[1].xml", cAlternateFileName="GETADO~1.XML")) returned 1 [0084.292] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\get.adobe[1].xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0084.292] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\get.adobe[1].xml.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0084.293] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd [0084.293] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0084.293] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0084.545] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0xd, lpOverlapped=0x0) returned 1 [0084.546] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x10, lpOverlapped=0x0) returned 1 [0084.547] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0084.567] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.576] CloseHandle (hObject=0xe8) returned 1 [0084.576] CloseHandle (hObject=0xf0) returned 1 [0084.576] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\get.adobe[1].xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\get.adobe[1].xml.dvodltmf")) returned 0 [0084.577] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\get.adobe[1].xml.dvodltmf")) returned 0x2020 [0084.577] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d941010, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="get.adobe[1].xml", cAlternateFileName="GETADO~1.XML")) returned 0x2e8518 [0084.577] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d941010, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="get.adobe[1].xml", cAlternateFileName="GETADO~1.XML")) returned 0 [0084.577] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0084.577] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\get.adobe[1].xml")) returned 1 [0084.579] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\get.adobe[1].xml")) returned 0xffffffff [0084.579] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d941010, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="get.adobe[1].xml", cAlternateFileName="GETADO~1.XML")) returned 0 [0084.579] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0084.579] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d782e5d, dwReserved1=0x6c, cFileName="FKLUIDU0", cAlternateFileName="")) returned 1 [0084.579] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0084.580] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="..", cAlternateFileName="")) returned 1 [0084.580] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="..", cAlternateFileName="")) returned 0 [0084.580] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0084.580] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x125db390, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x6d782e5d, dwReserved1=0x6c, cFileName="index.dat", cAlternateFileName="")) returned 1 [0084.580] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0084.580] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\index.dat.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0084.584] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8000 [0084.584] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0084.584] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0084.684] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x8000, lpOverlapped=0x0) returned 1 [0084.688] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x8010, lpOverlapped=0x0) returned 1 [0084.690] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0084.710] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.720] CloseHandle (hObject=0xe0) returned 1 [0084.720] CloseHandle (hObject=0xf0) returned 1 [0084.720] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\index.dat.dvodltmf")) returned 0 [0084.721] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\index.dat.dvodltmf")) returned 0x2020 [0084.721] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x125db390, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0x2e84d8 [0084.721] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x125db390, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0 [0084.721] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0084.721] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\index.dat")) returned 1 [0084.722] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\index.dat")) returned 0xffffffff [0084.722] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="OWLVMZRC", cAlternateFileName="")) returned 1 [0084.722] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0084.723] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.723] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0084.723] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0084.723] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="OWLVMZRC", cAlternateFileName="")) returned 0 [0084.723] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0084.723] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x65d58120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65d58120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65d58120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23f4, dwReserved0=0x2e73f0, dwReserved1=0x18edec, cFileName="frameiconcache.dat", cAlternateFileName="FRAMEI~1.DAT")) returned 1 [0084.723] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\frameiconcache.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0084.724] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\frameiconcache.dat.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0084.724] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x23f4 [0084.725] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0084.725] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0084.811] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x23f4, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x23f4, lpOverlapped=0x0) returned 1 [0084.812] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x2400, lpOverlapped=0x0) returned 1 [0084.813] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0084.833] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.843] CloseHandle (hObject=0xec) returned 1 [0084.843] CloseHandle (hObject=0xf0) returned 1 [0084.843] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\frameiconcache.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\frameiconcache.dat.dvodltmf")) returned 0 [0084.843] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\frameiconcache.dat.dvodltmf")) returned 0x2020 [0084.843] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x65d58120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65d58120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65d58120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23f4, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="frameiconcache.dat", cAlternateFileName="FRAMEI~1.DAT")) returned 0x2e8498 [0084.844] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x65d58120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65d58120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65d58120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23f4, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="frameiconcache.dat", cAlternateFileName="FRAMEI~1.DAT")) returned 0 [0084.844] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0084.844] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\frameiconcache.dat")) returned 1 [0084.845] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\frameiconcache.dat")) returned 0xffffffff [0084.845] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95014270, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0x95014270, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x95014270, ftLastWriteTime.dwHighDateTime=0x1d2fab5, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2e73f0, dwReserved1=0x18edec, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 1 [0084.845] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0084.846] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0084.846] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4000 [0084.846] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0084.847] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0084.932] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x4000, lpOverlapped=0x0) returned 1 [0084.933] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x4010, lpOverlapped=0x0) returned 1 [0084.934] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0084.954] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.964] CloseHandle (hObject=0xf0) returned 1 [0084.964] CloseHandle (hObject=0xec) returned 1 [0084.964] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat.dvodltmf")) returned 0 [0084.965] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat.dvodltmf")) returned 0x2020 [0084.965] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95014270, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0x95014270, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x95014270, ftLastWriteTime.dwHighDateTime=0x1d2fab5, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 0x2e8498 [0084.965] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95014270, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0x95014270, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x95014270, ftLastWriteTime.dwHighDateTime=0x1d2fab5, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 0 [0084.965] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0084.965] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat")) returned 1 [0084.966] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat")) returned 0xffffffff [0084.966] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e73f0, dwReserved1=0x18edec, cFileName="Recovery", cAlternateFileName="")) returned 1 [0084.966] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0084.966] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.966] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName="Active", cAlternateFileName="")) returned 1 [0084.966] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0065, dwReserved1=0x610064, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0084.967] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0065, dwReserved1=0x610064, cFileName="..", cAlternateFileName="")) returned 1 [0084.967] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0065, dwReserved1=0x610064, cFileName="..", cAlternateFileName="")) returned 0 [0084.967] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0084.967] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName="Last Active", cAlternateFileName="LASTAC~1")) returned 1 [0084.967] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0065, dwReserved1=0x610064, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0084.969] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0065, dwReserved1=0x610064, cFileName="..", cAlternateFileName="")) returned 1 [0084.969] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe35acf0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe35acf0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x306293b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e0065, dwReserved1=0x610064, cFileName="RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="RECOVE~2.DAT")) returned 1 [0084.969] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{4bd650f1-c8f9-11e7-b5bf-c43dc7584a00}.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0084.969] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{4bd650f1-c8f9-11e7-b5bf-c43dc7584a00}.dat.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0084.970] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe00 [0084.970] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0084.970] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0085.054] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0xe00, lpOverlapped=0x0) returned 1 [0085.056] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0xe10, lpOverlapped=0x0) returned 1 [0085.057] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0085.077] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.086] CloseHandle (hObject=0xe0) returned 1 [0085.087] CloseHandle (hObject=0xe8) returned 1 [0085.087] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{4bd650f1-c8f9-11e7-b5bf-c43dc7584a00}.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{4bd650f1-c8f9-11e7-b5bf-c43dc7584a00}.dat.dvodltmf")) returned 0 [0085.087] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{4bd650f1-c8f9-11e7-b5bf-c43dc7584a00}.dat.dvodltmf")) returned 0x2020 [0085.087] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe35acf0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe35acf0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x306293b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="RECOVE~2.DAT")) returned 0x2e8518 [0085.088] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe35acf0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe35acf0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x306293b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="RECOVE~2.DAT")) returned 0 [0085.088] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0085.088] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{4bd650f1-c8f9-11e7-b5bf-c43dc7584a00}.dat")) returned 1 [0085.089] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{4bd650f1-c8f9-11e7-b5bf-c43dc7584a00}.dat")) returned 0xffffffff [0085.089] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6dd28c60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6dd28c60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe35acf0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat", cAlternateFileName="RECOVE~1.DAT")) returned 1 [0085.089] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{aae6bf5c-4991-11e7-8e2b-c43dc7584a00}.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0085.089] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{aae6bf5c-4991-11e7-8e2b-c43dc7584a00}.dat.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0085.089] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1200 [0085.089] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0085.090] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0085.174] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x1200, lpOverlapped=0x0) returned 1 [0085.175] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x1210, lpOverlapped=0x0) returned 1 [0085.176] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0085.196] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.205] CloseHandle (hObject=0xe8) returned 1 [0085.205] CloseHandle (hObject=0xe0) returned 1 [0085.205] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{aae6bf5c-4991-11e7-8e2b-c43dc7584a00}.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{aae6bf5c-4991-11e7-8e2b-c43dc7584a00}.dat.dvodltmf")) returned 0 [0085.206] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{aae6bf5c-4991-11e7-8e2b-c43dc7584a00}.dat.dvodltmf")) returned 0x2020 [0085.206] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6dd28c60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6dd28c60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe35acf0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat", cAlternateFileName="RECOVE~1.DAT")) returned 0x2e8518 [0085.206] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6dd28c60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6dd28c60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe35acf0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat", cAlternateFileName="RECOVE~1.DAT")) returned 0 [0085.206] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0085.206] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{aae6bf5c-4991-11e7-8e2b-c43dc7584a00}.dat")) returned 1 [0085.207] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{aae6bf5c-4991-11e7-8e2b-c43dc7584a00}.dat")) returned 0xffffffff [0085.207] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe35acf0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe35acf0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe35acf0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="{4BD65~1.DAT")) returned 1 [0085.207] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{4bd650f0-c8f9-11e7-b5bf-c43dc7584a00}.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0085.208] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{4bd650f0-c8f9-11e7-b5bf-c43dc7584a00}.dat.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0085.209] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1200 [0085.209] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0085.209] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0085.293] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x1200, lpOverlapped=0x0) returned 1 [0085.294] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x1210, lpOverlapped=0x0) returned 1 [0085.296] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0085.315] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.324] CloseHandle (hObject=0xe0) returned 1 [0085.324] CloseHandle (hObject=0xe8) returned 1 [0085.325] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{4bd650f0-c8f9-11e7-b5bf-c43dc7584a00}.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{4bd650f0-c8f9-11e7-b5bf-c43dc7584a00}.dat.dvodltmf")) returned 0 [0085.325] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{4bd650f0-c8f9-11e7-b5bf-c43dc7584a00}.dat.dvodltmf")) returned 0x2020 [0085.325] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe35acf0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe35acf0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe35acf0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="{4BD65~1.DAT")) returned 0x2e8518 [0085.325] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe35acf0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe35acf0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe35acf0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="{4BD65~1.DAT")) returned 0 [0085.325] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0085.326] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{4bd650f0-c8f9-11e7-b5bf-c43dc7584a00}.dat")) returned 1 [0085.327] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{4bd650f0-c8f9-11e7-b5bf-c43dc7584a00}.dat")) returned 0xffffffff [0085.327] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30603250, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x306293b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="{69512~1.DAT")) returned 1 [0085.327] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{69512155-c8f9-11e7-b5bf-c43dc7584a00}.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0085.328] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{69512155-c8f9-11e7-b5bf-c43dc7584a00}.dat.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0085.328] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1200 [0085.328] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0085.329] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0085.423] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x1200, lpOverlapped=0x0) returned 1 [0085.427] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x1210, lpOverlapped=0x0) returned 1 [0085.428] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0085.448] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.457] CloseHandle (hObject=0xe8) returned 1 [0085.457] CloseHandle (hObject=0xe0) returned 1 [0085.458] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{69512155-c8f9-11e7-b5bf-c43dc7584a00}.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{69512155-c8f9-11e7-b5bf-c43dc7584a00}.dat.dvodltmf")) returned 0 [0085.458] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{69512155-c8f9-11e7-b5bf-c43dc7584a00}.dat.dvodltmf")) returned 0x2020 [0085.458] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30603250, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x306293b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="{69512~1.DAT")) returned 0x2e8518 [0085.458] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30603250, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x306293b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="{69512~1.DAT")) returned 0 [0085.458] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0085.458] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{69512155-c8f9-11e7-b5bf-c43dc7584a00}.dat")) returned 1 [0085.459] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{69512155-c8f9-11e7-b5bf-c43dc7584a00}.dat")) returned 0xffffffff [0085.459] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30603250, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x306293b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="{69512~1.DAT")) returned 0 [0085.460] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0085.460] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName="Last Active", cAlternateFileName="LASTAC~1")) returned 0 [0085.460] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0085.460] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e73f0, dwReserved1=0x18edec, cFileName="Recovery", cAlternateFileName="")) returned 0 [0085.460] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0085.460] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e656854, dwReserved1=0x42746164, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1 [0085.460] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e73f0, dwReserved1=0x18edec, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0085.472] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e73f0, dwReserved1=0x18edec, cFileName="..", cAlternateFileName="")) returned 1 [0085.472] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2cf59b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x105000, dwReserved0=0x2e73f0, dwReserved1=0x18edec, cFileName="CurrentDatabase_372.wmdb", cAlternateFileName="CURREN~1.WMD")) returned 1 [0085.472] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0085.472] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.473] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x105000 [0085.473] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0085.473] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0085.557] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x105000, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x105000, lpOverlapped=0x0) returned 1 [0085.598] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x105010, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x105010, lpOverlapped=0x0) returned 1 [0085.631] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0085.650] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.659] CloseHandle (hObject=0xec) returned 1 [0085.659] CloseHandle (hObject=0xf0) returned 1 [0085.660] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb.dvodltmf")) returned 0 [0085.660] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb.dvodltmf")) returned 0x2020 [0085.660] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2cf59b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x105000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="CurrentDatabase_372.wmdb", cAlternateFileName="CURREN~1.WMD")) returned 0x2e8498 [0085.660] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2cf59b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x105000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="CurrentDatabase_372.wmdb", cAlternateFileName="CURREN~1.WMD")) returned 0 [0085.660] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0085.660] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb")) returned 1 [0085.661] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb")) returned 0xffffffff [0085.661] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2cf33a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2cf33a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1106c, dwReserved0=0x2e73f0, dwReserved1=0x18edec, cFileName="LocalMLS_3.wmdb", cAlternateFileName="LOCALM~1.WMD")) returned 1 [0085.662] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.662] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0085.662] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1106c [0085.662] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0085.662] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0085.745] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1106c, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x1106c, lpOverlapped=0x0) returned 1 [0085.748] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x11070, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x11070, lpOverlapped=0x0) returned 1 [0085.750] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0085.769] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.809] CloseHandle (hObject=0xf0) returned 1 [0085.810] CloseHandle (hObject=0xec) returned 1 [0085.813] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb.dvodltmf")) returned 0 [0085.816] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb.dvodltmf")) returned 0x2020 [0085.816] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2cf33a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2cf33a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1106c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="LocalMLS_3.wmdb", cAlternateFileName="LOCALM~1.WMD")) returned 0x2e8498 [0085.816] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2cf33a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2cf33a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1106c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="LocalMLS_3.wmdb", cAlternateFileName="LOCALM~1.WMD")) returned 0 [0085.816] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0085.816] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb")) returned 1 [0085.818] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb")) returned 0xffffffff [0085.818] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e73f0, dwReserved1=0x18edec, cFileName="Sync Playlists", cAlternateFileName="SYNCPL~1")) returned 1 [0085.818] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0085.818] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.818] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa4, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0085.818] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x620064, dwReserved1=0x33005f, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0085.818] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x620064, dwReserved1=0x33005f, cFileName="..", cAlternateFileName="")) returned 1 [0085.818] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x620064, dwReserved1=0x33005f, cFileName="0000E713", cAlternateFileName="")) returned 1 [0085.818] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0085.820] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.820] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x0, cFileName="01_Music_auto_rated_at_5_stars.wpl", cAlternateFileName="01_MUS~1.WPL")) returned 1 [0085.821] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\01_music_auto_rated_at_5_stars.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0085.821] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\01_music_auto_rated_at_5_stars.wpl.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0085.821] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x414 [0085.821] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0085.821] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0085.906] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x414, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x414, lpOverlapped=0x0) returned 1 [0085.908] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x420, lpOverlapped=0x0) returned 1 [0085.909] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0085.929] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.938] CloseHandle (hObject=0xe8) returned 1 [0085.938] CloseHandle (hObject=0xe4) returned 1 [0085.938] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\01_music_auto_rated_at_5_stars.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\01_music_auto_rated_at_5_stars.wpl.dvodltmf")) returned 0 [0085.939] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\01_music_auto_rated_at_5_stars.wpl.dvodltmf")) returned 0x2020 [0085.939] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="01_Music_auto_rated_at_5_stars.wpl", cAlternateFileName="01_MUS~1.WPL")) returned 0x2e8558 [0085.939] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="01_Music_auto_rated_at_5_stars.wpl", cAlternateFileName="01_MUS~1.WPL")) returned 0 [0085.939] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0085.939] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\01_music_auto_rated_at_5_stars.wpl")) returned 1 [0085.940] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\01_music_auto_rated_at_5_stars.wpl")) returned 0xffffffff [0085.940] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="02_Music_added_in_the_last_month.wpl", cAlternateFileName="02_MUS~1.WPL")) returned 1 [0085.940] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\02_music_added_in_the_last_month.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0085.941] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\02_music_added_in_the_last_month.wpl.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0085.941] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ff [0085.941] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0085.941] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0086.024] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4ff, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x4ff, lpOverlapped=0x0) returned 1 [0086.025] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x500, lpOverlapped=0x0) returned 1 [0086.026] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0086.045] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.055] CloseHandle (hObject=0xe4) returned 1 [0086.055] CloseHandle (hObject=0xe8) returned 1 [0086.055] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\02_music_added_in_the_last_month.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\02_music_added_in_the_last_month.wpl.dvodltmf")) returned 0 [0086.055] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\02_music_added_in_the_last_month.wpl.dvodltmf")) returned 0x2020 [0086.056] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="02_Music_added_in_the_last_month.wpl", cAlternateFileName="02_MUS~1.WPL")) returned 0x2e8558 [0086.056] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="02_Music_added_in_the_last_month.wpl", cAlternateFileName="02_MUS~1.WPL")) returned 0 [0086.056] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0086.056] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\02_music_added_in_the_last_month.wpl")) returned 1 [0086.057] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\02_music_added_in_the_last_month.wpl")) returned 0xffffffff [0086.057] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="03_Music_rated_at_4_or_5_stars.wpl", cAlternateFileName="03_MUS~1.WPL")) returned 1 [0086.057] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\03_music_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0086.057] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\03_music_rated_at_4_or_5_stars.wpl.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0086.057] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4f3 [0086.057] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0086.058] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0086.149] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4f3, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x4f3, lpOverlapped=0x0) returned 1 [0086.151] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x500, lpOverlapped=0x0) returned 1 [0086.152] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0086.171] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.180] CloseHandle (hObject=0xe8) returned 1 [0086.180] CloseHandle (hObject=0xe4) returned 1 [0086.181] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\03_music_rated_at_4_or_5_stars.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\03_music_rated_at_4_or_5_stars.wpl.dvodltmf")) returned 0 [0086.181] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\03_music_rated_at_4_or_5_stars.wpl.dvodltmf")) returned 0x2020 [0086.181] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="03_Music_rated_at_4_or_5_stars.wpl", cAlternateFileName="03_MUS~1.WPL")) returned 0x2e8558 [0086.181] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="03_Music_rated_at_4_or_5_stars.wpl", cAlternateFileName="03_MUS~1.WPL")) returned 0 [0086.181] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0086.181] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\03_music_rated_at_4_or_5_stars.wpl")) returned 1 [0086.182] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\03_music_rated_at_4_or_5_stars.wpl")) returned 0xffffffff [0086.182] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="04_Music_played_in_the_last_month.wpl", cAlternateFileName="04_MUS~1.WPL")) returned 1 [0086.182] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\04_music_played_in_the_last_month.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0086.183] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\04_music_played_in_the_last_month.wpl.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0086.184] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x504 [0086.184] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0086.184] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0086.266] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x504, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x504, lpOverlapped=0x0) returned 1 [0086.267] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x510, lpOverlapped=0x0) returned 1 [0086.268] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0086.287] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.297] CloseHandle (hObject=0xe4) returned 1 [0086.297] CloseHandle (hObject=0xe8) returned 1 [0086.297] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\04_music_played_in_the_last_month.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\04_music_played_in_the_last_month.wpl.dvodltmf")) returned 0 [0086.297] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\04_music_played_in_the_last_month.wpl.dvodltmf")) returned 0x2020 [0086.297] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="04_Music_played_in_the_last_month.wpl", cAlternateFileName="04_MUS~1.WPL")) returned 0x2e8558 [0086.298] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="04_Music_played_in_the_last_month.wpl", cAlternateFileName="04_MUS~1.WPL")) returned 0 [0086.298] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0086.298] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\04_music_played_in_the_last_month.wpl")) returned 1 [0086.299] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\04_music_played_in_the_last_month.wpl")) returned 0xffffffff [0086.299] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="05_Pictures_taken_in_the_last_month.wpl", cAlternateFileName="05_PIC~1.WPL")) returned 1 [0086.299] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\05_pictures_taken_in_the_last_month.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0086.299] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\05_pictures_taken_in_the_last_month.wpl.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0086.299] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x31d [0086.299] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0086.300] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0086.389] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x31d, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x31d, lpOverlapped=0x0) returned 1 [0086.390] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x320, lpOverlapped=0x0) returned 1 [0086.391] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0086.410] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.420] CloseHandle (hObject=0xe8) returned 1 [0086.420] CloseHandle (hObject=0xe4) returned 1 [0086.420] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\05_pictures_taken_in_the_last_month.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\05_pictures_taken_in_the_last_month.wpl.dvodltmf")) returned 0 [0086.421] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\05_pictures_taken_in_the_last_month.wpl.dvodltmf")) returned 0x2020 [0086.421] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="05_Pictures_taken_in_the_last_month.wpl", cAlternateFileName="05_PIC~1.WPL")) returned 0x2e8558 [0086.421] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="05_Pictures_taken_in_the_last_month.wpl", cAlternateFileName="05_PIC~1.WPL")) returned 0 [0086.421] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0086.421] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\05_pictures_taken_in_the_last_month.wpl")) returned 1 [0086.431] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\05_pictures_taken_in_the_last_month.wpl")) returned 0xffffffff [0086.431] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="06_Pictures_rated_4_or_5_stars.wpl", cAlternateFileName="06_PIC~1.WPL")) returned 1 [0086.431] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\06_pictures_rated_4_or_5_stars.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0086.432] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\06_pictures_rated_4_or_5_stars.wpl.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0086.433] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x311 [0086.433] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0086.433] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0086.545] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x311, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x311, lpOverlapped=0x0) returned 1 [0086.549] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x320, lpOverlapped=0x0) returned 1 [0086.551] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0086.571] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.581] CloseHandle (hObject=0xe4) returned 1 [0086.581] CloseHandle (hObject=0xe8) returned 1 [0086.582] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\06_pictures_rated_4_or_5_stars.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\06_pictures_rated_4_or_5_stars.wpl.dvodltmf")) returned 0 [0086.583] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\06_pictures_rated_4_or_5_stars.wpl.dvodltmf")) returned 0x2020 [0086.583] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="06_Pictures_rated_4_or_5_stars.wpl", cAlternateFileName="06_PIC~1.WPL")) returned 0x2e8558 [0086.583] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="06_Pictures_rated_4_or_5_stars.wpl", cAlternateFileName="06_PIC~1.WPL")) returned 0 [0086.583] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0086.583] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\06_pictures_rated_4_or_5_stars.wpl")) returned 1 [0086.585] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\06_pictures_rated_4_or_5_stars.wpl")) returned 0xffffffff [0086.585] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="07_TV_recorded_in_the_last_week.wpl", cAlternateFileName="07_TV_~1.WPL")) returned 1 [0086.585] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\07_tv_recorded_in_the_last_week.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0086.586] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\07_tv_recorded_in_the_last_week.wpl.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0086.586] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x410 [0086.586] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0086.586] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0086.673] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x410, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x410, lpOverlapped=0x0) returned 1 [0086.674] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x420, lpOverlapped=0x0) returned 1 [0086.675] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0086.694] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.707] CloseHandle (hObject=0xe8) returned 1 [0086.707] CloseHandle (hObject=0xe4) returned 1 [0086.707] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\07_tv_recorded_in_the_last_week.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\07_tv_recorded_in_the_last_week.wpl.dvodltmf")) returned 0 [0086.707] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\07_tv_recorded_in_the_last_week.wpl.dvodltmf")) returned 0x2020 [0086.708] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="07_TV_recorded_in_the_last_week.wpl", cAlternateFileName="07_TV_~1.WPL")) returned 0x2e8558 [0086.708] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="07_TV_recorded_in_the_last_week.wpl", cAlternateFileName="07_TV_~1.WPL")) returned 0 [0086.708] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0086.708] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\07_tv_recorded_in_the_last_week.wpl")) returned 1 [0086.709] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\07_tv_recorded_in_the_last_week.wpl")) returned 0xffffffff [0086.709] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="08_Video_rated_at_4_or_5_stars.wpl", cAlternateFileName="08_VID~1.WPL")) returned 1 [0086.709] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\08_video_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0086.710] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\08_video_rated_at_4_or_5_stars.wpl.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0086.710] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3fc [0086.710] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0086.711] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0086.794] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3fc, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x3fc, lpOverlapped=0x0) returned 1 [0086.796] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x400, lpOverlapped=0x0) returned 1 [0086.797] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0086.816] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.826] CloseHandle (hObject=0xe4) returned 1 [0086.826] CloseHandle (hObject=0xe8) returned 1 [0086.826] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\08_video_rated_at_4_or_5_stars.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\08_video_rated_at_4_or_5_stars.wpl.dvodltmf")) returned 0 [0086.826] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\08_video_rated_at_4_or_5_stars.wpl.dvodltmf")) returned 0x2020 [0086.826] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="08_Video_rated_at_4_or_5_stars.wpl", cAlternateFileName="08_VID~1.WPL")) returned 0x2e8558 [0086.826] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="08_Video_rated_at_4_or_5_stars.wpl", cAlternateFileName="08_VID~1.WPL")) returned 0 [0086.827] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0086.827] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\08_video_rated_at_4_or_5_stars.wpl")) returned 1 [0086.828] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\08_video_rated_at_4_or_5_stars.wpl")) returned 0xffffffff [0086.828] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="09_Music_played_the_most.wpl", cAlternateFileName="09_MUS~1.WPL")) returned 1 [0086.828] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\09_music_played_the_most.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0086.828] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\09_music_played_the_most.wpl.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0086.828] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x401 [0086.828] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0086.829] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0086.912] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x401, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x401, lpOverlapped=0x0) returned 1 [0086.914] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x410, lpOverlapped=0x0) returned 1 [0086.915] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0086.934] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.943] CloseHandle (hObject=0xe8) returned 1 [0086.943] CloseHandle (hObject=0xe4) returned 1 [0086.944] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\09_music_played_the_most.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\09_music_played_the_most.wpl.dvodltmf")) returned 0 [0086.944] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\09_music_played_the_most.wpl.dvodltmf")) returned 0x2020 [0086.944] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="09_Music_played_the_most.wpl", cAlternateFileName="09_MUS~1.WPL")) returned 0x2e8558 [0086.944] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="09_Music_played_the_most.wpl", cAlternateFileName="09_MUS~1.WPL")) returned 0 [0086.944] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0086.944] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\09_music_played_the_most.wpl")) returned 1 [0086.945] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\09_music_played_the_most.wpl")) returned 0xffffffff [0086.945] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x427, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="10_All_Music.wpl", cAlternateFileName="10_ALL~1.WPL")) returned 1 [0086.945] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\10_all_music.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0086.946] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\10_all_music.wpl.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0086.946] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x427 [0086.946] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0086.946] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0087.030] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x427, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x427, lpOverlapped=0x0) returned 1 [0087.032] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x430, lpOverlapped=0x0) returned 1 [0087.033] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0087.052] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.061] CloseHandle (hObject=0xe4) returned 1 [0087.061] CloseHandle (hObject=0xe8) returned 1 [0087.062] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\10_all_music.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\10_all_music.wpl.dvodltmf")) returned 0 [0087.062] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\10_all_music.wpl.dvodltmf")) returned 0x2020 [0087.062] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x427, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="10_All_Music.wpl", cAlternateFileName="10_ALL~1.WPL")) returned 0x2e8558 [0087.062] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x427, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="10_All_Music.wpl", cAlternateFileName="10_ALL~1.WPL")) returned 0 [0087.062] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0087.062] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\10_all_music.wpl")) returned 1 [0087.063] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\10_all_music.wpl")) returned 0xffffffff [0087.063] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x0, cFileName="11_All_Pictures.wpl", cAlternateFileName="11_ALL~1.WPL")) returned 1 [0087.063] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\11_all_pictures.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0087.064] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\11_all_pictures.wpl.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0087.065] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x249 [0087.065] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0087.065] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0087.150] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x249, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x249, lpOverlapped=0x0) returned 1 [0087.152] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x250, lpOverlapped=0x0) returned 1 [0087.152] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0087.173] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.182] CloseHandle (hObject=0xe8) returned 1 [0087.182] CloseHandle (hObject=0xe4) returned 1 [0087.182] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\11_all_pictures.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\11_all_pictures.wpl.dvodltmf")) returned 0 [0087.183] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\11_all_pictures.wpl.dvodltmf")) returned 0x2020 [0087.183] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="11_All_Pictures.wpl", cAlternateFileName="11_ALL~1.WPL")) returned 0x2e8558 [0087.183] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="11_All_Pictures.wpl", cAlternateFileName="11_ALL~1.WPL")) returned 0 [0087.183] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0087.183] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\11_all_pictures.wpl")) returned 1 [0087.184] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\11_all_pictures.wpl")) returned 0xffffffff [0087.184] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 1 [0087.184] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\12_all_video.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0087.185] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\12_all_video.wpl.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0087.185] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x437 [0087.185] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0087.185] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0087.270] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x437, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x437, lpOverlapped=0x0) returned 1 [0087.700] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x440, lpOverlapped=0x0) returned 1 [0087.701] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0087.723] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.734] CloseHandle (hObject=0xe4) returned 1 [0087.734] CloseHandle (hObject=0xe8) returned 1 [0087.734] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\12_all_video.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\12_all_video.wpl.dvodltmf")) returned 0 [0087.735] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\12_all_video.wpl.dvodltmf")) returned 0x2020 [0087.735] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 0x2e8558 [0087.735] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 0 [0087.735] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0087.735] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\12_all_video.wpl")) returned 1 [0087.736] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\12_all_video.wpl")) returned 0xffffffff [0087.736] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 0 [0087.736] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0087.736] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70772e6f, dwReserved1=0x6c70776c, cFileName="00010C6E", cAlternateFileName="")) returned 1 [0087.736] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0087.738] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.738] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x0, cFileName="01_Music_auto_rated_at_5_stars.wpl", cAlternateFileName="01_MUS~1.WPL")) returned 1 [0087.738] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0087.738] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0087.739] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x414 [0087.739] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0087.739] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0087.841] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x414, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x414, lpOverlapped=0x0) returned 1 [0087.852] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x420, lpOverlapped=0x0) returned 1 [0087.854] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0087.874] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.883] CloseHandle (hObject=0xe8) returned 1 [0087.883] CloseHandle (hObject=0xe4) returned 1 [0087.883] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl.dvodltmf")) returned 0 [0087.884] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl.dvodltmf")) returned 0x2020 [0087.884] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="01_Music_auto_rated_at_5_stars.wpl", cAlternateFileName="01_MUS~1.WPL")) returned 0x2e8558 [0087.885] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="01_Music_auto_rated_at_5_stars.wpl", cAlternateFileName="01_MUS~1.WPL")) returned 0 [0087.885] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0087.885] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl")) returned 1 [0087.886] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl")) returned 0xffffffff [0087.886] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="02_Music_added_in_the_last_month.wpl", cAlternateFileName="02_MUS~1.WPL")) returned 1 [0087.886] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0087.887] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0087.887] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ff [0087.887] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0087.887] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0087.972] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4ff, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x4ff, lpOverlapped=0x0) returned 1 [0087.974] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x500, lpOverlapped=0x0) returned 1 [0087.975] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0087.995] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.004] CloseHandle (hObject=0xe4) returned 1 [0088.004] CloseHandle (hObject=0xe8) returned 1 [0088.004] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl.dvodltmf")) returned 0 [0088.005] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl.dvodltmf")) returned 0x2020 [0088.005] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="02_Music_added_in_the_last_month.wpl", cAlternateFileName="02_MUS~1.WPL")) returned 0x2e8558 [0088.005] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="02_Music_added_in_the_last_month.wpl", cAlternateFileName="02_MUS~1.WPL")) returned 0 [0088.005] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0088.005] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl")) returned 1 [0088.006] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl")) returned 0xffffffff [0088.006] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="03_Music_rated_at_4_or_5_stars.wpl", cAlternateFileName="03_MUS~1.WPL")) returned 1 [0088.006] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0088.007] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0088.007] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4f3 [0088.007] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0088.007] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0088.093] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4f3, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x4f3, lpOverlapped=0x0) returned 1 [0088.094] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x500, lpOverlapped=0x0) returned 1 [0088.095] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0088.115] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.125] CloseHandle (hObject=0xe8) returned 1 [0088.125] CloseHandle (hObject=0xe4) returned 1 [0088.125] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl.dvodltmf")) returned 0 [0088.126] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl.dvodltmf")) returned 0x2020 [0088.126] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="03_Music_rated_at_4_or_5_stars.wpl", cAlternateFileName="03_MUS~1.WPL")) returned 0x2e8558 [0088.126] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="03_Music_rated_at_4_or_5_stars.wpl", cAlternateFileName="03_MUS~1.WPL")) returned 0 [0088.126] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0088.126] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl")) returned 1 [0088.127] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl")) returned 0xffffffff [0088.127] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="04_Music_played_in_the_last_month.wpl", cAlternateFileName="04_MUS~1.WPL")) returned 1 [0088.127] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0088.128] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0088.128] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x504 [0088.128] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0088.129] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0088.214] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x504, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x504, lpOverlapped=0x0) returned 1 [0088.216] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x510, lpOverlapped=0x0) returned 1 [0088.217] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0088.238] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.248] CloseHandle (hObject=0xe4) returned 1 [0088.248] CloseHandle (hObject=0xe8) returned 1 [0088.248] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl.dvodltmf")) returned 0 [0088.249] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl.dvodltmf")) returned 0x2020 [0088.249] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="04_Music_played_in_the_last_month.wpl", cAlternateFileName="04_MUS~1.WPL")) returned 0x2e8558 [0088.249] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="04_Music_played_in_the_last_month.wpl", cAlternateFileName="04_MUS~1.WPL")) returned 0 [0088.249] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0088.249] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl")) returned 1 [0088.250] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl")) returned 0xffffffff [0088.250] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="05_Pictures_taken_in_the_last_month.wpl", cAlternateFileName="05_PIC~1.WPL")) returned 1 [0088.250] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0088.250] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0088.251] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x31d [0088.251] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0088.251] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0088.336] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x31d, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x31d, lpOverlapped=0x0) returned 1 [0088.338] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x320, lpOverlapped=0x0) returned 1 [0088.338] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0088.364] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.374] CloseHandle (hObject=0xe8) returned 1 [0088.374] CloseHandle (hObject=0xe4) returned 1 [0088.374] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl.dvodltmf")) returned 0 [0088.374] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl.dvodltmf")) returned 0x2020 [0088.374] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="05_Pictures_taken_in_the_last_month.wpl", cAlternateFileName="05_PIC~1.WPL")) returned 0x2e8558 [0088.375] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="05_Pictures_taken_in_the_last_month.wpl", cAlternateFileName="05_PIC~1.WPL")) returned 0 [0088.375] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0088.375] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl")) returned 1 [0088.376] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl")) returned 0xffffffff [0088.376] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="06_Pictures_rated_4_or_5_stars.wpl", cAlternateFileName="06_PIC~1.WPL")) returned 1 [0088.376] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0088.376] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0088.377] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x311 [0088.377] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0088.377] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0088.467] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x311, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x311, lpOverlapped=0x0) returned 1 [0088.468] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x320, lpOverlapped=0x0) returned 1 [0088.469] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0088.489] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.499] CloseHandle (hObject=0xe4) returned 1 [0088.499] CloseHandle (hObject=0xe8) returned 1 [0088.499] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl.dvodltmf")) returned 0 [0088.499] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl.dvodltmf")) returned 0x2020 [0088.499] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="06_Pictures_rated_4_or_5_stars.wpl", cAlternateFileName="06_PIC~1.WPL")) returned 0x2e8558 [0088.499] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="06_Pictures_rated_4_or_5_stars.wpl", cAlternateFileName="06_PIC~1.WPL")) returned 0 [0088.499] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0088.499] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl")) returned 1 [0088.500] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl")) returned 0xffffffff [0088.500] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="07_TV_recorded_in_the_last_week.wpl", cAlternateFileName="07_TV_~1.WPL")) returned 1 [0088.500] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0088.501] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0088.501] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x410 [0088.501] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0088.501] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0088.598] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x410, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x410, lpOverlapped=0x0) returned 1 [0088.600] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x420, lpOverlapped=0x0) returned 1 [0088.601] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0088.621] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.632] CloseHandle (hObject=0xe8) returned 1 [0088.632] CloseHandle (hObject=0xe4) returned 1 [0088.632] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl.dvodltmf")) returned 0 [0088.633] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl.dvodltmf")) returned 0x2020 [0088.633] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="07_TV_recorded_in_the_last_week.wpl", cAlternateFileName="07_TV_~1.WPL")) returned 0x2e8558 [0088.633] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="07_TV_recorded_in_the_last_week.wpl", cAlternateFileName="07_TV_~1.WPL")) returned 0 [0088.633] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0088.633] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl")) returned 1 [0088.634] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl")) returned 0xffffffff [0088.634] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="08_Video_rated_at_4_or_5_stars.wpl", cAlternateFileName="08_VID~1.WPL")) returned 1 [0088.634] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0088.635] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0088.635] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3fc [0088.635] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0088.635] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0088.717] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3fc, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x3fc, lpOverlapped=0x0) returned 1 [0088.721] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x400, lpOverlapped=0x0) returned 1 [0088.722] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0088.741] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.750] CloseHandle (hObject=0xe4) returned 1 [0088.750] CloseHandle (hObject=0xe8) returned 1 [0088.750] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl.dvodltmf")) returned 0 [0088.751] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl.dvodltmf")) returned 0x2020 [0088.751] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="08_Video_rated_at_4_or_5_stars.wpl", cAlternateFileName="08_VID~1.WPL")) returned 0x2e8558 [0088.751] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="08_Video_rated_at_4_or_5_stars.wpl", cAlternateFileName="08_VID~1.WPL")) returned 0 [0088.752] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0088.752] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl")) returned 1 [0088.752] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl")) returned 0xffffffff [0088.752] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="09_Music_played_the_most.wpl", cAlternateFileName="09_MUS~1.WPL")) returned 1 [0088.753] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0088.754] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0088.754] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x401 [0088.754] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0088.754] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0088.837] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x401, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x401, lpOverlapped=0x0) returned 1 [0088.839] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x410, lpOverlapped=0x0) returned 1 [0088.840] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0088.858] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.868] CloseHandle (hObject=0xe8) returned 1 [0088.868] CloseHandle (hObject=0xe4) returned 1 [0088.868] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl.dvodltmf")) returned 0 [0088.868] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl.dvodltmf")) returned 0x2020 [0088.868] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="09_Music_played_the_most.wpl", cAlternateFileName="09_MUS~1.WPL")) returned 0x2e8558 [0088.868] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="09_Music_played_the_most.wpl", cAlternateFileName="09_MUS~1.WPL")) returned 0 [0088.869] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0088.869] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl")) returned 1 [0088.869] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl")) returned 0xffffffff [0088.869] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x427, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="10_All_Music.wpl", cAlternateFileName="10_ALL~1.WPL")) returned 1 [0088.869] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0088.870] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0088.871] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x427 [0088.871] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0088.871] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0088.968] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x427, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x427, lpOverlapped=0x0) returned 1 [0088.981] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x430, lpOverlapped=0x0) returned 1 [0088.982] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0089.001] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.011] CloseHandle (hObject=0xe4) returned 1 [0089.011] CloseHandle (hObject=0xe8) returned 1 [0089.011] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl.dvodltmf")) returned 0 [0089.012] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl.dvodltmf")) returned 0x2020 [0089.012] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x427, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="10_All_Music.wpl", cAlternateFileName="10_ALL~1.WPL")) returned 0x2e8558 [0089.012] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x427, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="10_All_Music.wpl", cAlternateFileName="10_ALL~1.WPL")) returned 0 [0089.012] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0089.012] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl")) returned 1 [0089.013] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl")) returned 0xffffffff [0089.013] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x0, cFileName="11_All_Pictures.wpl", cAlternateFileName="11_ALL~1.WPL")) returned 1 [0089.014] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0089.014] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0089.015] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x249 [0089.015] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0089.015] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0089.108] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x249, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x249, lpOverlapped=0x0) returned 1 [0089.111] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x250, lpOverlapped=0x0) returned 1 [0089.112] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0089.132] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.141] CloseHandle (hObject=0xe8) returned 1 [0089.141] CloseHandle (hObject=0xe4) returned 1 [0089.141] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl.dvodltmf")) returned 0 [0089.142] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl.dvodltmf")) returned 0x2020 [0089.142] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="11_All_Pictures.wpl", cAlternateFileName="11_ALL~1.WPL")) returned 0x2e8558 [0089.142] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="11_All_Pictures.wpl", cAlternateFileName="11_ALL~1.WPL")) returned 0 [0089.142] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0089.142] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl")) returned 1 [0089.143] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl")) returned 0xffffffff [0089.143] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 1 [0089.143] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0089.143] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0089.144] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x437 [0089.144] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0089.144] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0089.233] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x437, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x437, lpOverlapped=0x0) returned 1 [0089.235] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x440, lpOverlapped=0x0) returned 1 [0089.236] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0089.255] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.267] CloseHandle (hObject=0xe4) returned 1 [0089.268] CloseHandle (hObject=0xe8) returned 1 [0089.268] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl.dvodltmf")) returned 0 [0089.268] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl.dvodltmf")) returned 0x2020 [0089.269] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 0x2e8558 [0089.269] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 0 [0089.269] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0089.269] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl")) returned 1 [0089.270] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl")) returned 0xffffffff [0089.270] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 0 [0089.270] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0089.270] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70772e6f, dwReserved1=0x6c70776c, cFileName="00010C6E", cAlternateFileName="")) returned 0 [0089.270] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0089.270] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa4, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0089.270] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0089.271] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e73f0, dwReserved1=0x18edec, cFileName="Transcoded Files Cache", cAlternateFileName="TRANSC~1")) returned 1 [0089.271] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0089.272] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.272] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.272] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0089.272] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e73f0, dwReserved1=0x18edec, cFileName="Transcoded Files Cache", cAlternateFileName="TRANSC~1")) returned 0 [0089.272] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0089.272] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c6946, dwReserved1=0x61432073, cFileName="Office", cAlternateFileName="")) returned 1 [0089.272] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e73f0, dwReserved1=0x18edec, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0089.273] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e73f0, dwReserved1=0x18edec, cFileName="..", cAlternateFileName="")) returned 1 [0089.273] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e73f0, dwReserved1=0x18edec, cFileName="14.0", cAlternateFileName="")) returned 1 [0089.273] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0089.275] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.275] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa4, dwReserved1=0x0, cFileName="OfficeFileCache", cAlternateFileName="OFFICE~1")) returned 1 [0089.275] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0089.276] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.276] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7aab700, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7aab700, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="FSD-CNRY.FSD", cAlternateFileName="")) returned 1 [0089.276] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-cnry.fsd"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0089.276] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-cnry.fsd.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0089.279] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x20000 [0089.279] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0089.279] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0089.363] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x20000, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x20000, lpOverlapped=0x0) returned 1 [0089.373] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x20010, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x20010, lpOverlapped=0x0) returned 1 [0089.376] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0089.396] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.405] CloseHandle (hObject=0xe0) returned 1 [0089.405] CloseHandle (hObject=0xe8) returned 1 [0089.405] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-cnry.fsd"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-cnry.fsd.dvodltmf")) returned 0 [0089.406] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-cnry.fsd.dvodltmf")) returned 0x2020 [0089.406] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7aab700, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7aab700, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="FSD-CNRY.FSD", cAlternateFileName="")) returned 0x2e8518 [0089.406] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7aab700, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7aab700, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="FSD-CNRY.FSD", cAlternateFileName="")) returned 0 [0089.406] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0089.406] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-cnry.fsd")) returned 1 [0089.408] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-cnry.fsd")) returned 0xffffffff [0089.408] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7ad1860, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7af79c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD", cAlternateFileName="FSD-{4~1.FSD")) returned 1 [0089.408] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-{48508c83-ec67-468f-aa1f-6f3caf625658}.fsd"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0089.408] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-{48508c83-ec67-468f-aa1f-6f3caf625658}.fsd.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0089.409] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x20000 [0089.409] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0089.409] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0089.513] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x20000, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x20000, lpOverlapped=0x0) returned 1 [0089.517] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x20010, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x20010, lpOverlapped=0x0) returned 1 [0089.520] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0089.539] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.548] CloseHandle (hObject=0xe8) returned 1 [0089.548] CloseHandle (hObject=0xe0) returned 1 [0089.548] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-{48508c83-ec67-468f-aa1f-6f3caf625658}.fsd"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-{48508c83-ec67-468f-aa1f-6f3caf625658}.fsd.dvodltmf")) returned 0 [0089.549] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-{48508c83-ec67-468f-aa1f-6f3caf625658}.fsd.dvodltmf")) returned 0x2020 [0089.549] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7ad1860, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7af79c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD", cAlternateFileName="FSD-{4~1.FSD")) returned 0x2e8518 [0089.549] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7ad1860, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7af79c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD", cAlternateFileName="FSD-{4~1.FSD")) returned 0 [0089.549] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0089.549] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-{48508c83-ec67-468f-aa1f-6f3caf625658}.fsd")) returned 1 [0089.551] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-{48508c83-ec67-468f-aa1f-6f3caf625658}.fsd")) returned 0xffffffff [0089.551] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7ad1860, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7af79c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="FSF-CTBL.FSF", cAlternateFileName="")) returned 1 [0089.551] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsf-ctbl.fsf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0089.551] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsf-ctbl.fsf.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0089.551] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x72 [0089.551] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0089.552] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0089.653] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x72, lpOverlapped=0x0) returned 1 [0089.654] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x80, lpOverlapped=0x0) returned 1 [0089.654] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0089.674] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.684] CloseHandle (hObject=0xe0) returned 1 [0089.684] CloseHandle (hObject=0xe8) returned 1 [0089.684] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsf-ctbl.fsf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsf-ctbl.fsf.dvodltmf")) returned 0 [0089.685] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsf-ctbl.fsf.dvodltmf")) returned 0x2020 [0089.685] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7ad1860, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7af79c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="FSF-CTBL.FSF", cAlternateFileName="")) returned 0x2e8518 [0089.685] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7ad1860, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7af79c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="FSF-CTBL.FSF", cAlternateFileName="")) returned 0 [0089.685] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0089.685] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsf-ctbl.fsf")) returned 1 [0089.686] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsf-ctbl.fsf")) returned 0xffffffff [0089.686] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7ad1860, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7af79c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="FSF-CTBL.FSF", cAlternateFileName="")) returned 0 [0089.686] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0089.686] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa4, dwReserved1=0x0, cFileName="OfficeFileCache", cAlternateFileName="OFFICE~1")) returned 0 [0089.686] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0089.686] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65686361, dwReserved1=0x18edec, cFileName="Groove", cAlternateFileName="")) returned 1 [0089.686] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0089.686] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="..", cAlternateFileName="")) returned 1 [0089.686] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="System", cAlternateFileName="")) returned 1 [0089.686] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0089.687] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="..", cAlternateFileName="")) returned 1 [0089.687] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="..", cAlternateFileName="")) returned 0 [0089.687] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0089.687] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="User", cAlternateFileName="")) returned 1 [0089.687] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0089.687] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="..", cAlternateFileName="")) returned 1 [0089.687] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="..", cAlternateFileName="")) returned 0 [0089.687] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0089.689] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="User", cAlternateFileName="")) returned 0 [0089.689] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0089.689] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65686361, dwReserved1=0x18edec, cFileName="ONetConfig", cAlternateFileName="ONETCO~1")) returned 1 [0089.689] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0089.689] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="..", cAlternateFileName="")) returned 1 [0089.689] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bd15230, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="350db95df4cbd94b2a1c300510e12e11.sig", cAlternateFileName="350DB9~1.SIG")) returned 1 [0089.689] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.sig"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0089.691] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.sig.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0089.692] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x80 [0089.692] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0089.693] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0089.791] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x80, lpOverlapped=0x0) returned 1 [0089.792] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x90, lpOverlapped=0x0) returned 1 [0089.793] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0089.813] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.822] CloseHandle (hObject=0xf0) returned 1 [0089.822] CloseHandle (hObject=0xe8) returned 1 [0089.822] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.sig"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.sig.dvodltmf")) returned 0 [0089.823] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.sig.dvodltmf")) returned 0x2020 [0089.823] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bd15230, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="350db95df4cbd94b2a1c300510e12e11.sig", cAlternateFileName="350DB9~1.SIG")) returned 0x2e84d8 [0089.823] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bd15230, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="350db95df4cbd94b2a1c300510e12e11.sig", cAlternateFileName="350DB9~1.SIG")) returned 0 [0089.823] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0089.823] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.sig")) returned 1 [0089.824] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.sig")) returned 0xffffffff [0089.824] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bd15230, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x7ef, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="350db95df4cbd94b2a1c300510e12e11.xml", cAlternateFileName="350DB9~1.XML")) returned 1 [0089.824] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0089.824] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0089.825] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7ef [0089.825] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0089.825] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0089.927] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x7ef, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x7ef, lpOverlapped=0x0) returned 1 [0089.928] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x7f0, lpOverlapped=0x0) returned 1 [0089.929] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0089.949] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.958] CloseHandle (hObject=0xe8) returned 1 [0089.958] CloseHandle (hObject=0xf0) returned 1 [0089.958] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml.dvodltmf")) returned 0 [0089.959] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml.dvodltmf")) returned 0x2020 [0089.959] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bd15230, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x7ef, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="350db95df4cbd94b2a1c300510e12e11.xml", cAlternateFileName="350DB9~1.XML")) returned 0x2e84d8 [0089.959] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bd15230, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x7ef, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="350db95df4cbd94b2a1c300510e12e11.xml", cAlternateFileName="350DB9~1.XML")) returned 0 [0089.959] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0089.959] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml")) returned 1 [0089.960] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml")) returned 0xffffffff [0089.960] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bd15230, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x7ef, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="350db95df4cbd94b2a1c300510e12e11.xml", cAlternateFileName="350DB9~1.XML")) returned 0 [0089.960] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0089.961] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65686361, dwReserved1=0x18edec, cFileName="ONetConfig", cAlternateFileName="ONETCO~1")) returned 0 [0089.961] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0089.961] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c6946, dwReserved1=0x61432073, cFileName="Outlook", cAlternateFileName="")) returned 1 [0089.961] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34396462, dwReserved1=0x31613262, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0089.961] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34396462, dwReserved1=0x31613262, cFileName="..", cAlternateFileName="")) returned 1 [0089.961] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3dc8cc40, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3dc8cc40, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3dc8cc40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x34396462, dwReserved1=0x31613262, cFileName="mapisvc.inf", cAlternateFileName="")) returned 1 [0089.961] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\mapisvc.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0089.962] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\mapisvc.inf.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0089.964] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x462 [0089.964] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0089.964] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0090.049] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x462, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x462, lpOverlapped=0x0) returned 1 [0090.051] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x470, lpOverlapped=0x0) returned 1 [0090.052] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0090.072] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.081] CloseHandle (hObject=0xec) returned 1 [0090.081] CloseHandle (hObject=0xf0) returned 1 [0090.081] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\mapisvc.inf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\mapisvc.inf.dvodltmf")) returned 0 [0090.082] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\mapisvc.inf.dvodltmf")) returned 0x2020 [0090.082] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3dc8cc40, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3dc8cc40, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3dc8cc40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="mapisvc.inf", cAlternateFileName="")) returned 0x2e8498 [0090.082] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3dc8cc40, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3dc8cc40, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3dc8cc40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="mapisvc.inf", cAlternateFileName="")) returned 0 [0090.082] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0090.082] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\mapisvc.inf")) returned 1 [0090.083] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\mapisvc.inf")) returned 0xffffffff [0090.083] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5c4d2d00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4d2d00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4d2d00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook.sharing.xml.obi", cAlternateFileName="OUTLOO~1.OBI")) returned 1 [0090.083] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Outlook.sharing.xml.obi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\outlook.sharing.xml.obi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0090.085] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Outlook.sharing.xml.obi.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\outlook.sharing.xml.obi.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0090.085] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9 [0090.086] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0090.086] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0090.170] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0xb9, lpOverlapped=0x0) returned 1 [0090.171] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0xc0, lpOverlapped=0x0) returned 1 [0090.172] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0090.192] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.201] CloseHandle (hObject=0xf0) returned 1 [0090.201] CloseHandle (hObject=0xec) returned 1 [0090.201] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Outlook.sharing.xml.obi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\outlook.sharing.xml.obi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Outlook.sharing.xml.obi.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\outlook.sharing.xml.obi.dvodltmf")) returned 0 [0090.202] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Outlook.sharing.xml.obi.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\outlook.sharing.xml.obi.dvodltmf")) returned 0x2020 [0090.202] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Outlook.sharing.xml.obi", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5c4d2d00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4d2d00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4d2d00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Outlook.sharing.xml.obi", cAlternateFileName="OUTLOO~1.OBI")) returned 0x2e8498 [0090.202] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5c4d2d00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4d2d00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4d2d00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Outlook.sharing.xml.obi", cAlternateFileName="OUTLOO~1.OBI")) returned 0 [0090.202] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0090.202] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Outlook.sharing.xml.obi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\outlook.sharing.xml.obi")) returned 1 [0090.203] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Outlook.sharing.xml.obi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\outlook.sharing.xml.obi")) returned 0xffffffff [0090.203] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e73f0, dwReserved1=0x18edec, cFileName="RoamCache", cAlternateFileName="ROAMCA~1")) returned 1 [0090.203] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaa, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0090.203] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaa, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.203] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x60a26dc0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0xaa, dwReserved1=0x0, cFileName="Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0090.203] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_contactprefs_2_f230e11936b7d740a008ffc660e83c71.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0090.204] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_contactprefs_2_f230e11936b7d740a008ffc660e83c71.dat.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0090.205] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x104 [0090.206] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0090.206] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0090.295] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x104, lpOverlapped=0x0) returned 1 [0090.296] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x110, lpOverlapped=0x0) returned 1 [0090.297] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0090.323] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.333] CloseHandle (hObject=0xf0) returned 1 [0090.333] CloseHandle (hObject=0xe8) returned 1 [0090.333] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_contactprefs_2_f230e11936b7d740a008ffc660e83c71.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_contactprefs_2_f230e11936b7d740a008ffc660e83c71.dat.dvodltmf")) returned 0 [0090.336] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_contactprefs_2_f230e11936b7d740a008ffc660e83c71.dat.dvodltmf")) returned 0x2020 [0090.336] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x60a26dc0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", cAlternateFileName="STREAM~1.DAT")) returned 0x2e84d8 [0090.336] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x60a26dc0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0090.336] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0090.336] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_contactprefs_2_f230e11936b7d740a008ffc660e83c71.dat")) returned 1 [0090.337] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_contactprefs_2_f230e11936b7d740a008ffc660e83c71.dat")) returned 0xffffffff [0090.337] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x60a26dc0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0xaa, dwReserved1=0x0, cFileName="Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0090.337] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0090.337] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e73f0, dwReserved1=0x18edec, cFileName="RoamCache", cAlternateFileName="ROAMCA~1")) returned 0 [0090.337] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0090.337] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x676e6972, dwReserved1=0x6c6d782e, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0090.337] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50746361, dwReserved1=0x73666572, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0090.339] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50746361, dwReserved1=0x73666572, cFileName="..", cAlternateFileName="")) returned 1 [0090.339] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50746361, dwReserved1=0x73666572, cFileName="..", cAlternateFileName="")) returned 0 [0090.339] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0090.339] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x676e6972, dwReserved1=0x6c6d782e, cFileName="TaskSchedulerConfig", cAlternateFileName="TASKSC~1")) returned 1 [0090.339] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50746361, dwReserved1=0x73666572, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0090.340] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50746361, dwReserved1=0x73666572, cFileName="..", cAlternateFileName="")) returned 1 [0090.340] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50746361, dwReserved1=0x73666572, cFileName="..", cAlternateFileName="")) returned 0 [0090.340] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0090.340] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x676e6972, dwReserved1=0x6c6d782e, cFileName="Visio", cAlternateFileName="")) returned 1 [0090.340] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50746361, dwReserved1=0x73666572, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0090.340] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50746361, dwReserved1=0x73666572, cFileName="..", cAlternateFileName="")) returned 1 [0090.340] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5ef99320, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5efe55e0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x18ce0, dwReserved0=0x50746361, dwReserved1=0x73666572, cFileName="content14.dat", cAlternateFileName="CONTEN~1.DAT")) returned 1 [0090.341] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\content14.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0090.341] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\content14.dat.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0090.341] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18ce0 [0090.341] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0090.342] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0090.434] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x18ce0, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x18ce0, lpOverlapped=0x0) returned 1 [0090.511] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x18cf0, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x18cf0, lpOverlapped=0x0) returned 1 [0090.513] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0090.533] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.546] CloseHandle (hObject=0xec) returned 1 [0090.547] CloseHandle (hObject=0xe8) returned 1 [0090.547] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\content14.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\content14.dat.dvodltmf")) returned 0 [0090.547] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\content14.dat.dvodltmf")) returned 0x2020 [0090.547] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5ef99320, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5efe55e0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x18ce0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="content14.dat", cAlternateFileName="CONTEN~1.DAT")) returned 0x2e8498 [0090.548] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5ef99320, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5efe55e0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x18ce0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="content14.dat", cAlternateFileName="CONTEN~1.DAT")) returned 0 [0090.548] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0090.548] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\content14.dat")) returned 1 [0090.549] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\content14.dat")) returned 0xffffffff [0090.549] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x976e3d80, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x976e3d80, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x5f055ac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1f400, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbs.dat", cAlternateFileName="")) returned 1 [0090.549] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\thumbs.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0090.550] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\thumbs.dat.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0090.550] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f400 [0090.550] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0090.550] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0090.639] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1f400, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x1f400, lpOverlapped=0x0) returned 1 [0090.649] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1f410, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x1f410, lpOverlapped=0x0) returned 1 [0090.652] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0090.678] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.690] CloseHandle (hObject=0xe8) returned 1 [0090.690] CloseHandle (hObject=0xec) returned 1 [0090.690] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\thumbs.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\thumbs.dat.dvodltmf")) returned 0 [0090.691] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\thumbs.dat.dvodltmf")) returned 0x2020 [0090.691] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x976e3d80, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x976e3d80, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x5f055ac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1f400, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="thumbs.dat", cAlternateFileName="")) returned 0x2e8498 [0090.691] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x976e3d80, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x976e3d80, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x5f055ac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1f400, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="thumbs.dat", cAlternateFileName="")) returned 0 [0090.691] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0090.691] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\thumbs.dat")) returned 1 [0090.694] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\thumbs.dat")) returned 0xffffffff [0090.694] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x976e3d80, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x976e3d80, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x5f055ac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1f400, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbs.dat", cAlternateFileName="")) returned 0 [0090.694] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0090.694] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x676e7461, dwReserved1=0x6c6d782e, cFileName="Windows", cAlternateFileName="")) returned 1 [0090.694] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0d18, dwReserved1=0x18edec, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0090.694] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0d18, dwReserved1=0x18edec, cFileName="..", cAlternateFileName="")) returned 1 [0090.694] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0d18, dwReserved1=0x18edec, cFileName="1024", cAlternateFileName="")) returned 1 [0090.694] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0090.696] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.696] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0090.696] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0090.696] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x34ef3970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0d18, dwReserved1=0x18edec, cFileName="1033", cAlternateFileName="")) returned 1 [0090.696] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x34ef3970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0090.697] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x34ef3970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.697] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ef3970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8ecd4180, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x49098, dwReserved0=0x8c, dwReserved1=0x0, cFileName="StructuredQuerySchema.bin", cAlternateFileName="STRUCT~1.BIN")) returned 1 [0090.697] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\1033\\structuredqueryschema.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0090.698] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\1033\\structuredqueryschema.bin.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0090.699] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x49098 [0090.699] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0090.699] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0090.790] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x49098, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x49098, lpOverlapped=0x0) returned 1 [0090.796] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x490a0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x490a0, lpOverlapped=0x0) returned 1 [0090.802] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0090.821] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.831] CloseHandle (hObject=0xe8) returned 1 [0090.831] CloseHandle (hObject=0xf0) returned 1 [0090.831] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\1033\\structuredqueryschema.bin"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\1033\\structuredqueryschema.bin.dvodltmf")) returned 0 [0090.832] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\1033\\structuredqueryschema.bin.dvodltmf")) returned 0x2020 [0090.832] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ef3970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8ecd4180, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x49098, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="StructuredQuerySchema.bin", cAlternateFileName="STRUCT~1.BIN")) returned 0x2e84d8 [0090.832] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ef3970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8ecd4180, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x49098, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="StructuredQuerySchema.bin", cAlternateFileName="STRUCT~1.BIN")) returned 0 [0090.832] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0090.832] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\1033\\structuredqueryschema.bin")) returned 1 [0090.835] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\1033\\structuredqueryschema.bin")) returned 0xffffffff [0090.835] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ef3970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8ecd4180, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x49098, dwReserved0=0x8c, dwReserved1=0x0, cFileName="StructuredQuerySchema.bin", cAlternateFileName="STRUCT~1.BIN")) returned 0 [0090.835] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0090.835] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x79726575, dwReserved1=0x65686353, cFileName="Burn", cAlternateFileName="")) returned 1 [0090.835] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0090.836] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="..", cAlternateFileName="")) returned 1 [0090.836] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="Burn", cAlternateFileName="")) returned 1 [0090.836] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0090.836] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.836] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xb8, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0090.836] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0090.836] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0090.839] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae [0090.839] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0090.839] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0090.925] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0xae, lpOverlapped=0x0) returned 1 [0090.926] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0xb0, lpOverlapped=0x0) returned 1 [0090.927] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0090.947] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.956] CloseHandle (hObject=0xe8) returned 1 [0090.956] CloseHandle (hObject=0xe0) returned 1 [0090.956] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini.dvodltmf")) returned 0 [0090.957] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini.dvodltmf")) returned 0x20 [0090.957] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8518 [0090.957] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0090.957] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0090.957] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini")) returned 1 [0090.958] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini")) returned 0xffffffff [0090.958] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xb8, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0090.958] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0090.959] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3b9ee2a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f30c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="Burn1", cAlternateFileName="")) returned 1 [0090.959] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3b9ee2a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f30c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0090.959] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3b9ee2a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f30c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="..", cAlternateFileName="")) returned 1 [0090.959] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3b9f09b0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f09b0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0090.959] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0090.959] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0090.960] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae [0090.960] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0090.961] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0091.051] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0xae, lpOverlapped=0x0) returned 1 [0091.052] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0xb0, lpOverlapped=0x0) returned 1 [0091.054] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0091.073] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.083] CloseHandle (hObject=0xe0) returned 1 [0091.083] CloseHandle (hObject=0xe8) returned 1 [0091.083] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini.dvodltmf")) returned 0 [0091.085] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini.dvodltmf")) returned 0x20 [0091.085] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3b9f09b0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f09b0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8518 [0091.085] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3b9f09b0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f09b0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0091.085] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0091.085] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini")) returned 1 [0091.086] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini")) returned 0xffffffff [0091.086] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3b9f09b0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f09b0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0091.086] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0091.087] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="Burn2", cAlternateFileName="")) returned 1 [0091.087] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0091.089] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="..", cAlternateFileName="")) returned 1 [0091.089] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x92637830, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0091.089] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn2\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0091.090] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn2\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0091.091] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae [0091.091] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0091.092] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0091.176] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0xae, lpOverlapped=0x0) returned 1 [0091.177] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0xb0, lpOverlapped=0x0) returned 1 [0091.178] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0091.197] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.207] CloseHandle (hObject=0xe8) returned 1 [0091.207] CloseHandle (hObject=0xe0) returned 1 [0091.207] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn2\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn2\\desktop.ini.dvodltmf")) returned 0 [0091.208] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn2\\desktop.ini.dvodltmf")) returned 0x20 [0091.208] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x92637830, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8518 [0091.208] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x92637830, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0091.208] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0091.208] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn2\\desktop.ini")) returned 1 [0091.209] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn2\\desktop.ini")) returned 0xffffffff [0091.209] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x92637830, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0091.209] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0091.210] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="Burn2", cAlternateFileName="")) returned 0 [0091.210] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0091.210] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x13d55540, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d55540, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x79726575, dwReserved1=0x65686353, cFileName="Caches", cAlternateFileName="")) returned 1 [0091.210] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x13d55540, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d55540, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0091.210] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x13d55540, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d55540, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="..", cAlternateFileName="")) returned 1 [0091.210] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa1c6ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaa1c6ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaa1c6ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="cversions.1.db", cAlternateFileName="CVERSI~1.DB")) returned 1 [0091.210] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0091.210] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0091.211] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4000 [0091.211] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0091.211] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0091.307] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x4000, lpOverlapped=0x0) returned 1 [0091.308] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x4010, lpOverlapped=0x0) returned 1 [0091.310] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0091.330] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.339] CloseHandle (hObject=0xf0) returned 1 [0091.339] CloseHandle (hObject=0xe0) returned 1 [0091.339] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db.dvodltmf")) returned 0 [0091.340] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db.dvodltmf")) returned 0x2020 [0091.340] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa1c6ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaa1c6ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaa1c6ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="cversions.1.db", cAlternateFileName="CVERSI~1.DB")) returned 0x2e84d8 [0091.340] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa1c6ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaa1c6ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaa1c6ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="cversions.1.db", cAlternateFileName="CVERSI~1.DB")) returned 0 [0091.340] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0091.340] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db")) returned 1 [0091.341] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db")) returned 0xffffffff [0091.341] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x408bd0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x408bd0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x408bd0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x18388, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000015.db", cAlternateFileName="{AFBF9~3.DB")) returned 1 [0091.341] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000015.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000015.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0091.342] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000015.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000015.db.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0091.343] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18388 [0091.343] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0091.343] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0091.436] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x18388, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x18388, lpOverlapped=0x0) returned 1 [0091.439] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x18390, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x18390, lpOverlapped=0x0) returned 1 [0091.441] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0091.461] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.470] CloseHandle (hObject=0xe0) returned 1 [0091.470] CloseHandle (hObject=0xf0) returned 1 [0091.470] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000015.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000015.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000015.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000015.db.dvodltmf")) returned 0 [0091.471] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000015.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000015.db.dvodltmf")) returned 0x2020 [0091.471] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000015.db", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x408bd0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x408bd0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x408bd0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x18388, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000015.db", cAlternateFileName="{AFBF9~3.DB")) returned 0x2e84d8 [0091.471] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x408bd0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x408bd0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x408bd0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x18388, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000015.db", cAlternateFileName="{AFBF9~3.DB")) returned 0 [0091.471] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0091.471] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000015.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000015.db")) returned 1 [0091.473] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000015.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000015.db")) returned 0xffffffff [0091.473] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13d2f3e0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x13d2f3e0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d2f3e0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x1ea08, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db", cAlternateFileName="{AFBF9~1.DB")) returned 1 [0091.473] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0091.473] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0091.474] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ea08 [0091.474] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0091.474] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0091.561] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1ea08, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x1ea08, lpOverlapped=0x0) returned 1 [0091.565] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1ea10, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x1ea10, lpOverlapped=0x0) returned 1 [0091.568] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0091.588] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.597] CloseHandle (hObject=0xf0) returned 1 [0091.597] CloseHandle (hObject=0xe0) returned 1 [0091.597] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db.dvodltmf")) returned 0 [0091.598] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db.dvodltmf")) returned 0x2020 [0091.598] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13d2f3e0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x13d2f3e0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d2f3e0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x1ea08, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db", cAlternateFileName="{AFBF9~1.DB")) returned 0x2e84d8 [0091.598] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13d2f3e0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x13d2f3e0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d2f3e0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x1ea08, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db", cAlternateFileName="{AFBF9~1.DB")) returned 0 [0091.598] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0091.598] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db")) returned 0 [0091.599] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db")) returned 0x2020 [0091.599] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13d2f3e0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x13d2f3e0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d2f3e0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x1ea08, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db", cAlternateFileName="{AFBF9~1.DB")) returned 0 [0091.599] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0091.599] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d384545, dwReserved1=0x37374334, cFileName="Explorer", cAlternateFileName="")) returned 1 [0091.599] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0091.599] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="..", cAlternateFileName="")) returned 1 [0091.599] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x30db3250, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="ExplorerStartupLog.etl", cAlternateFileName="EXPLOR~2.ETL")) returned 1 [0091.599] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0091.600] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog.etl.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0091.614] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6000 [0091.614] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0091.615] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0091.718] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x6000, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x6000, lpOverlapped=0x0) returned 1 [0091.720] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x6010, lpOverlapped=0x0) returned 1 [0091.722] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0091.742] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.751] CloseHandle (hObject=0xe0) returned 1 [0091.751] CloseHandle (hObject=0xf0) returned 1 [0091.751] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog.etl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog.etl.dvodltmf")) returned 0 [0091.752] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog.etl.dvodltmf")) returned 0x2020 [0091.752] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x30db3250, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ExplorerStartupLog.etl", cAlternateFileName="EXPLOR~2.ETL")) returned 0x2e84d8 [0091.752] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x30db3250, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ExplorerStartupLog.etl", cAlternateFileName="EXPLOR~2.ETL")) returned 0 [0091.752] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0091.752] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog.etl")) returned 1 [0091.754] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog.etl")) returned 0xffffffff [0091.754] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x841d6620, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="ExplorerStartupLog_RunOnce.etl", cAlternateFileName="EXPLOR~1.ETL")) returned 1 [0091.754] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog_runonce.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0091.754] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog_runonce.etl.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0091.755] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4000 [0091.755] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0091.755] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0091.862] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x4000, lpOverlapped=0x0) returned 1 [0091.864] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x4010, lpOverlapped=0x0) returned 1 [0091.865] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0091.884] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.898] CloseHandle (hObject=0xf0) returned 1 [0091.899] CloseHandle (hObject=0xe0) returned 1 [0091.899] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog_runonce.etl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog_runonce.etl.dvodltmf")) returned 0 [0091.899] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog_runonce.etl.dvodltmf")) returned 0x2020 [0091.899] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x841d6620, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="ExplorerStartupLog_RunOnce.etl", cAlternateFileName="EXPLOR~1.ETL")) returned 0x2e84d8 [0091.900] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x841d6620, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="ExplorerStartupLog_RunOnce.etl", cAlternateFileName="EXPLOR~1.ETL")) returned 0 [0091.900] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0091.900] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog_runonce.etl")) returned 1 [0091.901] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog_runonce.etl")) returned 0xffffffff [0091.901] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="thumbcache_1024.db", cAlternateFileName="TH78CB~1.DB")) returned 1 [0091.901] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0091.901] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0091.901] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0091.902] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0091.902] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0091.985] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x18, lpOverlapped=0x0) returned 1 [0091.986] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x20, lpOverlapped=0x0) returned 1 [0091.987] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0092.006] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.015] CloseHandle (hObject=0xe0) returned 1 [0092.015] CloseHandle (hObject=0xf0) returned 1 [0092.016] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db.dvodltmf")) returned 0 [0092.016] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db.dvodltmf")) returned 0x2020 [0092.016] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="thumbcache_1024.db", cAlternateFileName="TH78CB~1.DB")) returned 0x2e84d8 [0092.016] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="thumbcache_1024.db", cAlternateFileName="TH78CB~1.DB")) returned 0 [0092.016] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0092.016] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db")) returned 1 [0092.017] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db")) returned 0xffffffff [0092.017] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="thumbcache_256.db", cAlternateFileName="THUMBC~4.DB")) returned 1 [0092.017] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0092.018] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0092.018] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x100000 [0092.018] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0092.018] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0092.101] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x100000, lpOverlapped=0x0) returned 1 [0092.121] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x100010, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x100010, lpOverlapped=0x0) returned 1 [0092.142] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0092.162] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.171] CloseHandle (hObject=0xf0) returned 1 [0092.171] CloseHandle (hObject=0xe0) returned 1 [0092.171] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db.dvodltmf")) returned 0 [0092.172] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db.dvodltmf")) returned 0x2020 [0092.172] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="thumbcache_256.db", cAlternateFileName="THUMBC~4.DB")) returned 0x2e84d8 [0092.172] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="thumbcache_256.db", cAlternateFileName="THUMBC~4.DB")) returned 0 [0092.172] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0092.172] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db")) returned 1 [0092.180] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db")) returned 0xffffffff [0092.180] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="thumbcache_32.db", cAlternateFileName="THUMBC~2.DB")) returned 1 [0092.180] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0092.180] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0092.181] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0092.181] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0092.181] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0092.272] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x18, lpOverlapped=0x0) returned 1 [0092.274] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x20, lpOverlapped=0x0) returned 1 [0092.275] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0092.295] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.304] CloseHandle (hObject=0xe0) returned 1 [0092.304] CloseHandle (hObject=0xf0) returned 1 [0092.305] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db.dvodltmf")) returned 0 [0092.306] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db.dvodltmf")) returned 0x2020 [0092.306] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="thumbcache_32.db", cAlternateFileName="THUMBC~2.DB")) returned 0x2e84d8 [0092.306] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="thumbcache_32.db", cAlternateFileName="THUMBC~2.DB")) returned 0 [0092.306] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0092.306] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db")) returned 1 [0092.307] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db")) returned 0xffffffff [0092.307] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x73527bc0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="thumbcache_96.db", cAlternateFileName="THUMBC~3.DB")) returned 1 [0092.308] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0092.308] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0092.309] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x100000 [0092.309] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0092.309] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0092.399] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x100000, lpOverlapped=0x0) returned 1 [0092.420] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x100010, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x100010, lpOverlapped=0x0) returned 1 [0092.441] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0092.460] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.471] CloseHandle (hObject=0xf0) returned 1 [0092.471] CloseHandle (hObject=0xe0) returned 1 [0092.471] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db.dvodltmf")) returned 0 [0092.472] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db.dvodltmf")) returned 0x2020 [0092.472] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x73527bc0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="thumbcache_96.db", cAlternateFileName="THUMBC~3.DB")) returned 0x2e84d8 [0092.472] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x73527bc0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="thumbcache_96.db", cAlternateFileName="THUMBC~3.DB")) returned 0 [0092.472] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0092.472] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db")) returned 1 [0092.481] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db")) returned 0xffffffff [0092.481] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0xcb8, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="thumbcache_idx.db", cAlternateFileName="THUMBC~1.DB")) returned 1 [0092.481] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0092.481] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0092.482] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcb8 [0092.482] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0092.482] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0092.570] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xcb8, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xcb8, lpOverlapped=0x0) returned 1 [0092.571] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xcc0, lpOverlapped=0x0) returned 1 [0092.572] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0092.591] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.601] CloseHandle (hObject=0xe0) returned 1 [0092.601] CloseHandle (hObject=0xf0) returned 1 [0092.601] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db.dvodltmf")) returned 0 [0092.601] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db.dvodltmf")) returned 0x2020 [0092.601] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0xcb8, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="thumbcache_idx.db", cAlternateFileName="THUMBC~1.DB")) returned 0x2e84d8 [0092.602] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0xcb8, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="thumbcache_idx.db", cAlternateFileName="THUMBC~1.DB")) returned 0 [0092.602] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0092.602] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db")) returned 1 [0092.603] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db")) returned 0xffffffff [0092.603] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="thumbcache_sr.db", cAlternateFileName="TH0F82~1.DB")) returned 1 [0092.603] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0092.603] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0092.604] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0092.604] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0092.605] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0092.715] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x18, lpOverlapped=0x0) returned 1 [0092.717] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x20, lpOverlapped=0x0) returned 1 [0092.718] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0092.745] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.780] CloseHandle (hObject=0xf0) returned 1 [0092.781] CloseHandle (hObject=0xe0) returned 1 [0092.781] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db.dvodltmf")) returned 0 [0092.783] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db.dvodltmf")) returned 0x2020 [0092.783] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="thumbcache_sr.db", cAlternateFileName="TH0F82~1.DB")) returned 0x2e84d8 [0092.784] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="thumbcache_sr.db", cAlternateFileName="TH0F82~1.DB")) returned 0 [0092.784] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0092.784] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db")) returned 1 [0092.785] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db")) returned 0xffffffff [0092.785] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="thumbcache_sr.db", cAlternateFileName="TH0F82~1.DB")) returned 0 [0092.785] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0092.785] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e7273, dwReserved1=0x5f626262, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1 [0092.785] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0092.786] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="..", cAlternateFileName="")) returned 1 [0092.786] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="..", cAlternateFileName="")) returned 0 [0092.786] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0092.786] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e7273, dwReserved1=0x5f626262, cFileName="History", cAlternateFileName="")) returned 1 [0092.786] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0092.787] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="..", cAlternateFileName="")) returned 1 [0092.787] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0092.787] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0092.787] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0092.788] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x91 [0092.788] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0092.788] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0092.879] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x91, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x91, lpOverlapped=0x0) returned 1 [0092.880] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xa0, lpOverlapped=0x0) returned 1 [0092.881] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0092.900] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.910] CloseHandle (hObject=0xe0) returned 1 [0092.910] CloseHandle (hObject=0xf0) returned 1 [0092.910] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\desktop.ini.dvodltmf")) returned 0 [0092.910] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\desktop.ini.dvodltmf")) returned 0x2020 [0092.911] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e84d8 [0092.911] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0092.911] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0092.911] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\desktop.ini")) returned 1 [0092.912] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\desktop.ini")) returned 0xffffffff [0092.912] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x747020c0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x747020c0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="History.IE5", cAlternateFileName="")) returned 1 [0092.912] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x747020c0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x747020c0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0092.912] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x747020c0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x747020c0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.912] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0xa2, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0092.912] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0092.913] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0092.913] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x91 [0092.913] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0092.913] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0092.997] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x91, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x91, lpOverlapped=0x0) returned 1 [0092.998] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0xa0, lpOverlapped=0x0) returned 1 [0092.999] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0093.019] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.028] CloseHandle (hObject=0xe0) returned 1 [0093.028] CloseHandle (hObject=0xe8) returned 1 [0093.028] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini.dvodltmf")) returned 0 [0093.029] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini.dvodltmf")) returned 0x2020 [0093.029] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8518 [0093.029] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0093.029] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0093.029] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini")) returned 1 [0093.030] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini")) returned 0xffffffff [0093.030] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x83c55340, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="index.dat", cAlternateFileName="")) returned 1 [0093.030] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0093.030] CloseHandle (hObject=0xffffffff) returned 0 [0093.030] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat.dvodltmf")) returned 0 [0093.031] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat.dvodltmf")) returned 0xffffffff [0093.031] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x83c55340, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0x2e8518 [0093.031] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x83c55340, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0 [0093.031] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0093.031] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat")) returned 0 [0093.031] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat")) returned 0x2026 [0093.031] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x747020c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x747020c0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x747020c0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="MSHist012020010120200102", cAlternateFileName="MSHIST~1")) returned 1 [0093.031] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020010120200102\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x747020c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x747020c0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x747020c0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0093.031] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x747020c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x747020c0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x747020c0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.031] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x747020c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x747020c0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x83c55340, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xb6, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0093.031] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020010120200102\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012020010120200102\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0093.031] CloseHandle (hObject=0xffffffff) returned 0 [0093.032] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020010120200102\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012020010120200102\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020010120200102\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012020010120200102\\index.dat.dvodltmf")) returned 0 [0093.032] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020010120200102\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012020010120200102\\index.dat.dvodltmf")) returned 0xffffffff [0093.032] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020010120200102\\index.dat", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x747020c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x747020c0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x83c55340, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0x2e8558 [0093.032] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x747020c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x747020c0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x83c55340, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0 [0093.032] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0093.032] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020010120200102\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012020010120200102\\index.dat")) returned 0 [0093.032] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020010120200102\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012020010120200102\\index.dat")) returned 0x2026 [0093.032] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x747020c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x747020c0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x83c55340, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xb6, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0093.032] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0093.032] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x747020c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x747020c0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x747020c0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="MSHist012020010120200102", cAlternateFileName="MSHIST~1")) returned 0 [0093.032] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0093.032] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x30313030, dwReserved1=0x32303231, cFileName="Low", cAlternateFileName="")) returned 1 [0093.034] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0093.034] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="..", cAlternateFileName="")) returned 1 [0093.034] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0093.034] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0093.036] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0093.036] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x91 [0093.036] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0093.037] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0093.121] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x91, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x91, lpOverlapped=0x0) returned 1 [0093.122] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0xa0, lpOverlapped=0x0) returned 1 [0093.123] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0093.143] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.153] CloseHandle (hObject=0xe8) returned 1 [0093.153] CloseHandle (hObject=0xe0) returned 1 [0093.153] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\desktop.ini.dvodltmf")) returned 0 [0093.154] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\desktop.ini.dvodltmf")) returned 0x2020 [0093.154] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8518 [0093.154] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0093.154] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0093.154] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\desktop.ini")) returned 1 [0093.155] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\desktop.ini")) returned 0xffffffff [0093.155] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="History.IE5", cAlternateFileName="")) returned 1 [0093.155] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaa, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0093.155] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaa, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.155] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0xaa, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0093.155] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0093.156] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0093.158] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x91 [0093.158] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0093.158] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0093.246] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x91, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x91, lpOverlapped=0x0) returned 1 [0093.247] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0xa0, lpOverlapped=0x0) returned 1 [0093.248] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0093.274] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.283] CloseHandle (hObject=0xe8) returned 1 [0093.283] CloseHandle (hObject=0xe4) returned 1 [0093.284] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\desktop.ini.dvodltmf")) returned 0 [0093.284] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\desktop.ini.dvodltmf")) returned 0x2020 [0093.284] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8558 [0093.285] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0093.285] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0093.285] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\desktop.ini")) returned 1 [0093.286] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\desktop.ini")) returned 0xffffffff [0093.286] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f0b6db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0b6db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x432daef0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="index.dat", cAlternateFileName="")) returned 1 [0093.286] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0093.286] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\index.dat.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0093.286] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8000 [0093.286] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0093.287] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0093.384] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x8000, lpOverlapped=0x0) returned 1 [0093.386] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x8010, lpOverlapped=0x0) returned 1 [0093.388] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0093.407] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.417] CloseHandle (hObject=0xe4) returned 1 [0093.417] CloseHandle (hObject=0xe8) returned 1 [0093.417] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\index.dat.dvodltmf")) returned 0 [0093.418] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\index.dat.dvodltmf")) returned 0x2020 [0093.418] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f0b6db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0b6db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x432daef0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0x2e8558 [0093.418] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f0b6db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0b6db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x432daef0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0 [0093.418] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0093.418] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\index.dat")) returned 1 [0093.419] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\index.dat")) returned 0xffffffff [0093.419] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="MSHist012017071220170713", cAlternateFileName="MSHIST~1")) returned 1 [0093.419] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0093.419] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.419] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0xbe, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0093.419] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\mshist012017071220170713\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0093.420] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\mshist012017071220170713\\index.dat.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0093.420] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8000 [0093.420] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0093.420] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0093.510] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x8000, lpOverlapped=0x0) returned 1 [0093.511] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x8010, lpOverlapped=0x0) returned 1 [0093.513] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0093.532] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.542] CloseHandle (hObject=0xe4) returned 1 [0093.542] CloseHandle (hObject=0xf4) returned 1 [0093.542] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\mshist012017071220170713\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\mshist012017071220170713\\index.dat.dvodltmf")) returned 0 [0093.542] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\mshist012017071220170713\\index.dat.dvodltmf")) returned 0x2020 [0093.542] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0x2e8598 [0093.543] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0 [0093.543] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0093.543] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\mshist012017071220170713\\index.dat")) returned 1 [0093.544] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\mshist012017071220170713\\index.dat")) returned 0xffffffff [0093.544] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0xbe, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0093.544] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0093.544] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="MSHist012017071220170713", cAlternateFileName="MSHIST~1")) returned 0 [0093.544] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0093.544] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="History.IE5", cAlternateFileName="")) returned 0 [0093.544] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0093.544] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x30313030, dwReserved1=0x32303231, cFileName="Low", cAlternateFileName="")) returned 0 [0093.544] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0093.544] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e7273, dwReserved1=0x5f626262, cFileName="Ringtones", cAlternateFileName="RINGTO~1")) returned 1 [0093.544] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x30313030, dwReserved1=0x32303231, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0093.545] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x30313030, dwReserved1=0x32303231, cFileName="..", cAlternateFileName="")) returned 1 [0093.545] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x30313030, dwReserved1=0x32303231, cFileName="..", cAlternateFileName="")) returned 0 [0093.545] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0093.545] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e7273, dwReserved1=0x5f626262, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0093.545] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x30313030, dwReserved1=0x32303231, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0093.545] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x30313030, dwReserved1=0x32303231, cFileName="..", cAlternateFileName="")) returned 1 [0093.545] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x30313030, dwReserved1=0x32303231, cFileName="Content.IE5", cAlternateFileName="")) returned 1 [0093.546] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31373037, dwReserved1=0x31303232, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0093.546] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31373037, dwReserved1=0x31303232, cFileName="..", cAlternateFileName="")) returned 1 [0093.546] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e570c75, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x31373037, dwReserved1=0x31303232, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0093.546] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0093.546] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0093.547] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0093.548] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0093.548] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0093.636] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x43, lpOverlapped=0x0) returned 1 [0093.637] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x50, lpOverlapped=0x0) returned 1 [0093.638] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0093.658] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.667] CloseHandle (hObject=0xe0) returned 1 [0093.667] CloseHandle (hObject=0xe8) returned 1 [0093.667] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini.dvodltmf")) returned 0 [0093.668] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini.dvodltmf")) returned 0x2020 [0093.668] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e570c75, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8518 [0093.668] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e570c75, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0093.668] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0093.668] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini")) returned 1 [0093.669] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini")) returned 0xffffffff [0093.669] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x75061760, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="index.dat", cAlternateFileName="")) returned 1 [0093.669] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0093.669] CloseHandle (hObject=0xffffffff) returned 0 [0093.669] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat.dvodltmf")) returned 0 [0093.669] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat.dvodltmf")) returned 0xffffffff [0093.669] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x75061760, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0x2e8518 [0093.670] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x75061760, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0 [0093.670] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0093.670] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat")) returned 0 [0093.670] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat")) returned 0x2026 [0093.670] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="MM5O9XQS", cAlternateFileName="")) returned 1 [0093.670] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0093.672] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.673] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0xd8, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0093.673] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0093.674] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0093.674] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0093.674] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0093.674] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0093.765] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x43, lpOverlapped=0x0) returned 1 [0093.840] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x50, lpOverlapped=0x0) returned 1 [0093.841] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0093.861] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.870] CloseHandle (hObject=0xe0) returned 1 [0093.870] CloseHandle (hObject=0xf4) returned 1 [0093.870] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini.dvodltmf")) returned 0 [0093.871] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini.dvodltmf")) returned 0x2020 [0093.871] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8558 [0093.871] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0093.871] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0093.871] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini")) returned 1 [0093.872] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini")) returned 0xffffffff [0093.872] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0xd8, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0093.873] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0093.873] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="PMMR5K9K", cAlternateFileName="")) returned 1 [0093.873] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0093.879] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="..", cAlternateFileName="")) returned 1 [0093.879] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0093.880] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0093.880] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0093.880] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0093.880] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0093.881] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0093.972] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x43, lpOverlapped=0x0) returned 1 [0093.973] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x50, lpOverlapped=0x0) returned 1 [0093.974] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0093.994] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.002] CloseHandle (hObject=0xf4) returned 1 [0094.003] CloseHandle (hObject=0xe0) returned 1 [0094.003] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini.dvodltmf")) returned 0 [0094.003] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini.dvodltmf")) returned 0x2020 [0094.003] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8558 [0094.003] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0094.004] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0094.004] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini")) returned 1 [0094.004] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini")) returned 0xffffffff [0094.004] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0094.005] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0094.005] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="RIJUQL1C", cAlternateFileName="")) returned 1 [0094.005] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0094.009] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="..", cAlternateFileName="")) returned 1 [0094.009] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0094.009] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0094.009] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0094.010] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0094.010] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0094.010] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0094.092] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x43, lpOverlapped=0x0) returned 1 [0094.092] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x50, lpOverlapped=0x0) returned 1 [0094.093] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0094.112] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.121] CloseHandle (hObject=0xe0) returned 1 [0094.121] CloseHandle (hObject=0xf4) returned 1 [0094.121] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini.dvodltmf")) returned 0 [0094.122] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini.dvodltmf")) returned 0x2020 [0094.122] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8558 [0094.122] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0094.122] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0094.122] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini")) returned 1 [0094.123] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini")) returned 0xffffffff [0094.123] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0094.123] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0094.123] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="X9OHK109", cAlternateFileName="")) returned 1 [0094.123] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0094.125] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="..", cAlternateFileName="")) returned 1 [0094.125] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0094.125] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0094.125] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0094.126] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0094.126] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0094.126] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0094.215] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x43, lpOverlapped=0x0) returned 1 [0094.216] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x50, lpOverlapped=0x0) returned 1 [0094.217] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0094.236] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.246] CloseHandle (hObject=0xf4) returned 1 [0094.246] CloseHandle (hObject=0xe0) returned 1 [0094.246] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini.dvodltmf")) returned 0 [0094.247] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini.dvodltmf")) returned 0x2020 [0094.247] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8558 [0094.247] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0094.247] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0094.247] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini")) returned 1 [0094.248] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini")) returned 0xffffffff [0094.248] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0094.248] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0094.248] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="X9OHK109", cAlternateFileName="")) returned 0 [0094.248] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0094.248] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x30313030, dwReserved1=0x32303231, cFileName="Content.MSO", cAlternateFileName="")) returned 1 [0094.248] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0094.251] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="..", cAlternateFileName="")) returned 1 [0094.251] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="..", cAlternateFileName="")) returned 0 [0094.251] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0094.251] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27b4c650, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x30313030, dwReserved1=0x32303231, cFileName="Content.Word", cAlternateFileName="CONTEN~1.WOR")) returned 1 [0094.252] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0094.252] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="..", cAlternateFileName="")) returned 1 [0094.252] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="..", cAlternateFileName="")) returned 0 [0094.252] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0094.252] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe710360, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x30313030, dwReserved1=0x32303231, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0094.252] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0094.253] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0094.254] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0094.254] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0094.254] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0094.340] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x43, lpOverlapped=0x0) returned 1 [0094.341] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x50, lpOverlapped=0x0) returned 1 [0094.341] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0094.372] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.381] CloseHandle (hObject=0xf0) returned 1 [0094.381] CloseHandle (hObject=0xe8) returned 1 [0094.381] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini.dvodltmf")) returned 0 [0094.382] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini.dvodltmf")) returned 0x2020 [0094.382] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe710360, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e84d8 [0094.382] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe710360, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0094.382] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0094.382] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini")) returned 1 [0094.383] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini")) returned 0xffffffff [0094.383] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="Low", cAlternateFileName="")) returned 1 [0094.383] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0094.384] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.384] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc4, dwReserved1=0x0, cFileName="AntiPhishing", cAlternateFileName="ANTIPH~1")) returned 1 [0094.384] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0094.384] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="..", cAlternateFileName="")) returned 1 [0094.384] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x47f94, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat", cAlternateFileName="2CEDBF~1.DAT")) returned 1 [0094.384] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\antiphishing\\2cedbfbc-dba8-43aa-b1fd-cc8e6316e3e2.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0094.384] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\antiphishing\\2cedbfbc-dba8-43aa-b1fd-cc8e6316e3e2.dat.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0094.386] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x47f94 [0094.386] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0094.387] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0094.475] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x47f94, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x47f94, lpOverlapped=0x0) returned 1 [0094.481] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x47fa0, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x47fa0, lpOverlapped=0x0) returned 1 [0094.487] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0094.507] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.517] CloseHandle (hObject=0xe0) returned 1 [0094.517] CloseHandle (hObject=0xf4) returned 1 [0094.517] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\antiphishing\\2cedbfbc-dba8-43aa-b1fd-cc8e6316e3e2.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\antiphishing\\2cedbfbc-dba8-43aa-b1fd-cc8e6316e3e2.dat.dvodltmf")) returned 0 [0094.518] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\antiphishing\\2cedbfbc-dba8-43aa-b1fd-cc8e6316e3e2.dat.dvodltmf")) returned 0x2020 [0094.518] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x47f94, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat", cAlternateFileName="2CEDBF~1.DAT")) returned 0x2e8558 [0094.518] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x47f94, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat", cAlternateFileName="2CEDBF~1.DAT")) returned 0 [0094.518] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0094.518] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\antiphishing\\2cedbfbc-dba8-43aa-b1fd-cc8e6316e3e2.dat")) returned 1 [0094.521] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\antiphishing\\2cedbfbc-dba8-43aa-b1fd-cc8e6316e3e2.dat")) returned 0xffffffff [0094.521] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x47f94, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat", cAlternateFileName="2CEDBF~1.DAT")) returned 0 [0094.521] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0094.521] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3841, dwReserved1=0x2d414133, cFileName="Content.IE5", cAlternateFileName="")) returned 1 [0094.521] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0094.522] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="..", cAlternateFileName="")) returned 1 [0094.522] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5137ebf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x5137ebf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e33e0, dwReserved1=0x18e6b4, cFileName="9QH4S0GZ", cAlternateFileName="")) returned 1 [0094.522] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5137ebf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x5137ebf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x120, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0094.524] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5137ebf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x5137ebf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x120, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.525] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdbb73b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbdbb73b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdc03670, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x39d41, dwReserved0=0x120, dwReserved1=0x0, cFileName="28-8f3193-f30905ea[1]", cAlternateFileName="28-8F3~1")) returned 1 [0094.525] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x551dcf90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x551dcf90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5529b670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ecb, dwReserved0=0x120, dwReserved1=0x0, cFileName="528d82a2[1].js", cAlternateFileName="528D82~1.JS")) returned 1 [0094.525] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\528d82a2[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0094.527] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\528d82a2[1].js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0094.527] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ecb [0094.527] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0094.530] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0094.615] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2ecb, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2ecb, lpOverlapped=0x0) returned 1 [0094.617] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2ed0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2ed0, lpOverlapped=0x0) returned 1 [0094.618] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0094.639] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.648] CloseHandle (hObject=0xe0) returned 1 [0094.648] CloseHandle (hObject=0xe4) returned 1 [0094.648] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\528d82a2[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\528d82a2[1].js.dvodltmf")) returned 0 [0094.649] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\528d82a2[1].js.dvodltmf")) returned 0x2020 [0094.649] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x551dcf90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x551dcf90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5529b670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ecb, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="528d82a2[1].js", cAlternateFileName="528D82~1.JS")) returned 0x2e8598 [0094.649] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x551dcf90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x551dcf90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5529b670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ecb, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="528d82a2[1].js", cAlternateFileName="528D82~1.JS")) returned 0 [0094.649] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0094.649] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\528d82a2[1].js")) returned 1 [0094.650] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\528d82a2[1].js")) returned 0xffffffff [0094.650] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454c4930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x135, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AA3e3XC[2].png", cAlternateFileName="AA3E3X~2.PNG")) returned 1 [0094.650] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0094.651] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0094.652] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x135 [0094.652] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0094.652] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0094.747] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x135, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x135, lpOverlapped=0x0) returned 1 [0094.750] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x140, lpOverlapped=0x0) returned 1 [0094.751] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0094.770] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.789] CloseHandle (hObject=0xe4) returned 1 [0094.789] CloseHandle (hObject=0xe0) returned 1 [0094.789] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png.dvodltmf")) returned 0 [0094.790] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png.dvodltmf")) returned 0x2020 [0094.790] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454c4930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x135, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AA3e3XC[2].png", cAlternateFileName="AA3E3X~2.PNG")) returned 0x2e8598 [0094.790] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454c4930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x135, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AA3e3XC[2].png", cAlternateFileName="AA3E3X~2.PNG")) returned 0 [0094.790] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0094.790] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png")) returned 1 [0094.791] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png")) returned 0xffffffff [0094.792] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AA3vOVA[1].png", cAlternateFileName="AA3VOV~1.PNG")) returned 1 [0094.792] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0094.792] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0094.793] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x28e [0094.793] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0094.793] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0094.878] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x28e, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x28e, lpOverlapped=0x0) returned 1 [0094.879] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x290, lpOverlapped=0x0) returned 1 [0094.880] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0094.900] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.910] CloseHandle (hObject=0xe0) returned 1 [0094.910] CloseHandle (hObject=0xe4) returned 1 [0094.910] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png.dvodltmf")) returned 0 [0094.911] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png.dvodltmf")) returned 0x2020 [0094.911] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AA3vOVA[1].png", cAlternateFileName="AA3VOV~1.PNG")) returned 0x2e8598 [0094.911] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AA3vOVA[1].png", cAlternateFileName="AA3VOV~1.PNG")) returned 0 [0094.911] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0094.911] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png")) returned 1 [0094.912] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png")) returned 0xffffffff [0094.912] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1cd, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AA42EP9[1].png", cAlternateFileName="AA42EP~1.PNG")) returned 1 [0094.912] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0094.912] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0094.913] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1cd [0094.913] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0094.913] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0095.003] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1cd, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1cd, lpOverlapped=0x0) returned 1 [0095.004] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1d0, lpOverlapped=0x0) returned 1 [0095.005] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0095.025] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.034] CloseHandle (hObject=0xe4) returned 1 [0095.034] CloseHandle (hObject=0xe0) returned 1 [0095.034] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png.dvodltmf")) returned 0 [0095.035] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png.dvodltmf")) returned 0x2020 [0095.035] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1cd, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AA42EP9[1].png", cAlternateFileName="AA42EP~1.PNG")) returned 0x2e8598 [0095.035] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1cd, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AA42EP9[1].png", cAlternateFileName="AA42EP~1.PNG")) returned 0 [0095.035] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0095.035] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png")) returned 1 [0095.036] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png")) returned 0xffffffff [0095.036] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x514ddbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x514ddbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x514ddbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x191, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AA54rQj[1].png", cAlternateFileName="AA54RQ~1.PNG")) returned 1 [0095.036] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0095.037] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0095.037] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x191 [0095.037] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0095.038] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0095.121] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x191, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x191, lpOverlapped=0x0) returned 1 [0095.123] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1a0, lpOverlapped=0x0) returned 1 [0095.124] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0095.143] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.152] CloseHandle (hObject=0xe0) returned 1 [0095.152] CloseHandle (hObject=0xe4) returned 1 [0095.152] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png.dvodltmf")) returned 0 [0095.153] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png.dvodltmf")) returned 0x2020 [0095.153] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x514ddbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x514ddbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x514ddbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x191, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AA54rQj[1].png", cAlternateFileName="AA54RQ~1.PNG")) returned 0x2e8598 [0095.153] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x514ddbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x514ddbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x514ddbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x191, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AA54rQj[1].png", cAlternateFileName="AA54RQ~1.PNG")) returned 0 [0095.153] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0095.153] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png")) returned 1 [0095.154] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png")) returned 0xffffffff [0095.154] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19d, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AA61yi9[1].png", cAlternateFileName="AA61YI~1.PNG")) returned 1 [0095.154] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0095.155] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0095.156] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19d [0095.156] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0095.156] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0095.239] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x19d, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x19d, lpOverlapped=0x0) returned 1 [0095.240] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1a0, lpOverlapped=0x0) returned 1 [0095.241] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0095.260] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.269] CloseHandle (hObject=0xe4) returned 1 [0095.269] CloseHandle (hObject=0xe0) returned 1 [0095.269] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png.dvodltmf")) returned 0 [0095.270] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png.dvodltmf")) returned 0x2020 [0095.270] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19d, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AA61yi9[1].png", cAlternateFileName="AA61YI~1.PNG")) returned 0x2e8598 [0095.270] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19d, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AA61yi9[1].png", cAlternateFileName="AA61YI~1.PNG")) returned 0 [0095.270] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0095.270] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png")) returned 1 [0095.271] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png")) returned 0xffffffff [0095.271] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fa5350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fa5350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fa5350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AA8uCo4[1].png", cAlternateFileName="AA8UCO~1.PNG")) returned 1 [0095.271] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0095.272] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0095.272] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c8 [0095.272] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0095.273] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0095.356] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2c8, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2c8, lpOverlapped=0x0) returned 1 [0095.397] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2d0, lpOverlapped=0x0) returned 1 [0095.398] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0095.416] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.426] CloseHandle (hObject=0xe0) returned 1 [0095.426] CloseHandle (hObject=0xe4) returned 1 [0095.427] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png.dvodltmf")) returned 0 [0095.427] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png.dvodltmf")) returned 0x2020 [0095.427] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fa5350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fa5350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fa5350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AA8uCo4[1].png", cAlternateFileName="AA8UCO~1.PNG")) returned 0x2e8598 [0095.427] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fa5350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fa5350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fa5350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AA8uCo4[1].png", cAlternateFileName="AA8UCO~1.PNG")) returned 0 [0095.427] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0095.428] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png")) returned 1 [0095.428] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png")) returned 0xffffffff [0095.429] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4593b270, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4593b270, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4593b270, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x342, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AAdAVrM[1].png", cAlternateFileName="AADAVR~1.PNG")) returned 1 [0095.429] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0095.430] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0095.430] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x342 [0095.430] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0095.430] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0095.558] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x342, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x342, lpOverlapped=0x0) returned 1 [0095.565] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x350, lpOverlapped=0x0) returned 1 [0095.569] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0095.589] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.598] CloseHandle (hObject=0xe4) returned 1 [0095.598] CloseHandle (hObject=0xe0) returned 1 [0095.599] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png.dvodltmf")) returned 0 [0095.599] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png.dvodltmf")) returned 0x2020 [0095.599] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4593b270, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4593b270, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4593b270, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x342, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AAdAVrM[1].png", cAlternateFileName="AADAVR~1.PNG")) returned 0x2e8598 [0095.600] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4593b270, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4593b270, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4593b270, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x342, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AAdAVrM[1].png", cAlternateFileName="AADAVR~1.PNG")) returned 0 [0095.600] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0095.600] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png")) returned 1 [0095.601] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png")) returned 0xffffffff [0095.601] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf4697f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf4697f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf4b5ab0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x21e7, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="adServer[1].htm", cAlternateFileName="ADSERV~1.HTM")) returned 1 [0095.601] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\adserver[1].htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0095.602] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\adserver[1].htm.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0095.602] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x21e7 [0095.602] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0095.603] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0095.696] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x21e7, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x21e7, lpOverlapped=0x0) returned 1 [0095.749] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x21f0, lpOverlapped=0x0) returned 1 [0095.750] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0095.770] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.780] CloseHandle (hObject=0xe0) returned 1 [0095.780] CloseHandle (hObject=0xe4) returned 1 [0095.780] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\adserver[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\adserver[1].htm.dvodltmf")) returned 0 [0095.781] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\adserver[1].htm.dvodltmf")) returned 0x2020 [0095.781] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf4697f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf4697f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf4b5ab0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x21e7, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="adServer[1].htm", cAlternateFileName="ADSERV~1.HTM")) returned 0x2e8598 [0095.781] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf4697f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf4697f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf4b5ab0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x21e7, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="adServer[1].htm", cAlternateFileName="ADSERV~1.HTM")) returned 0 [0095.781] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0095.781] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\adserver[1].htm")) returned 1 [0095.782] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\adserver[1].htm")) returned 0xffffffff [0095.782] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50fa8bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="advertisement.ad[1].js", cAlternateFileName="ADVERT~1.JS")) returned 1 [0095.782] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\advertisement.ad[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0095.802] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\advertisement.ad[1].js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0095.803] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c [0095.803] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0095.803] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0095.891] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1c, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1c, lpOverlapped=0x0) returned 1 [0095.899] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x20, lpOverlapped=0x0) returned 1 [0095.902] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0095.922] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.931] CloseHandle (hObject=0xe4) returned 1 [0095.931] CloseHandle (hObject=0xe0) returned 1 [0095.932] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\advertisement.ad[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\advertisement.ad[1].js.dvodltmf")) returned 0 [0095.932] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\advertisement.ad[1].js.dvodltmf")) returned 0x2020 [0095.932] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50fa8bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="advertisement.ad[1].js", cAlternateFileName="ADVERT~1.JS")) returned 0x2e8598 [0095.932] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50fa8bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="advertisement.ad[1].js", cAlternateFileName="ADVERT~1.JS")) returned 0 [0095.933] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0095.933] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\advertisement.ad[1].js")) returned 1 [0095.933] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\advertisement.ad[1].js")) returned 0xffffffff [0095.933] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x545d0030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x545d0030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x545d0030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40b, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="async_usersync[1]", cAlternateFileName="ASYNC_~1")) returned 1 [0095.934] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe9ff7b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe9ff7b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9ff7b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x534, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="async_usersync[2]", cAlternateFileName="ASYNC_~2")) returned 1 [0095.934] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe9ff7b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe9ff7b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9ff7b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="async_usersync[3]", cAlternateFileName="ASYNC_~3")) returned 1 [0095.934] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454c4930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BB1CcOi[1].png", cAlternateFileName="BB1CCO~1.PNG")) returned 1 [0095.934] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0095.934] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0095.934] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d0 [0095.935] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0095.935] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0096.027] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1d0, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1d0, lpOverlapped=0x0) returned 1 [0096.030] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1e0, lpOverlapped=0x0) returned 1 [0096.031] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0096.051] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.061] CloseHandle (hObject=0xe0) returned 1 [0096.061] CloseHandle (hObject=0xe4) returned 1 [0096.061] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png.dvodltmf")) returned 0 [0096.062] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png.dvodltmf")) returned 0x2020 [0096.063] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454c4930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BB1CcOi[1].png", cAlternateFileName="BB1CCO~1.PNG")) returned 0x2e8598 [0096.063] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454c4930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BB1CcOi[1].png", cAlternateFileName="BB1CCO~1.PNG")) returned 0 [0096.063] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0096.063] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png")) returned 1 [0096.064] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png")) returned 0xffffffff [0096.064] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x310, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BB46JmN[1].png", cAlternateFileName="BB46JM~1.PNG")) returned 1 [0096.064] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0096.066] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0096.066] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x310 [0096.066] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0096.067] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0096.152] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x310, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x310, lpOverlapped=0x0) returned 1 [0096.154] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x320, lpOverlapped=0x0) returned 1 [0096.155] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0096.174] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.184] CloseHandle (hObject=0xe4) returned 1 [0096.184] CloseHandle (hObject=0xe0) returned 1 [0096.184] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png.dvodltmf")) returned 0 [0096.185] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png.dvodltmf")) returned 0x2020 [0096.185] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x310, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BB46JmN[1].png", cAlternateFileName="BB46JM~1.PNG")) returned 0x2e8598 [0096.185] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x310, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BB46JmN[1].png", cAlternateFileName="BB46JM~1.PNG")) returned 0 [0096.185] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0096.185] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png")) returned 1 [0096.186] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png")) returned 0xffffffff [0096.186] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x120, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BB5kJAC[1].png", cAlternateFileName="BB5KJA~1.PNG")) returned 1 [0096.186] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0096.187] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0096.187] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x120 [0096.188] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0096.188] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0096.276] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x120, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x120, lpOverlapped=0x0) returned 1 [0096.277] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x130, lpOverlapped=0x0) returned 1 [0096.279] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0096.300] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.309] CloseHandle (hObject=0xe0) returned 1 [0096.310] CloseHandle (hObject=0xe4) returned 1 [0096.310] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png.dvodltmf")) returned 0 [0096.310] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png.dvodltmf")) returned 0x2020 [0096.310] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x120, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BB5kJAC[1].png", cAlternateFileName="BB5KJA~1.PNG")) returned 0x2e8598 [0096.311] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x120, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BB5kJAC[1].png", cAlternateFileName="BB5KJA~1.PNG")) returned 0 [0096.311] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0096.311] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png")) returned 1 [0096.312] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png")) returned 0xffffffff [0096.312] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53337450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BB5kTiV[1].png", cAlternateFileName="BB5KTI~1.PNG")) returned 1 [0096.312] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0096.313] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0096.313] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x121 [0096.313] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0096.313] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0096.414] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x121, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x121, lpOverlapped=0x0) returned 1 [0096.415] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x130, lpOverlapped=0x0) returned 1 [0096.416] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0096.437] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.446] CloseHandle (hObject=0xe4) returned 1 [0096.446] CloseHandle (hObject=0xe0) returned 1 [0096.447] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png.dvodltmf")) returned 0 [0096.447] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png.dvodltmf")) returned 0x2020 [0096.447] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53337450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BB5kTiV[1].png", cAlternateFileName="BB5KTI~1.PNG")) returned 0x2e8598 [0096.447] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53337450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BB5kTiV[1].png", cAlternateFileName="BB5KTI~1.PNG")) returned 0 [0096.448] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0096.448] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png")) returned 1 [0096.452] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png")) returned 0xffffffff [0096.452] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x18c, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BB6Ma4a[1].png", cAlternateFileName="BB6MA4~1.PNG")) returned 1 [0096.452] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0096.453] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0096.453] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18c [0096.453] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0096.453] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0096.543] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x18c, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x18c, lpOverlapped=0x0) returned 1 [0096.545] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x190, lpOverlapped=0x0) returned 1 [0096.546] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0096.567] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.577] CloseHandle (hObject=0xe0) returned 1 [0096.577] CloseHandle (hObject=0xe4) returned 1 [0096.577] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png.dvodltmf")) returned 0 [0096.578] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png.dvodltmf")) returned 0x2020 [0096.578] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x18c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BB6Ma4a[1].png", cAlternateFileName="BB6MA4~1.PNG")) returned 0x2e8598 [0096.578] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x18c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BB6Ma4a[1].png", cAlternateFileName="BB6MA4~1.PNG")) returned 0 [0096.578] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0096.578] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png")) returned 1 [0096.579] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png")) returned 0xffffffff [0096.579] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x168, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BB74fLs[1].png", cAlternateFileName="BB74FL~1.PNG")) returned 1 [0096.579] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0096.580] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0096.580] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x168 [0096.581] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0096.581] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0096.670] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x168, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x168, lpOverlapped=0x0) returned 1 [0096.672] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x170, lpOverlapped=0x0) returned 1 [0096.673] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0096.693] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.703] CloseHandle (hObject=0xe4) returned 1 [0096.703] CloseHandle (hObject=0xe0) returned 1 [0096.704] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png.dvodltmf")) returned 0 [0096.704] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png.dvodltmf")) returned 0x2020 [0096.704] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x168, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BB74fLs[1].png", cAlternateFileName="BB74FL~1.PNG")) returned 0x2e8598 [0096.704] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x168, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BB74fLs[1].png", cAlternateFileName="BB74FL~1.PNG")) returned 0 [0096.704] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0096.705] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png")) returned 1 [0096.705] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png")) returned 0xffffffff [0096.706] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6421e580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6421e580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x642446e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x333f, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBIqq8[1].jpg", cAlternateFileName="BBBIQQ~1.JPG")) returned 1 [0096.706] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0096.706] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0096.707] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x333f [0096.707] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0096.707] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0096.794] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x333f, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x333f, lpOverlapped=0x0) returned 1 [0096.806] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3340, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x3340, lpOverlapped=0x0) returned 1 [0096.807] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0096.827] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.837] CloseHandle (hObject=0xe0) returned 1 [0096.837] CloseHandle (hObject=0xe4) returned 1 [0096.837] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg.dvodltmf")) returned 0 [0096.838] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg.dvodltmf")) returned 0x2020 [0096.838] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6421e580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6421e580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x642446e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x333f, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBIqq8[1].jpg", cAlternateFileName="BBBIQQ~1.JPG")) returned 0x2e8598 [0096.838] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6421e580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6421e580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x642446e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x333f, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBIqq8[1].jpg", cAlternateFileName="BBBIQQ~1.JPG")) returned 0 [0096.838] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0096.838] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg")) returned 1 [0096.839] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg")) returned 0xffffffff [0096.840] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x90b, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBL0ij[1].jpg", cAlternateFileName="BBBL0I~1.JPG")) returned 1 [0096.840] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0096.840] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0096.841] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x90b [0096.841] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0096.841] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0096.927] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x90b, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x90b, lpOverlapped=0x0) returned 1 [0096.928] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x910, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x910, lpOverlapped=0x0) returned 1 [0096.929] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0096.949] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.959] CloseHandle (hObject=0xe4) returned 1 [0096.959] CloseHandle (hObject=0xe0) returned 1 [0096.959] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg.dvodltmf")) returned 0 [0096.960] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg.dvodltmf")) returned 0x2020 [0096.960] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x90b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBL0ij[1].jpg", cAlternateFileName="BBBL0I~1.JPG")) returned 0x2e8598 [0096.960] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x90b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBL0ij[1].jpg", cAlternateFileName="BBBL0I~1.JPG")) returned 0 [0096.960] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0096.960] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg")) returned 1 [0096.961] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg")) returned 0xffffffff [0096.961] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53630fd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53630fd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53657130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x994, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBLhZX[1].jpg", cAlternateFileName="BBBLHZ~1.JPG")) returned 1 [0096.961] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0096.962] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0096.963] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x994 [0096.963] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0096.963] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0097.059] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x994, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x994, lpOverlapped=0x0) returned 1 [0097.060] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x9a0, lpOverlapped=0x0) returned 1 [0097.061] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0097.081] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.091] CloseHandle (hObject=0xe0) returned 1 [0097.091] CloseHandle (hObject=0xe4) returned 1 [0097.091] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg.dvodltmf")) returned 0 [0097.091] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg.dvodltmf")) returned 0x2020 [0097.092] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53630fd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53630fd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53657130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x994, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBLhZX[1].jpg", cAlternateFileName="BBBLHZ~1.JPG")) returned 0x2e8598 [0097.092] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53630fd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53630fd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53657130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x994, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBLhZX[1].jpg", cAlternateFileName="BBBLHZ~1.JPG")) returned 0 [0097.092] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0097.092] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg")) returned 1 [0097.093] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg")) returned 0xffffffff [0097.093] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53467f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53467f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53467f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28b9, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBNiEo[1].jpg", cAlternateFileName="BBBNIE~1.JPG")) returned 1 [0097.093] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0097.093] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0097.094] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x28b9 [0097.094] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0097.094] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0097.182] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x28b9, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x28b9, lpOverlapped=0x0) returned 1 [0097.185] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x28c0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x28c0, lpOverlapped=0x0) returned 1 [0097.186] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0097.206] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.216] CloseHandle (hObject=0xe4) returned 1 [0097.216] CloseHandle (hObject=0xe0) returned 1 [0097.216] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg.dvodltmf")) returned 0 [0097.217] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg.dvodltmf")) returned 0x2020 [0097.217] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53467f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53467f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53467f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28b9, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBNiEo[1].jpg", cAlternateFileName="BBBNIE~1.JPG")) returned 0x2e8598 [0097.217] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53467f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53467f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53467f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28b9, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBNiEo[1].jpg", cAlternateFileName="BBBNIE~1.JPG")) returned 0 [0097.217] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0097.217] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg")) returned 1 [0097.218] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg")) returned 0xffffffff [0097.219] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b65ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b65ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53b8c150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x176d, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBO1mQ[1].jpg", cAlternateFileName="BBBO1M~1.JPG")) returned 1 [0097.219] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0097.220] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0097.220] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x176d [0097.221] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0097.221] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0097.306] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x176d, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x176d, lpOverlapped=0x0) returned 1 [0097.308] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1770, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1770, lpOverlapped=0x0) returned 1 [0097.309] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0097.329] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.338] CloseHandle (hObject=0xe0) returned 1 [0097.338] CloseHandle (hObject=0xe4) returned 1 [0097.338] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg.dvodltmf")) returned 0 [0097.339] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg.dvodltmf")) returned 0x2020 [0097.339] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b65ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b65ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53b8c150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x176d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBO1mQ[1].jpg", cAlternateFileName="BBBO1M~1.JPG")) returned 0x2e8598 [0097.339] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b65ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b65ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53b8c150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x176d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBO1mQ[1].jpg", cAlternateFileName="BBBO1M~1.JPG")) returned 0 [0097.339] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0097.340] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg")) returned 1 [0097.340] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg")) returned 0xffffffff [0097.340] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d18e120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6d18e120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6d1b4280, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6218, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBO3tl[1].jpg", cAlternateFileName="BBBO3T~1.JPG")) returned 1 [0097.341] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0097.341] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0097.341] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6218 [0097.341] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0097.342] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0097.436] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x6218, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x6218, lpOverlapped=0x0) returned 1 [0097.438] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x6220, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x6220, lpOverlapped=0x0) returned 1 [0097.440] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0097.459] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.469] CloseHandle (hObject=0xe4) returned 1 [0097.469] CloseHandle (hObject=0xe0) returned 1 [0097.469] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg.dvodltmf")) returned 0 [0097.470] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg.dvodltmf")) returned 0x2020 [0097.470] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d18e120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6d18e120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6d1b4280, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6218, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBO3tl[1].jpg", cAlternateFileName="BBBO3T~1.JPG")) returned 0x2e8598 [0097.470] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d18e120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6d18e120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6d1b4280, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6218, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBO3tl[1].jpg", cAlternateFileName="BBBO3T~1.JPG")) returned 0 [0097.470] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0097.470] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg")) returned 1 [0097.472] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg")) returned 0xffffffff [0097.472] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x75a, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBO8dQ[1].jpg", cAlternateFileName="BBBO8D~1.JPG")) returned 1 [0097.472] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0097.473] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0097.473] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x75a [0097.473] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0097.473] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0097.558] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x75a, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x75a, lpOverlapped=0x0) returned 1 [0097.587] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x760, lpOverlapped=0x0) returned 1 [0097.588] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0097.611] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.628] CloseHandle (hObject=0xe0) returned 1 [0097.628] CloseHandle (hObject=0xe4) returned 1 [0097.628] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg.dvodltmf")) returned 0 [0097.628] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg.dvodltmf")) returned 0x2020 [0097.629] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x75a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBO8dQ[1].jpg", cAlternateFileName="BBBO8D~1.JPG")) returned 0x2e8598 [0097.629] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x75a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBO8dQ[1].jpg", cAlternateFileName="BBBO8D~1.JPG")) returned 0 [0097.629] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0097.629] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg")) returned 1 [0097.630] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg")) returned 0xffffffff [0097.630] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x537add90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x537add90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x537add90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d89, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBOe7C[1].jpg", cAlternateFileName="BBBOE7~1.JPG")) returned 1 [0097.630] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0097.630] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0097.631] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d89 [0097.631] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0097.631] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0097.724] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2d89, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2d89, lpOverlapped=0x0) returned 1 [0097.726] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2d90, lpOverlapped=0x0) returned 1 [0097.727] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0097.747] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.757] CloseHandle (hObject=0xe4) returned 1 [0097.757] CloseHandle (hObject=0xe0) returned 1 [0097.757] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg.dvodltmf")) returned 0 [0097.758] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg.dvodltmf")) returned 0x2020 [0097.758] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x537add90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x537add90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x537add90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d89, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBOe7C[1].jpg", cAlternateFileName="BBBOE7~1.JPG")) returned 0x2e8598 [0097.758] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x537add90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x537add90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x537add90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d89, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBOe7C[1].jpg", cAlternateFileName="BBBOE7~1.JPG")) returned 0 [0097.758] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0097.758] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg")) returned 1 [0097.759] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg")) returned 0xffffffff [0097.759] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5303d8d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5303d8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5303d8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1e36, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBPThN[1].jpg", cAlternateFileName="BBBPTH~1.JPG")) returned 1 [0097.759] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0097.780] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0097.781] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1e36 [0097.781] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0097.781] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0097.881] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1e36, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1e36, lpOverlapped=0x0) returned 1 [0097.883] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1e40, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1e40, lpOverlapped=0x0) returned 1 [0097.884] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0097.904] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.914] CloseHandle (hObject=0xe0) returned 1 [0097.914] CloseHandle (hObject=0xe4) returned 1 [0097.914] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg.dvodltmf")) returned 0 [0097.915] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg.dvodltmf")) returned 0x2020 [0097.915] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5303d8d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5303d8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5303d8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1e36, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBPThN[1].jpg", cAlternateFileName="BBBPTH~1.JPG")) returned 0x2e8598 [0097.915] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5303d8d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5303d8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5303d8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1e36, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBPThN[1].jpg", cAlternateFileName="BBBPTH~1.JPG")) returned 0 [0097.915] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0097.915] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg")) returned 1 [0097.916] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg")) returned 0xffffffff [0097.916] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1ee7, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBPUFJ[1].jpg", cAlternateFileName="BBBPUF~1.JPG")) returned 1 [0097.917] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0097.917] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0097.917] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ee7 [0097.917] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0097.918] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0098.003] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1ee7, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1ee7, lpOverlapped=0x0) returned 1 [0098.005] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1ef0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1ef0, lpOverlapped=0x0) returned 1 [0098.006] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0098.026] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.035] CloseHandle (hObject=0xe4) returned 1 [0098.035] CloseHandle (hObject=0xe0) returned 1 [0098.035] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg.dvodltmf")) returned 0 [0098.036] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg.dvodltmf")) returned 0x2020 [0098.036] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1ee7, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBPUFJ[1].jpg", cAlternateFileName="BBBPUF~1.JPG")) returned 0x2e8598 [0098.036] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1ee7, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBPUFJ[1].jpg", cAlternateFileName="BBBPUF~1.JPG")) returned 0 [0098.036] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0098.036] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg")) returned 1 [0098.037] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg")) returned 0xffffffff [0098.037] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533a9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533a9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x924, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBQxzx[1].jpg", cAlternateFileName="BBBQXZ~1.JPG")) returned 1 [0098.037] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0098.038] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0098.039] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x924 [0098.039] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0098.039] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0098.126] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x924, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x924, lpOverlapped=0x0) returned 1 [0098.128] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x930, lpOverlapped=0x0) returned 1 [0098.129] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0098.149] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.158] CloseHandle (hObject=0xe0) returned 1 [0098.158] CloseHandle (hObject=0xe4) returned 1 [0098.158] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg.dvodltmf")) returned 0 [0098.159] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg.dvodltmf")) returned 0x2020 [0098.159] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533a9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533a9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x924, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBQxzx[1].jpg", cAlternateFileName="BBBQXZ~1.JPG")) returned 0x2e8598 [0098.159] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533a9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533a9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x924, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBQxzx[1].jpg", cAlternateFileName="BBBQXZ~1.JPG")) returned 0 [0098.159] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0098.159] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg")) returned 1 [0098.160] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg")) returned 0xffffffff [0098.160] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1963, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBseMP[1].jpg", cAlternateFileName="BBBSEM~1.JPG")) returned 1 [0098.162] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0098.163] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0098.163] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1963 [0098.163] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0098.164] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0098.258] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1963, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1963, lpOverlapped=0x0) returned 1 [0098.260] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1970, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1970, lpOverlapped=0x0) returned 1 [0098.261] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0098.280] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.290] CloseHandle (hObject=0xe4) returned 1 [0098.290] CloseHandle (hObject=0xe0) returned 1 [0098.290] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg.dvodltmf")) returned 0 [0098.291] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg.dvodltmf")) returned 0x2020 [0098.291] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1963, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBseMP[1].jpg", cAlternateFileName="BBBSEM~1.JPG")) returned 0x2e8598 [0098.291] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1963, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBseMP[1].jpg", cAlternateFileName="BBBSEM~1.JPG")) returned 0 [0098.291] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0098.291] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg")) returned 1 [0098.292] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg")) returned 0xffffffff [0098.292] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53af3bd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53af3bd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53af3bd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x16d6, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBsqNL[1].jpg", cAlternateFileName="BBBSQN~1.JPG")) returned 1 [0098.292] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0098.293] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0098.293] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16d6 [0098.293] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0098.293] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0098.397] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x16d6, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x16d6, lpOverlapped=0x0) returned 1 [0098.399] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x16e0, lpOverlapped=0x0) returned 1 [0098.400] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0098.420] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.430] CloseHandle (hObject=0xe0) returned 1 [0098.430] CloseHandle (hObject=0xe4) returned 1 [0098.430] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg.dvodltmf")) returned 0 [0098.431] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg.dvodltmf")) returned 0x2020 [0098.431] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53af3bd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53af3bd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53af3bd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x16d6, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBsqNL[1].jpg", cAlternateFileName="BBBSQN~1.JPG")) returned 0x2e8598 [0098.431] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53af3bd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53af3bd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53af3bd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x16d6, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBsqNL[1].jpg", cAlternateFileName="BBBSQN~1.JPG")) returned 0 [0098.431] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0098.431] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg")) returned 1 [0098.432] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg")) returned 0xffffffff [0098.432] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7ae, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBTpvW[1].jpg", cAlternateFileName="BBBTPV~1.JPG")) returned 1 [0098.432] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0098.433] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0098.433] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7ae [0098.433] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0098.433] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0098.520] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x7ae, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x7ae, lpOverlapped=0x0) returned 1 [0098.522] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x7b0, lpOverlapped=0x0) returned 1 [0098.523] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0098.543] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.553] CloseHandle (hObject=0xe4) returned 1 [0098.553] CloseHandle (hObject=0xe0) returned 1 [0098.553] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg.dvodltmf")) returned 0 [0098.553] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg.dvodltmf")) returned 0x2020 [0098.554] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7ae, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBTpvW[1].jpg", cAlternateFileName="BBBTPV~1.JPG")) returned 0x2e8598 [0098.554] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7ae, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBTpvW[1].jpg", cAlternateFileName="BBBTPV~1.JPG")) returned 0 [0098.554] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0098.554] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg")) returned 1 [0098.555] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg")) returned 0xffffffff [0098.555] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x974, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBVEOW[1].jpg", cAlternateFileName="BBBVEO~1.JPG")) returned 1 [0098.555] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0098.555] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0098.556] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x974 [0098.556] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0098.556] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0098.646] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x974, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x974, lpOverlapped=0x0) returned 1 [0098.648] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x980, lpOverlapped=0x0) returned 1 [0098.649] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0098.668] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.678] CloseHandle (hObject=0xe0) returned 1 [0098.678] CloseHandle (hObject=0xe4) returned 1 [0098.678] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg.dvodltmf")) returned 0 [0098.678] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg.dvodltmf")) returned 0x2020 [0098.678] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x974, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBVEOW[1].jpg", cAlternateFileName="BBBVEO~1.JPG")) returned 0x2e8598 [0098.679] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x974, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBVEOW[1].jpg", cAlternateFileName="BBBVEO~1.JPG")) returned 0 [0098.679] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0098.679] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg")) returned 1 [0098.680] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg")) returned 0xffffffff [0098.680] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1e67, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBVGsM[1].jpg", cAlternateFileName="BBBVGS~1.JPG")) returned 1 [0098.680] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0098.681] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0098.681] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1e67 [0098.681] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0098.681] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0098.768] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1e67, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1e67, lpOverlapped=0x0) returned 1 [0098.777] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1e70, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1e70, lpOverlapped=0x0) returned 1 [0098.778] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0098.798] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.808] CloseHandle (hObject=0xe4) returned 1 [0098.808] CloseHandle (hObject=0xe0) returned 1 [0098.808] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg.dvodltmf")) returned 0 [0098.808] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg.dvodltmf")) returned 0x2020 [0098.808] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1e67, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBVGsM[1].jpg", cAlternateFileName="BBBVGS~1.JPG")) returned 0x2e8598 [0098.809] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1e67, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBVGsM[1].jpg", cAlternateFileName="BBBVGS~1.JPG")) returned 0 [0098.809] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0098.809] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg")) returned 1 [0098.810] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg")) returned 0xffffffff [0098.810] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaa8, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBVIzI[1].jpg", cAlternateFileName="BBBVIZ~1.JPG")) returned 1 [0098.810] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0098.811] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0098.812] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaa8 [0098.812] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0098.812] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0098.905] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xaa8, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0xaa8, lpOverlapped=0x0) returned 1 [0098.907] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0xab0, lpOverlapped=0x0) returned 1 [0098.908] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0098.927] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.937] CloseHandle (hObject=0xe0) returned 1 [0098.937] CloseHandle (hObject=0xe4) returned 1 [0098.937] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg.dvodltmf")) returned 0 [0098.938] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg.dvodltmf")) returned 0x2020 [0098.938] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaa8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBVIzI[1].jpg", cAlternateFileName="BBBVIZ~1.JPG")) returned 0x2e8598 [0098.938] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaa8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBVIzI[1].jpg", cAlternateFileName="BBBVIZ~1.JPG")) returned 0 [0098.938] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0098.938] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg")) returned 1 [0098.939] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg")) returned 0xffffffff [0098.939] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f59090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f59090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f59090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x97a, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBVJ4r[1].jpg", cAlternateFileName="BBBVJ4~1.JPG")) returned 1 [0098.939] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0098.940] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0098.940] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x97a [0098.940] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0098.940] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0099.026] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x97a, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x97a, lpOverlapped=0x0) returned 1 [0099.032] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x980, lpOverlapped=0x0) returned 1 [0099.034] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0099.053] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.063] CloseHandle (hObject=0xe4) returned 1 [0099.063] CloseHandle (hObject=0xe0) returned 1 [0099.063] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg.dvodltmf")) returned 0 [0099.064] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg.dvodltmf")) returned 0x2020 [0099.064] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f59090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f59090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f59090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x97a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBVJ4r[1].jpg", cAlternateFileName="BBBVJ4~1.JPG")) returned 0x2e8598 [0099.064] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f59090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f59090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f59090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x97a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBVJ4r[1].jpg", cAlternateFileName="BBBVJ4~1.JPG")) returned 0 [0099.064] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0099.064] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg")) returned 1 [0099.065] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg")) returned 0xffffffff [0099.065] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5160e6d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5160e6d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5160e6d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7d8, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBVxM8[1].jpg", cAlternateFileName="BBBVXM~1.JPG")) returned 1 [0099.065] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0099.066] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0099.066] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7d8 [0099.066] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0099.067] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0099.158] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x7d8, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x7d8, lpOverlapped=0x0) returned 1 [0099.160] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x7e0, lpOverlapped=0x0) returned 1 [0099.161] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0099.180] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.190] CloseHandle (hObject=0xe0) returned 1 [0099.190] CloseHandle (hObject=0xe4) returned 1 [0099.190] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg.dvodltmf")) returned 0 [0099.191] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg.dvodltmf")) returned 0x2020 [0099.191] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5160e6d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5160e6d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5160e6d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7d8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBVxM8[1].jpg", cAlternateFileName="BBBVXM~1.JPG")) returned 0x2e8598 [0099.191] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5160e6d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5160e6d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5160e6d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7d8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBVxM8[1].jpg", cAlternateFileName="BBBVXM~1.JPG")) returned 0 [0099.191] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0099.191] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg")) returned 1 [0099.192] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg")) returned 0xffffffff [0099.192] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538de890, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538de890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538de890, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8d7, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBz9wz[1].jpg", cAlternateFileName="BBBZ9W~1.JPG")) returned 1 [0099.192] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0099.193] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0099.193] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8d7 [0099.193] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0099.193] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0099.279] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x8d7, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x8d7, lpOverlapped=0x0) returned 1 [0099.281] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x8e0, lpOverlapped=0x0) returned 1 [0099.282] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0099.302] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.311] CloseHandle (hObject=0xe4) returned 1 [0099.311] CloseHandle (hObject=0xe0) returned 1 [0099.311] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg.dvodltmf")) returned 0 [0099.312] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg.dvodltmf")) returned 0x2020 [0099.312] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538de890, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538de890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538de890, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8d7, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBz9wz[1].jpg", cAlternateFileName="BBBZ9W~1.JPG")) returned 0x2e8598 [0099.312] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538de890, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538de890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538de890, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8d7, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBz9wz[1].jpg", cAlternateFileName="BBBZ9W~1.JPG")) returned 0 [0099.312] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0099.312] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg")) returned 1 [0099.313] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg")) returned 0xffffffff [0099.313] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6421e580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6421e580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x642446e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24be, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBzxW1[1].jpg", cAlternateFileName="BBBZXW~1.JPG")) returned 1 [0099.313] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0099.314] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0099.314] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x24be [0099.314] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0099.314] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0099.411] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x24be, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x24be, lpOverlapped=0x0) returned 1 [0099.412] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x24c0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x24c0, lpOverlapped=0x0) returned 1 [0099.414] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0099.433] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.443] CloseHandle (hObject=0xe0) returned 1 [0099.443] CloseHandle (hObject=0xe4) returned 1 [0099.443] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg.dvodltmf")) returned 0 [0099.444] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg.dvodltmf")) returned 0x2020 [0099.444] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6421e580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6421e580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x642446e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24be, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBzxW1[1].jpg", cAlternateFileName="BBBZXW~1.JPG")) returned 0x2e8598 [0099.444] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6421e580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6421e580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x642446e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24be, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBzxW1[1].jpg", cAlternateFileName="BBBZXW~1.JPG")) returned 0 [0099.444] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0099.444] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg")) returned 1 [0099.445] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg")) returned 0xffffffff [0099.445] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6125cc20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6125cc20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x33a8, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBC06Ub[1].jpg", cAlternateFileName="BBC06U~1.JPG")) returned 1 [0099.445] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0099.446] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0099.447] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x33a8 [0099.447] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0099.447] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0099.535] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x33a8, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x33a8, lpOverlapped=0x0) returned 1 [0099.537] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x33b0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x33b0, lpOverlapped=0x0) returned 1 [0099.538] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0099.558] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.567] CloseHandle (hObject=0xe4) returned 1 [0099.567] CloseHandle (hObject=0xe0) returned 1 [0099.567] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg.dvodltmf")) returned 0 [0099.568] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg.dvodltmf")) returned 0x2020 [0099.568] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6125cc20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6125cc20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x33a8, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBC06Ub[1].jpg", cAlternateFileName="BBC06U~1.JPG")) returned 0x2e8598 [0099.568] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6125cc20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6125cc20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x33a8, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBC06Ub[1].jpg", cAlternateFileName="BBC06U~1.JPG")) returned 0 [0099.568] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0099.568] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg")) returned 1 [0099.570] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg")) returned 0xffffffff [0099.570] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53017770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53017770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53017770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBC095c[1].jpg", cAlternateFileName="BBC095~1.JPG")) returned 1 [0099.570] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc095c[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0099.571] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc095c[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0099.571] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x738 [0099.571] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0099.571] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0099.658] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x738, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x738, lpOverlapped=0x0) returned 1 [0099.659] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x740, lpOverlapped=0x0) returned 1 [0099.660] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0099.680] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.690] CloseHandle (hObject=0xe0) returned 1 [0099.690] CloseHandle (hObject=0xe4) returned 1 [0099.690] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc095c[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc095c[1].jpg.dvodltmf")) returned 0 [0099.690] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc095c[1].jpg.dvodltmf")) returned 0x2020 [0099.690] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53017770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53017770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53017770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBC095c[1].jpg", cAlternateFileName="BBC095~1.JPG")) returned 0x2e8598 [0099.691] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53017770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53017770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53017770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBC095c[1].jpg", cAlternateFileName="BBC095~1.JPG")) returned 0 [0099.691] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0099.691] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc095c[1].jpg")) returned 1 [0099.692] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc095c[1].jpg")) returned 0xffffffff [0099.692] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ff1610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ff1610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ff1610, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x17a5, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBC0ALC[1].jpg", cAlternateFileName="BBC0AL~1.JPG")) returned 1 [0099.692] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0alc[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0099.693] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0alc[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0099.693] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17a5 [0099.693] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0099.694] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0099.793] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x17a5, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x17a5, lpOverlapped=0x0) returned 1 [0099.794] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x17b0, lpOverlapped=0x0) returned 1 [0099.795] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0099.815] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.825] CloseHandle (hObject=0xe4) returned 1 [0099.825] CloseHandle (hObject=0xe0) returned 1 [0099.825] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0alc[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0alc[1].jpg.dvodltmf")) returned 0 [0099.825] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0alc[1].jpg.dvodltmf")) returned 0x2020 [0099.826] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ff1610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ff1610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ff1610, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x17a5, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBC0ALC[1].jpg", cAlternateFileName="BBC0AL~1.JPG")) returned 0x2e8598 [0099.826] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ff1610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ff1610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ff1610, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x17a5, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBC0ALC[1].jpg", cAlternateFileName="BBC0AL~1.JPG")) returned 0 [0099.826] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0099.826] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0alc[1].jpg")) returned 1 [0099.827] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0alc[1].jpg")) returned 0xffffffff [0099.827] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53089b90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53089b90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2720, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBC0lYn[1].jpg", cAlternateFileName="BBC0LY~1.JPG")) returned 1 [0099.827] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0lyn[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0099.828] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0lyn[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0099.828] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2720 [0099.828] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0099.829] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0099.923] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2720, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2720, lpOverlapped=0x0) returned 1 [0099.925] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2730, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2730, lpOverlapped=0x0) returned 1 [0099.926] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0099.946] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.955] CloseHandle (hObject=0xe0) returned 1 [0099.956] CloseHandle (hObject=0xe4) returned 1 [0099.956] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0lyn[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0lyn[1].jpg.dvodltmf")) returned 0 [0099.956] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0lyn[1].jpg.dvodltmf")) returned 0x2020 [0099.957] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53089b90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53089b90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2720, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBC0lYn[1].jpg", cAlternateFileName="BBC0LY~1.JPG")) returned 0x2e8598 [0099.957] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53089b90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53089b90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2720, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBC0lYn[1].jpg", cAlternateFileName="BBC0LY~1.JPG")) returned 0 [0099.957] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0099.957] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0lyn[1].jpg")) returned 1 [0099.958] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0lyn[1].jpg")) returned 0xffffffff [0099.958] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f0cdd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f0cdd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f0cdd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x522, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBC0mlu[1].jpg", cAlternateFileName="BBC0ML~1.JPG")) returned 1 [0099.958] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0mlu[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0099.958] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0mlu[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0099.958] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x522 [0099.958] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0099.960] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0100.043] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x522, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x522, lpOverlapped=0x0) returned 1 [0100.045] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x530, lpOverlapped=0x0) returned 1 [0100.046] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0100.065] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.076] CloseHandle (hObject=0xe4) returned 1 [0100.076] CloseHandle (hObject=0xe0) returned 1 [0100.076] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0mlu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0mlu[1].jpg.dvodltmf")) returned 0 [0100.076] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0mlu[1].jpg.dvodltmf")) returned 0x2020 [0100.077] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f0cdd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f0cdd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f0cdd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x522, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBC0mlu[1].jpg", cAlternateFileName="BBC0ML~1.JPG")) returned 0x2e8598 [0100.077] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f0cdd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f0cdd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f0cdd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x522, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBC0mlu[1].jpg", cAlternateFileName="BBC0ML~1.JPG")) returned 0 [0100.077] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0100.077] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0mlu[1].jpg")) returned 1 [0100.078] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0mlu[1].jpg")) returned 0xffffffff [0100.078] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x188f, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBC0rDa[1].jpg", cAlternateFileName="BBC0RD~1.JPG")) returned 1 [0100.078] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0100.078] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0100.079] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x188f [0100.079] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0100.079] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0100.164] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x188f, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x188f, lpOverlapped=0x0) returned 1 [0100.165] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1890, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1890, lpOverlapped=0x0) returned 1 [0100.166] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0100.186] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.195] CloseHandle (hObject=0xe0) returned 1 [0100.195] CloseHandle (hObject=0xe4) returned 1 [0100.196] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[1].jpg.dvodltmf")) returned 0 [0100.196] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[1].jpg.dvodltmf")) returned 0x2020 [0100.196] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x188f, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBC0rDa[1].jpg", cAlternateFileName="BBC0RD~1.JPG")) returned 0x2e8598 [0100.196] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x188f, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBC0rDa[1].jpg", cAlternateFileName="BBC0RD~1.JPG")) returned 0 [0100.197] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0100.197] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[1].jpg")) returned 1 [0100.197] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[1].jpg")) returned 0xffffffff [0100.198] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e9a9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e9a9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e9a9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7fe, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBC0rDa[2].jpg", cAlternateFileName="BBC0RD~2.JPG")) returned 1 [0100.198] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0100.198] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[2].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0100.198] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7fe [0100.198] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0100.199] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0100.284] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x7fe, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x7fe, lpOverlapped=0x0) returned 1 [0100.286] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x800, lpOverlapped=0x0) returned 1 [0100.287] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0100.307] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.316] CloseHandle (hObject=0xe4) returned 1 [0100.316] CloseHandle (hObject=0xe0) returned 1 [0100.317] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[2].jpg.dvodltmf")) returned 0 [0100.317] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[2].jpg.dvodltmf")) returned 0x2020 [0100.317] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e9a9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e9a9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e9a9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7fe, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBC0rDa[2].jpg", cAlternateFileName="BBC0RD~2.JPG")) returned 0x2e8598 [0100.318] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e9a9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e9a9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e9a9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7fe, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBC0rDa[2].jpg", cAlternateFileName="BBC0RD~2.JPG")) returned 0 [0100.318] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0100.318] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[2].jpg")) returned 1 [0100.319] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[2].jpg")) returned 0xffffffff [0100.319] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5e275160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e275160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e275160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x320d, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBC0tCi[1].jpg", cAlternateFileName="BBC0TC~1.JPG")) returned 1 [0100.319] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0tci[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0100.320] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0tci[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0100.320] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x320d [0100.320] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0100.321] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0100.421] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x320d, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x320d, lpOverlapped=0x0) returned 1 [0100.476] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3210, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x3210, lpOverlapped=0x0) returned 1 [0100.477] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0100.497] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.506] CloseHandle (hObject=0xe0) returned 1 [0100.506] CloseHandle (hObject=0xe4) returned 1 [0100.507] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0tci[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0tci[1].jpg.dvodltmf")) returned 0 [0100.507] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0tci[1].jpg.dvodltmf")) returned 0x2020 [0100.507] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5e275160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e275160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e275160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x320d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBC0tCi[1].jpg", cAlternateFileName="BBC0TC~1.JPG")) returned 0x2e8598 [0100.508] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5e275160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e275160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e275160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x320d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBC0tCi[1].jpg", cAlternateFileName="BBC0TC~1.JPG")) returned 0 [0100.508] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0100.508] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0tci[1].jpg")) returned 1 [0100.509] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0tci[1].jpg")) returned 0xffffffff [0100.509] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459d37f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459d37f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459d37f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x28f2, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBDK7Yy[1].jpg", cAlternateFileName="BBDK7Y~1.JPG")) returned 1 [0100.509] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdk7yy[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0100.510] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdk7yy[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0100.510] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x28f2 [0100.510] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0100.511] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0100.598] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x28f2, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x28f2, lpOverlapped=0x0) returned 1 [0100.600] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2900, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2900, lpOverlapped=0x0) returned 1 [0100.601] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0100.621] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.632] CloseHandle (hObject=0xe4) returned 1 [0100.632] CloseHandle (hObject=0xe0) returned 1 [0100.632] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdk7yy[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdk7yy[1].jpg.dvodltmf")) returned 0 [0100.633] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdk7yy[1].jpg.dvodltmf")) returned 0x2020 [0100.633] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459d37f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459d37f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459d37f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x28f2, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBDK7Yy[1].jpg", cAlternateFileName="BBDK7Y~1.JPG")) returned 0x2e8598 [0100.633] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459d37f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459d37f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459d37f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x28f2, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBDK7Yy[1].jpg", cAlternateFileName="BBDK7Y~1.JPG")) returned 0 [0100.633] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0100.633] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdk7yy[1].jpg")) returned 1 [0100.634] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdk7yy[1].jpg")) returned 0xffffffff [0100.634] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458eefb0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458eefb0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458eefb0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBDRbsH[1].jpg", cAlternateFileName="BBDRBS~1.JPG")) returned 1 [0100.634] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdrbsh[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0100.635] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdrbsh[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0100.635] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x83c [0100.636] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0100.636] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0100.721] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x83c, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x83c, lpOverlapped=0x0) returned 1 [0100.727] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x840, lpOverlapped=0x0) returned 1 [0100.728] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0100.747] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.766] CloseHandle (hObject=0xe0) returned 1 [0100.766] CloseHandle (hObject=0xe4) returned 1 [0100.766] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdrbsh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdrbsh[1].jpg.dvodltmf")) returned 0 [0100.767] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdrbsh[1].jpg.dvodltmf")) returned 0x2020 [0100.767] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458eefb0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458eefb0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458eefb0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBDRbsH[1].jpg", cAlternateFileName="BBDRBS~1.JPG")) returned 0x2e8598 [0100.767] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458eefb0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458eefb0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458eefb0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBDRbsH[1].jpg", cAlternateFileName="BBDRBS~1.JPG")) returned 0 [0100.767] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0100.767] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdrbsh[1].jpg")) returned 1 [0100.768] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdrbsh[1].jpg")) returned 0xffffffff [0100.768] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b9c870, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b9c870, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b9c870, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x968, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBDZoZR[1].jpg", cAlternateFileName="BBDZOZ~1.JPG")) returned 1 [0100.768] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdzozr[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0100.769] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdzozr[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0100.769] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x968 [0100.769] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0100.769] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0100.853] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x968, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x968, lpOverlapped=0x0) returned 1 [0100.856] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x970, lpOverlapped=0x0) returned 1 [0100.857] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0100.876] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.894] CloseHandle (hObject=0xe4) returned 1 [0100.894] CloseHandle (hObject=0xe0) returned 1 [0100.894] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdzozr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdzozr[1].jpg.dvodltmf")) returned 0 [0100.896] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdzozr[1].jpg.dvodltmf")) returned 0x2020 [0100.896] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b9c870, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b9c870, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b9c870, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x968, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBDZoZR[1].jpg", cAlternateFileName="BBDZOZ~1.JPG")) returned 0x2e8598 [0100.896] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b9c870, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b9c870, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b9c870, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x968, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBDZoZR[1].jpg", cAlternateFileName="BBDZOZ~1.JPG")) returned 0 [0100.896] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0100.896] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdzozr[1].jpg")) returned 1 [0100.897] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdzozr[1].jpg")) returned 0xffffffff [0100.897] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8d4, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBE97O8[1].jpg", cAlternateFileName="BBE97O~1.JPG")) returned 1 [0100.897] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe97o8[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0100.898] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe97o8[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0100.898] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8d4 [0100.899] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0100.899] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0101.003] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x8d4, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x8d4, lpOverlapped=0x0) returned 1 [0101.005] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x8e0, lpOverlapped=0x0) returned 1 [0101.006] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0101.025] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.035] CloseHandle (hObject=0xe0) returned 1 [0101.035] CloseHandle (hObject=0xe4) returned 1 [0101.035] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe97o8[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe97o8[1].jpg.dvodltmf")) returned 0 [0101.036] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe97o8[1].jpg.dvodltmf")) returned 0x2020 [0101.036] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8d4, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBE97O8[1].jpg", cAlternateFileName="BBE97O~1.JPG")) returned 0x2e8598 [0101.036] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8d4, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBE97O8[1].jpg", cAlternateFileName="BBE97O~1.JPG")) returned 0 [0101.036] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0101.036] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe97o8[1].jpg")) returned 1 [0101.037] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe97o8[1].jpg")) returned 0xffffffff [0101.037] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459d37f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459d37f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459d37f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x6e0, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBE9wSt[1].jpg", cAlternateFileName="BBE9WS~1.JPG")) returned 1 [0101.037] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe9wst[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0101.038] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe9wst[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0101.039] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6e0 [0101.039] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0101.039] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0101.122] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x6e0, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x6e0, lpOverlapped=0x0) returned 1 [0101.124] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x6f0, lpOverlapped=0x0) returned 1 [0101.125] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0101.144] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.154] CloseHandle (hObject=0xe4) returned 1 [0101.154] CloseHandle (hObject=0xe0) returned 1 [0101.154] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe9wst[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe9wst[1].jpg.dvodltmf")) returned 0 [0101.154] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe9wst[1].jpg.dvodltmf")) returned 0x2020 [0101.155] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459d37f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459d37f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459d37f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x6e0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBE9wSt[1].jpg", cAlternateFileName="BBE9WS~1.JPG")) returned 0x2e8598 [0101.155] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459d37f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459d37f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459d37f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x6e0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBE9wSt[1].jpg", cAlternateFileName="BBE9WS~1.JPG")) returned 0 [0101.155] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0101.155] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe9wst[1].jpg")) returned 1 [0101.156] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe9wst[1].jpg")) returned 0xffffffff [0101.156] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a6bd70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a6bd70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a6bd70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8b9, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEcHle[1].jpg", cAlternateFileName="BBECHL~1.JPG")) returned 1 [0101.156] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbechle[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0101.157] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbechle[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0101.157] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8b9 [0101.157] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0101.158] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0101.245] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x8b9, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x8b9, lpOverlapped=0x0) returned 1 [0101.247] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x8c0, lpOverlapped=0x0) returned 1 [0101.248] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0101.267] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.277] CloseHandle (hObject=0xe0) returned 1 [0101.277] CloseHandle (hObject=0xe4) returned 1 [0101.277] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbechle[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbechle[1].jpg.dvodltmf")) returned 0 [0101.277] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbechle[1].jpg.dvodltmf")) returned 0x2020 [0101.278] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a6bd70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a6bd70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a6bd70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8b9, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEcHle[1].jpg", cAlternateFileName="BBECHL~1.JPG")) returned 0x2e8598 [0101.278] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a6bd70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a6bd70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a6bd70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8b9, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEcHle[1].jpg", cAlternateFileName="BBECHL~1.JPG")) returned 0 [0101.278] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0101.278] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbechle[1].jpg")) returned 1 [0101.279] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbechle[1].jpg")) returned 0xffffffff [0101.279] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458eefb0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458eefb0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458eefb0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2086, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEdE0f[1].jpg", cAlternateFileName="BBEDE0~1.JPG")) returned 1 [0101.279] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbede0f[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0101.280] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbede0f[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0101.280] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2086 [0101.280] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0101.280] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0101.371] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2086, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2086, lpOverlapped=0x0) returned 1 [0101.378] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2090, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2090, lpOverlapped=0x0) returned 1 [0101.379] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0101.399] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.408] CloseHandle (hObject=0xe4) returned 1 [0101.408] CloseHandle (hObject=0xe0) returned 1 [0101.408] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbede0f[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbede0f[1].jpg.dvodltmf")) returned 0 [0101.409] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbede0f[1].jpg.dvodltmf")) returned 0x2020 [0101.409] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458eefb0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458eefb0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458eefb0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2086, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEdE0f[1].jpg", cAlternateFileName="BBEDE0~1.JPG")) returned 0x2e8598 [0101.409] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458eefb0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458eefb0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458eefb0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2086, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEdE0f[1].jpg", cAlternateFileName="BBEDE0~1.JPG")) returned 0 [0101.409] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0101.409] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbede0f[1].jpg")) returned 1 [0101.411] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbede0f[1].jpg")) returned 0xffffffff [0101.411] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x97b, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEdoQv[1].jpg", cAlternateFileName="BBEDOQ~1.JPG")) returned 1 [0101.411] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedoqv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0101.412] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedoqv[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0101.412] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x97b [0101.412] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0101.412] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0101.508] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x97b, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x97b, lpOverlapped=0x0) returned 1 [0101.510] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x980, lpOverlapped=0x0) returned 1 [0101.510] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0101.530] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.540] CloseHandle (hObject=0xe0) returned 1 [0101.540] CloseHandle (hObject=0xe4) returned 1 [0101.540] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedoqv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedoqv[1].jpg.dvodltmf")) returned 0 [0101.541] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedoqv[1].jpg.dvodltmf")) returned 0x2020 [0101.541] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x97b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEdoQv[1].jpg", cAlternateFileName="BBEDOQ~1.JPG")) returned 0x2e8598 [0101.541] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x97b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEdoQv[1].jpg", cAlternateFileName="BBEDOQ~1.JPG")) returned 0 [0101.541] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0101.541] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedoqv[1].jpg")) returned 1 [0101.542] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedoqv[1].jpg")) returned 0xffffffff [0101.542] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x69a, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEdqEy[1].jpg", cAlternateFileName="BBEDQE~1.JPG")) returned 1 [0101.542] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedqey[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0101.543] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedqey[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0101.547] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x69a [0101.547] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0101.547] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0101.633] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x69a, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x69a, lpOverlapped=0x0) returned 1 [0101.635] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x6a0, lpOverlapped=0x0) returned 1 [0101.636] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0101.656] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.666] CloseHandle (hObject=0xe4) returned 1 [0101.666] CloseHandle (hObject=0xe0) returned 1 [0101.666] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedqey[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedqey[1].jpg.dvodltmf")) returned 0 [0101.667] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedqey[1].jpg.dvodltmf")) returned 0x2020 [0101.667] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x69a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEdqEy[1].jpg", cAlternateFileName="BBEDQE~1.JPG")) returned 0x2e8598 [0101.667] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x69a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEdqEy[1].jpg", cAlternateFileName="BBEDQE~1.JPG")) returned 0 [0101.667] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0101.667] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedqey[1].jpg")) returned 1 [0101.668] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedqey[1].jpg")) returned 0xffffffff [0101.668] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x6d0, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEdtWw[1].jpg", cAlternateFileName="BBEDTW~1.JPG")) returned 1 [0101.668] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedtww[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0101.670] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedtww[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0101.671] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6d0 [0101.671] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0101.671] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0101.782] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x6d0, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x6d0, lpOverlapped=0x0) returned 1 [0101.784] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x6e0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x6e0, lpOverlapped=0x0) returned 1 [0101.785] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0101.805] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.814] CloseHandle (hObject=0xe0) returned 1 [0101.814] CloseHandle (hObject=0xe4) returned 1 [0101.814] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedtww[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedtww[1].jpg.dvodltmf")) returned 0 [0101.815] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedtww[1].jpg.dvodltmf")) returned 0x2020 [0101.815] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x6d0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEdtWw[1].jpg", cAlternateFileName="BBEDTW~1.JPG")) returned 0x2e8598 [0101.817] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x6d0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEdtWw[1].jpg", cAlternateFileName="BBEDTW~1.JPG")) returned 0 [0101.817] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0101.817] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedtww[1].jpg")) returned 1 [0101.818] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedtww[1].jpg")) returned 0xffffffff [0101.818] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x687, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEdXJj[1].jpg", cAlternateFileName="BBEDXJ~1.JPG")) returned 1 [0101.818] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedxjj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0101.819] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedxjj[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0101.820] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x687 [0101.820] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0101.820] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0101.907] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x687, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x687, lpOverlapped=0x0) returned 1 [0101.917] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x690, lpOverlapped=0x0) returned 1 [0101.918] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0101.938] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.947] CloseHandle (hObject=0xe4) returned 1 [0101.947] CloseHandle (hObject=0xe0) returned 1 [0101.948] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedxjj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedxjj[1].jpg.dvodltmf")) returned 0 [0101.948] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedxjj[1].jpg.dvodltmf")) returned 0x2020 [0101.948] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x687, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEdXJj[1].jpg", cAlternateFileName="BBEDXJ~1.JPG")) returned 0x2e8598 [0101.948] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x687, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEdXJj[1].jpg", cAlternateFileName="BBEDXJ~1.JPG")) returned 0 [0101.949] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0101.949] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedxjj[1].jpg")) returned 1 [0101.949] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedxjj[1].jpg")) returned 0xffffffff [0101.949] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457be4b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457be4b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4580a770, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x24c8, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEeP0k[1].jpg", cAlternateFileName="BBEEP0~1.JPG")) returned 1 [0101.950] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeep0k[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0101.950] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeep0k[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0101.951] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x24c8 [0101.951] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0101.951] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0102.048] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x24c8, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x24c8, lpOverlapped=0x0) returned 1 [0102.050] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x24d0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x24d0, lpOverlapped=0x0) returned 1 [0102.051] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0102.071] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.080] CloseHandle (hObject=0xe0) returned 1 [0102.080] CloseHandle (hObject=0xe4) returned 1 [0102.080] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeep0k[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeep0k[1].jpg.dvodltmf")) returned 0 [0102.081] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeep0k[1].jpg.dvodltmf")) returned 0x2020 [0102.081] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457be4b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457be4b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4580a770, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x24c8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEeP0k[1].jpg", cAlternateFileName="BBEEP0~1.JPG")) returned 0x2e8598 [0102.081] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457be4b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457be4b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4580a770, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x24c8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEeP0k[1].jpg", cAlternateFileName="BBEEP0~1.JPG")) returned 0 [0102.081] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0102.081] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeep0k[1].jpg")) returned 1 [0102.082] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeep0k[1].jpg")) returned 0xffffffff [0102.083] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b76710, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b76710, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b76710, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3417, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEeTuf[1].jpg", cAlternateFileName="BBEETU~1.JPG")) returned 1 [0102.083] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeetuf[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0102.083] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeetuf[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0102.084] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3417 [0102.084] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0102.084] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0102.168] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3417, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x3417, lpOverlapped=0x0) returned 1 [0102.171] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3420, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x3420, lpOverlapped=0x0) returned 1 [0102.173] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0102.193] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.202] CloseHandle (hObject=0xe4) returned 1 [0102.202] CloseHandle (hObject=0xe0) returned 1 [0102.202] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeetuf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeetuf[1].jpg.dvodltmf")) returned 0 [0102.203] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeetuf[1].jpg.dvodltmf")) returned 0x2020 [0102.203] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b76710, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b76710, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b76710, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3417, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEeTuf[1].jpg", cAlternateFileName="BBEETU~1.JPG")) returned 0x2e8598 [0102.203] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b76710, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b76710, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b76710, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3417, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEeTuf[1].jpg", cAlternateFileName="BBEETU~1.JPG")) returned 0 [0102.203] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0102.203] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeetuf[1].jpg")) returned 1 [0102.204] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeetuf[1].jpg")) returned 0xffffffff [0102.204] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xc0b, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEfE6e[1].jpg", cAlternateFileName="BBEFE6~1.JPG")) returned 1 [0102.204] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefe6e[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0102.205] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefe6e[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0102.206] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc0b [0102.206] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0102.206] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0102.291] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xc0b, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0xc0b, lpOverlapped=0x0) returned 1 [0102.292] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0xc10, lpOverlapped=0x0) returned 1 [0102.293] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0102.313] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.322] CloseHandle (hObject=0xe0) returned 1 [0102.323] CloseHandle (hObject=0xe4) returned 1 [0102.323] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefe6e[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefe6e[1].jpg.dvodltmf")) returned 0 [0102.323] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefe6e[1].jpg.dvodltmf")) returned 0x2020 [0102.323] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xc0b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEfE6e[1].jpg", cAlternateFileName="BBEFE6~1.JPG")) returned 0x2e8598 [0102.324] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xc0b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEfE6e[1].jpg", cAlternateFileName="BBEFE6~1.JPG")) returned 0 [0102.324] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0102.324] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefe6e[1].jpg")) returned 1 [0102.325] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefe6e[1].jpg")) returned 0xffffffff [0102.325] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45510bf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45510bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45510bf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3c4c, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEfjuT[1].jpg", cAlternateFileName="BBEFJU~1.JPG")) returned 1 [0102.326] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefjut[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0102.327] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefjut[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0102.327] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3c4c [0102.327] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0102.328] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0102.496] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3c4c, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x3c4c, lpOverlapped=0x0) returned 1 [0102.498] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3c50, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x3c50, lpOverlapped=0x0) returned 1 [0102.499] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0102.518] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.528] CloseHandle (hObject=0xe4) returned 1 [0102.528] CloseHandle (hObject=0xe0) returned 1 [0102.528] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefjut[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefjut[1].jpg.dvodltmf")) returned 0 [0102.529] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefjut[1].jpg.dvodltmf")) returned 0x2020 [0102.529] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45510bf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45510bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45510bf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3c4c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEfjuT[1].jpg", cAlternateFileName="BBEFJU~1.JPG")) returned 0x2e8598 [0102.529] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45510bf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45510bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45510bf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3c4c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEfjuT[1].jpg", cAlternateFileName="BBEFJU~1.JPG")) returned 0 [0102.529] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0102.529] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefjut[1].jpg")) returned 1 [0102.530] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefjut[1].jpg")) returned 0xffffffff [0102.530] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459f9950, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459f9950, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459f9950, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1f0e, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEg9QV[1].jpg", cAlternateFileName="BBEG9Q~1.JPG")) returned 1 [0102.530] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeg9qv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0102.531] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeg9qv[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0102.532] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f0e [0102.532] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0102.532] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0102.616] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1f0e, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1f0e, lpOverlapped=0x0) returned 1 [0102.707] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1f10, lpOverlapped=0x0) returned 1 [0102.708] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0102.730] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.739] CloseHandle (hObject=0xe0) returned 1 [0102.739] CloseHandle (hObject=0xe4) returned 1 [0102.739] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeg9qv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeg9qv[1].jpg.dvodltmf")) returned 0 [0102.740] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeg9qv[1].jpg.dvodltmf")) returned 0x2020 [0102.740] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459f9950, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459f9950, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459f9950, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1f0e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEg9QV[1].jpg", cAlternateFileName="BBEG9Q~1.JPG")) returned 0x2e8598 [0102.740] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459f9950, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459f9950, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459f9950, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1f0e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEg9QV[1].jpg", cAlternateFileName="BBEG9Q~1.JPG")) returned 0 [0102.740] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0102.740] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeg9qv[1].jpg")) returned 1 [0102.741] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeg9qv[1].jpg")) returned 0xffffffff [0102.741] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4587cb90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4587cb90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4587cb90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x980, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEgGSl[1].jpg", cAlternateFileName="BBEGGS~1.JPG")) returned 1 [0102.741] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeggsl[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0102.742] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeggsl[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0102.743] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x980 [0102.743] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0102.743] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0102.829] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x980, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x980, lpOverlapped=0x0) returned 1 [0102.833] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x990, lpOverlapped=0x0) returned 1 [0102.834] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0102.853] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.863] CloseHandle (hObject=0xe4) returned 1 [0102.863] CloseHandle (hObject=0xe0) returned 1 [0102.863] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeggsl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeggsl[1].jpg.dvodltmf")) returned 0 [0102.864] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeggsl[1].jpg.dvodltmf")) returned 0x2020 [0102.864] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4587cb90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4587cb90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4587cb90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x980, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEgGSl[1].jpg", cAlternateFileName="BBEGGS~1.JPG")) returned 0x2e8598 [0102.864] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4587cb90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4587cb90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4587cb90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x980, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEgGSl[1].jpg", cAlternateFileName="BBEGGS~1.JPG")) returned 0 [0102.864] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0102.864] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeggsl[1].jpg")) returned 1 [0102.865] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeggsl[1].jpg")) returned 0xffffffff [0102.865] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23fd, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEgiYw[1].jpg", cAlternateFileName="BBEGIY~1.JPG")) returned 1 [0102.865] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegiyw[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0102.874] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegiyw[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0102.875] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x23fd [0102.876] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0102.876] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0102.972] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x23fd, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x23fd, lpOverlapped=0x0) returned 1 [0102.974] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2400, lpOverlapped=0x0) returned 1 [0102.976] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0102.995] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.005] CloseHandle (hObject=0xe0) returned 1 [0103.005] CloseHandle (hObject=0xe4) returned 1 [0103.005] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegiyw[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegiyw[1].jpg.dvodltmf")) returned 0 [0103.006] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegiyw[1].jpg.dvodltmf")) returned 0x2020 [0103.006] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23fd, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEgiYw[1].jpg", cAlternateFileName="BBEGIY~1.JPG")) returned 0x2e8598 [0103.006] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23fd, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEgiYw[1].jpg", cAlternateFileName="BBEGIY~1.JPG")) returned 0 [0103.006] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0103.006] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegiyw[1].jpg")) returned 1 [0103.008] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegiyw[1].jpg")) returned 0xffffffff [0103.008] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1a59, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEgJfz[1].jpg", cAlternateFileName="BBEGJF~1.JPG")) returned 1 [0103.008] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegjfz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0103.009] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegjfz[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0103.009] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a59 [0103.009] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0103.010] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0103.093] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1a59, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1a59, lpOverlapped=0x0) returned 1 [0103.095] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1a60, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1a60, lpOverlapped=0x0) returned 1 [0103.096] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0103.115] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.125] CloseHandle (hObject=0xe4) returned 1 [0103.125] CloseHandle (hObject=0xe0) returned 1 [0103.125] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegjfz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegjfz[1].jpg.dvodltmf")) returned 0 [0103.126] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegjfz[1].jpg.dvodltmf")) returned 0x2020 [0103.126] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1a59, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEgJfz[1].jpg", cAlternateFileName="BBEGJF~1.JPG")) returned 0x2e8598 [0103.126] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1a59, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEgJfz[1].jpg", cAlternateFileName="BBEGJF~1.JPG")) returned 0 [0103.126] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0103.126] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegjfz[1].jpg")) returned 1 [0103.127] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegjfz[1].jpg")) returned 0xffffffff [0103.127] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7b0, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEgqtY[1].jpg", cAlternateFileName="BBEGQT~1.JPG")) returned 1 [0103.128] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegqty[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0103.128] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegqty[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0103.129] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7b0 [0103.129] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0103.129] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0103.213] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x7b0, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x7b0, lpOverlapped=0x0) returned 1 [0103.214] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x7c0, lpOverlapped=0x0) returned 1 [0103.215] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0103.236] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.246] CloseHandle (hObject=0xe0) returned 1 [0103.246] CloseHandle (hObject=0xe4) returned 1 [0103.246] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegqty[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegqty[1].jpg.dvodltmf")) returned 0 [0103.246] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegqty[1].jpg.dvodltmf")) returned 0x2020 [0103.246] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7b0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEgqtY[1].jpg", cAlternateFileName="BBEGQT~1.JPG")) returned 0x2e8598 [0103.247] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7b0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEgqtY[1].jpg", cAlternateFileName="BBEGQT~1.JPG")) returned 0 [0103.247] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0103.247] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegqty[1].jpg")) returned 1 [0103.248] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegqty[1].jpg")) returned 0xffffffff [0103.248] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x44ec, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEgsz3[1].jpg", cAlternateFileName="BBEGSZ~1.JPG")) returned 1 [0103.248] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegsz3[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0103.249] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegsz3[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0103.249] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x44ec [0103.249] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0103.250] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0103.335] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x44ec, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x44ec, lpOverlapped=0x0) returned 1 [0103.337] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x44f0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x44f0, lpOverlapped=0x0) returned 1 [0103.338] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0103.358] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.374] CloseHandle (hObject=0xe4) returned 1 [0103.374] CloseHandle (hObject=0xe0) returned 1 [0103.374] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegsz3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegsz3[1].jpg.dvodltmf")) returned 0 [0103.374] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegsz3[1].jpg.dvodltmf")) returned 0x2020 [0103.375] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x44ec, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEgsz3[1].jpg", cAlternateFileName="BBEGSZ~1.JPG")) returned 0x2e8598 [0103.375] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x44ec, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEgsz3[1].jpg", cAlternateFileName="BBEGSZ~1.JPG")) returned 0 [0103.375] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0103.375] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegsz3[1].jpg")) returned 1 [0103.377] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegsz3[1].jpg")) returned 0xffffffff [0103.377] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde8add0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde8add0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbde8add0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x171b, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEgtcS[1].jpg", cAlternateFileName="BBEGTC~1.JPG")) returned 1 [0103.377] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0103.378] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0103.378] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x171b [0103.378] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0103.378] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0103.469] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x171b, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x171b, lpOverlapped=0x0) returned 1 [0103.471] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1720, lpOverlapped=0x0) returned 1 [0103.472] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0103.492] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.501] CloseHandle (hObject=0xe0) returned 1 [0103.501] CloseHandle (hObject=0xe4) returned 1 [0103.501] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[1].jpg.dvodltmf")) returned 0 [0103.502] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[1].jpg.dvodltmf")) returned 0x2020 [0103.502] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde8add0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde8add0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbde8add0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x171b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEgtcS[1].jpg", cAlternateFileName="BBEGTC~1.JPG")) returned 0x2e8598 [0103.504] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde8add0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde8add0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbde8add0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x171b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEgtcS[1].jpg", cAlternateFileName="BBEGTC~1.JPG")) returned 0 [0103.504] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0103.504] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[1].jpg")) returned 1 [0103.505] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[1].jpg")) returned 0xffffffff [0103.505] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457721f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457721f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457721f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1826, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEgtcS[2].jpg", cAlternateFileName="BBEGTC~2.JPG")) returned 1 [0103.505] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0103.506] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[2].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0103.506] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1826 [0103.506] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0103.507] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0103.591] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1826, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1826, lpOverlapped=0x0) returned 1 [0103.593] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1830, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1830, lpOverlapped=0x0) returned 1 [0103.594] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0103.614] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.623] CloseHandle (hObject=0xe4) returned 1 [0103.624] CloseHandle (hObject=0xe0) returned 1 [0103.624] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[2].jpg.dvodltmf")) returned 0 [0103.624] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[2].jpg.dvodltmf")) returned 0x2020 [0103.624] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457721f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457721f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457721f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1826, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEgtcS[2].jpg", cAlternateFileName="BBEGTC~2.JPG")) returned 0x2e8598 [0103.626] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457721f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457721f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457721f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1826, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEgtcS[2].jpg", cAlternateFileName="BBEGTC~2.JPG")) returned 0 [0103.626] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0103.626] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[2].jpg")) returned 1 [0103.627] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[2].jpg")) returned 0xffffffff [0103.627] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5e5, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEgx5f[1].jpg", cAlternateFileName="BBEGX5~1.JPG")) returned 1 [0103.627] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0103.628] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0103.629] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5e5 [0103.629] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0103.629] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0103.723] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x5e5, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x5e5, lpOverlapped=0x0) returned 1 [0103.725] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x5f0, lpOverlapped=0x0) returned 1 [0103.726] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0103.745] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.757] CloseHandle (hObject=0xe0) returned 1 [0103.757] CloseHandle (hObject=0xe4) returned 1 [0103.757] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[1].jpg.dvodltmf")) returned 0 [0103.758] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[1].jpg.dvodltmf")) returned 0x2020 [0103.758] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5e5, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEgx5f[1].jpg", cAlternateFileName="BBEGX5~1.JPG")) returned 0x2e8598 [0103.758] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5e5, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEgx5f[1].jpg", cAlternateFileName="BBEGX5~1.JPG")) returned 0 [0103.758] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0103.758] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[1].jpg")) returned 1 [0103.759] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[1].jpg")) returned 0xffffffff [0103.759] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b505b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b505b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b505b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x5e5, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEgx5f[2].jpg", cAlternateFileName="BBEGX5~2.JPG")) returned 1 [0103.759] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0103.760] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[2].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0103.761] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5e5 [0103.761] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0103.761] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0103.886] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x5e5, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x5e5, lpOverlapped=0x0) returned 1 [0103.888] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x5f0, lpOverlapped=0x0) returned 1 [0103.889] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0103.908] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.917] CloseHandle (hObject=0xe4) returned 1 [0103.918] CloseHandle (hObject=0xe0) returned 1 [0103.918] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[2].jpg.dvodltmf")) returned 0 [0103.918] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[2].jpg.dvodltmf")) returned 0x2020 [0103.918] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b505b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b505b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b505b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x5e5, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEgx5f[2].jpg", cAlternateFileName="BBEGX5~2.JPG")) returned 0x2e8598 [0103.919] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b505b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b505b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b505b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x5e5, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEgx5f[2].jpg", cAlternateFileName="BBEGX5~2.JPG")) returned 0 [0103.919] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0103.919] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[2].jpg")) returned 1 [0103.920] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[2].jpg")) returned 0xffffffff [0103.920] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3565, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEgyIm[1].jpg", cAlternateFileName="BBEGYI~1.JPG")) returned 1 [0103.920] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegyim[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0103.920] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegyim[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0103.920] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3565 [0103.920] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0103.921] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0104.013] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3565, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x3565, lpOverlapped=0x0) returned 1 [0104.015] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3570, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x3570, lpOverlapped=0x0) returned 1 [0104.016] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0104.035] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.045] CloseHandle (hObject=0xe0) returned 1 [0104.046] CloseHandle (hObject=0xe4) returned 1 [0104.046] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegyim[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegyim[1].jpg.dvodltmf")) returned 0 [0104.047] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegyim[1].jpg.dvodltmf")) returned 0x2020 [0104.047] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3565, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEgyIm[1].jpg", cAlternateFileName="BBEGYI~1.JPG")) returned 0x2e8598 [0104.047] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3565, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEgyIm[1].jpg", cAlternateFileName="BBEGYI~1.JPG")) returned 0 [0104.047] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0104.047] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegyim[1].jpg")) returned 1 [0104.049] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegyim[1].jpg")) returned 0xffffffff [0104.049] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBg3ODX[2].png", cAlternateFileName="BBG3OD~2.PNG")) returned 1 [0104.049] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbg3odx[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0104.050] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbg3odx[2].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0104.051] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf3 [0104.051] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0104.051] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0104.139] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xf3, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0xf3, lpOverlapped=0x0) returned 1 [0104.141] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x100, lpOverlapped=0x0) returned 1 [0104.142] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0104.162] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.174] CloseHandle (hObject=0xe4) returned 1 [0104.174] CloseHandle (hObject=0xe0) returned 1 [0104.174] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbg3odx[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbg3odx[2].png.dvodltmf")) returned 0 [0104.175] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbg3odx[2].png.dvodltmf")) returned 0x2020 [0104.175] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBg3ODX[2].png", cAlternateFileName="BBG3OD~2.PNG")) returned 0x2e8598 [0104.175] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBg3ODX[2].png", cAlternateFileName="BBG3OD~2.PNG")) returned 0 [0104.175] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0104.175] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbg3odx[2].png")) returned 1 [0104.176] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbg3odx[2].png")) returned 0xffffffff [0104.176] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde8add0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde8add0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbde8add0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x3b9, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBiyCq[1].png", cAlternateFileName="BBIYCQ~1.PNG")) returned 1 [0104.176] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbiycq[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0104.176] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbiycq[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0104.177] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b9 [0104.177] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0104.177] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0104.262] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3b9, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x3b9, lpOverlapped=0x0) returned 1 [0104.264] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x3c0, lpOverlapped=0x0) returned 1 [0104.265] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0104.285] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.295] CloseHandle (hObject=0xe0) returned 1 [0104.295] CloseHandle (hObject=0xe4) returned 1 [0104.295] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbiycq[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbiycq[1].png.dvodltmf")) returned 0 [0104.296] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbiycq[1].png.dvodltmf")) returned 0x2020 [0104.296] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde8add0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde8add0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbde8add0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x3b9, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBiyCq[1].png", cAlternateFileName="BBIYCQ~1.PNG")) returned 0x2e8598 [0104.296] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde8add0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde8add0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbde8add0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x3b9, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBiyCq[1].png", cAlternateFileName="BBIYCQ~1.PNG")) returned 0 [0104.296] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0104.296] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbiycq[1].png")) returned 1 [0104.297] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbiycq[1].png")) returned 0xffffffff [0104.297] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f7f1f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f7f1f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f7f1f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBn4lUU[1].png", cAlternateFileName="BBN4LU~1.PNG")) returned 1 [0104.297] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbn4luu[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0104.298] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbn4luu[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0104.298] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14d [0104.298] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0104.298] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0104.388] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x14d, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x14d, lpOverlapped=0x0) returned 1 [0104.390] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x150, lpOverlapped=0x0) returned 1 [0104.390] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0104.411] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.420] CloseHandle (hObject=0xe4) returned 1 [0104.420] CloseHandle (hObject=0xe0) returned 1 [0104.421] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbn4luu[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbn4luu[1].png.dvodltmf")) returned 0 [0104.421] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbn4luu[1].png.dvodltmf")) returned 0x2020 [0104.421] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f7f1f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f7f1f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f7f1f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBn4lUU[1].png", cAlternateFileName="BBN4LU~1.PNG")) returned 0x2e8598 [0104.421] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f7f1f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f7f1f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f7f1f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBn4lUU[1].png", cAlternateFileName="BBN4LU~1.PNG")) returned 0 [0104.422] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0104.422] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbn4luu[1].png")) returned 1 [0104.422] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbn4luu[1].png")) returned 0xffffffff [0104.423] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBnMKeN[1].png", cAlternateFileName="BBNMKE~1.PNG")) returned 1 [0104.423] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbnmken[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0104.423] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbnmken[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0104.423] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x24b [0104.423] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0104.424] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0104.508] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x24b, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x24b, lpOverlapped=0x0) returned 1 [0104.510] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x250, lpOverlapped=0x0) returned 1 [0104.511] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0104.530] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.540] CloseHandle (hObject=0xe0) returned 1 [0104.540] CloseHandle (hObject=0xe4) returned 1 [0104.540] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbnmken[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbnmken[1].png.dvodltmf")) returned 0 [0104.540] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbnmken[1].png.dvodltmf")) returned 0x2020 [0104.540] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBnMKeN[1].png", cAlternateFileName="BBNMKE~1.PNG")) returned 0x2e8598 [0104.541] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBnMKeN[1].png", cAlternateFileName="BBNMKE~1.PNG")) returned 0 [0104.541] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0104.541] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbnmken[1].png")) returned 1 [0104.542] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbnmken[1].png")) returned 0xffffffff [0104.542] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x38b7, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBwGan9[1].jpg", cAlternateFileName="BBWGAN~1.JPG")) returned 1 [0104.542] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbwgan9[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0104.542] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbwgan9[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0104.543] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x38b7 [0104.543] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0104.543] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0104.629] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x38b7, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x38b7, lpOverlapped=0x0) returned 1 [0104.630] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x38c0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x38c0, lpOverlapped=0x0) returned 1 [0104.631] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0104.651] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.660] CloseHandle (hObject=0xe4) returned 1 [0104.660] CloseHandle (hObject=0xe0) returned 1 [0104.661] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbwgan9[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbwgan9[1].jpg.dvodltmf")) returned 0 [0104.661] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbwgan9[1].jpg.dvodltmf")) returned 0x2020 [0104.661] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x38b7, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBwGan9[1].jpg", cAlternateFileName="BBWGAN~1.JPG")) returned 0x2e8598 [0104.662] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x38b7, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBwGan9[1].jpg", cAlternateFileName="BBWGAN~1.JPG")) returned 0 [0104.662] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0104.662] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbwgan9[1].jpg")) returned 1 [0104.663] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbwgan9[1].jpg")) returned 0xffffffff [0104.663] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36c, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBz3ebk[1].png", cAlternateFileName="BBZ3EB~1.PNG")) returned 1 [0104.663] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbz3ebk[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0104.663] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbz3ebk[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0104.663] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x36c [0104.663] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0104.664] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0104.748] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x36c, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x36c, lpOverlapped=0x0) returned 1 [0104.751] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x370, lpOverlapped=0x0) returned 1 [0104.752] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0104.773] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.783] CloseHandle (hObject=0xe0) returned 1 [0104.783] CloseHandle (hObject=0xe4) returned 1 [0104.783] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbz3ebk[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbz3ebk[1].png.dvodltmf")) returned 0 [0104.784] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbz3ebk[1].png.dvodltmf")) returned 0x2020 [0104.784] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBz3ebk[1].png", cAlternateFileName="BBZ3EB~1.PNG")) returned 0x2e8598 [0104.784] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBz3ebk[1].png", cAlternateFileName="BBZ3EB~1.PNG")) returned 0 [0104.784] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0104.784] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbz3ebk[1].png")) returned 1 [0104.785] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbz3ebk[1].png")) returned 0xffffffff [0104.785] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60d4dd60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60d4dd60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60d4dd60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29ed, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="benefits-5-mobile[1].png", cAlternateFileName="BENEFI~1.PNG")) returned 1 [0104.785] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\benefits-5-mobile[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0104.786] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\benefits-5-mobile[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0104.787] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29ed [0104.787] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0104.787] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0104.870] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x29ed, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x29ed, lpOverlapped=0x0) returned 1 [0104.872] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x29f0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x29f0, lpOverlapped=0x0) returned 1 [0104.873] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0104.892] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.901] CloseHandle (hObject=0xe4) returned 1 [0104.902] CloseHandle (hObject=0xe0) returned 1 [0104.902] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\benefits-5-mobile[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\benefits-5-mobile[1].png.dvodltmf")) returned 0 [0104.902] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\benefits-5-mobile[1].png.dvodltmf")) returned 0x2020 [0104.902] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60d4dd60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60d4dd60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60d4dd60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29ed, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="benefits-5-mobile[1].png", cAlternateFileName="BENEFI~1.PNG")) returned 0x2e8598 [0104.903] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60d4dd60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60d4dd60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60d4dd60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29ed, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="benefits-5-mobile[1].png", cAlternateFileName="BENEFI~1.PNG")) returned 0 [0104.903] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0104.903] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\benefits-5-mobile[1].png")) returned 1 [0104.904] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\benefits-5-mobile[1].png")) returned 0xffffffff [0104.904] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61804060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61804060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61850320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13f3f, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="cb=gapi[1].loaded_1", cAlternateFileName="CB_GAP~1.LOA")) returned 1 [0104.904] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cb=gapi[1].loaded_1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\cb=gapi[1].loaded_1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0104.905] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cb=gapi[1].loaded_1.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\cb=gapi[1].loaded_1.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0104.905] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13f3f [0104.905] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0104.906] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0104.997] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x13f3f, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x13f3f, lpOverlapped=0x0) returned 1 [0104.999] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x13f40, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x13f40, lpOverlapped=0x0) returned 1 [0105.001] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0105.021] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.030] CloseHandle (hObject=0xe0) returned 1 [0105.030] CloseHandle (hObject=0xe4) returned 1 [0105.031] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cb=gapi[1].loaded_1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\cb=gapi[1].loaded_1"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cb=gapi[1].loaded_1.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\cb=gapi[1].loaded_1.dvodltmf")) returned 0 [0105.031] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cb=gapi[1].loaded_1.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\cb=gapi[1].loaded_1.dvodltmf")) returned 0x2020 [0105.031] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cb=gapi[1].loaded_1", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61804060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61804060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61850320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13f3f, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="cb=gapi[1].loaded_1", cAlternateFileName="CB_GAP~1.LOA")) returned 0x2e8598 [0105.032] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61804060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61804060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61850320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13f3f, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="cb=gapi[1].loaded_1", cAlternateFileName="CB_GAP~1.LOA")) returned 0 [0105.032] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0105.032] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cb=gapi[1].loaded_1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\cb=gapi[1].loaded_1")) returned 1 [0105.033] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cb=gapi[1].loaded_1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\cb=gapi[1].loaded_1")) returned 0xffffffff [0105.033] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60ea49c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60ea49c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60ef0c80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c6c, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="chrome-new[1].jpg", cAlternateFileName="CHROME~1.JPG")) returned 1 [0105.033] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\chrome-new[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0105.034] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\chrome-new[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0105.034] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10c6c [0105.034] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0105.035] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0105.119] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x10c6c, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x10c6c, lpOverlapped=0x0) returned 1 [0105.122] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10c70, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x10c70, lpOverlapped=0x0) returned 1 [0105.124] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0105.143] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.152] CloseHandle (hObject=0xe4) returned 1 [0105.153] CloseHandle (hObject=0xe0) returned 1 [0105.153] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\chrome-new[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\chrome-new[1].jpg.dvodltmf")) returned 0 [0105.153] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\chrome-new[1].jpg.dvodltmf")) returned 0x2020 [0105.153] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60ea49c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60ea49c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60ef0c80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c6c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="chrome-new[1].jpg", cAlternateFileName="CHROME~1.JPG")) returned 0x2e8598 [0105.154] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60ea49c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60ea49c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60ef0c80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c6c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="chrome-new[1].jpg", cAlternateFileName="CHROME~1.JPG")) returned 0 [0105.154] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0105.154] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\chrome-new[1].jpg")) returned 1 [0105.155] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\chrome-new[1].jpg")) returned 0xffffffff [0105.155] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60aec760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60aec760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60b128c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4739, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot", cAlternateFileName="CJZKEO~1.EOT")) returned 1 [0105.155] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\cjzkeoubrn4kerxqtauh3fy6323mhuzfjmgtvxag2ie[1].eot"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0105.156] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\cjzkeoubrn4kerxqtauh3fy6323mhuzfjmgtvxag2ie[1].eot.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0105.157] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4739 [0105.157] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0105.157] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0105.240] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4739, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x4739, lpOverlapped=0x0) returned 1 [0105.242] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4740, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x4740, lpOverlapped=0x0) returned 1 [0105.244] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0105.263] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.272] CloseHandle (hObject=0xe0) returned 1 [0105.272] CloseHandle (hObject=0xe4) returned 1 [0105.272] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\cjzkeoubrn4kerxqtauh3fy6323mhuzfjmgtvxag2ie[1].eot"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\cjzkeoubrn4kerxqtauh3fy6323mhuzfjmgtvxag2ie[1].eot.dvodltmf")) returned 0 [0105.273] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\cjzkeoubrn4kerxqtauh3fy6323mhuzfjmgtvxag2ie[1].eot.dvodltmf")) returned 0x2020 [0105.273] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60aec760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60aec760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60b128c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4739, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot", cAlternateFileName="CJZKEO~1.EOT")) returned 0x2e8598 [0105.273] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60aec760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60aec760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60b128c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4739, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot", cAlternateFileName="CJZKEO~1.EOT")) returned 0 [0105.273] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0105.273] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\cjzkeoubrn4kerxqtauh3fy6323mhuzfjmgtvxag2ie[1].eot")) returned 1 [0105.274] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\cjzkeoubrn4kerxqtauh3fy6323mhuzfjmgtvxag2ie[1].eot")) returned 0xffffffff [0105.274] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b8c150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b8c150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53bb22b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7b1, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="ContainerTag[1].js", cAlternateFileName="CONTAI~1.JS")) returned 1 [0105.274] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0105.275] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[1].js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0105.276] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7b1 [0105.276] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0105.276] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0105.420] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x7b1, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x7b1, lpOverlapped=0x0) returned 1 [0105.421] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x7c0, lpOverlapped=0x0) returned 1 [0105.422] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0105.442] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.452] CloseHandle (hObject=0xe4) returned 1 [0105.452] CloseHandle (hObject=0xe0) returned 1 [0105.452] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[1].js.dvodltmf")) returned 0 [0105.452] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[1].js.dvodltmf")) returned 0x2020 [0105.453] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b8c150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b8c150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53bb22b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7b1, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ContainerTag[1].js", cAlternateFileName="CONTAI~1.JS")) returned 0x2e8598 [0105.453] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b8c150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b8c150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53bb22b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7b1, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ContainerTag[1].js", cAlternateFileName="CONTAI~1.JS")) returned 0 [0105.453] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0105.453] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[1].js")) returned 1 [0105.454] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[1].js")) returned 0xffffffff [0105.454] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe6dfad0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe6dfad0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe6dfad0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7b1, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="ContainerTag[2].js", cAlternateFileName="CONTAI~2.JS")) returned 1 [0105.454] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[2].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0105.454] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[2].js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0105.454] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7b1 [0105.455] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0105.455] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0105.557] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x7b1, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x7b1, lpOverlapped=0x0) returned 1 [0105.559] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x7c0, lpOverlapped=0x0) returned 1 [0105.560] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0105.580] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.589] CloseHandle (hObject=0xe0) returned 1 [0105.589] CloseHandle (hObject=0xe4) returned 1 [0105.589] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[2].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[2].js.dvodltmf")) returned 0 [0105.590] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[2].js.dvodltmf")) returned 0x2020 [0105.590] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe6dfad0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe6dfad0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe6dfad0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7b1, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="ContainerTag[2].js", cAlternateFileName="CONTAI~2.JS")) returned 0x2e8598 [0105.590] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe6dfad0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe6dfad0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe6dfad0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7b1, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="ContainerTag[2].js", cAlternateFileName="CONTAI~2.JS")) returned 0 [0105.590] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0105.590] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[2].js")) returned 1 [0105.591] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[2].js")) returned 0xffffffff [0105.591] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5ddbc1a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5ddbc1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5ddbc1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="css[2].txt", cAlternateFileName="CSS_2_~1.TXT")) returned 1 [0105.591] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\css[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0105.598] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\css[2].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0105.599] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbb [0105.599] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0105.599] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0105.723] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xbb, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0xbb, lpOverlapped=0x0) returned 1 [0105.724] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0xc0, lpOverlapped=0x0) returned 1 [0105.726] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0105.745] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.756] CloseHandle (hObject=0xe4) returned 1 [0105.756] CloseHandle (hObject=0xe0) returned 1 [0105.756] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\css[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\css[2].txt.dvodltmf")) returned 0 [0105.757] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\css[2].txt.dvodltmf")) returned 0x2020 [0105.757] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5ddbc1a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5ddbc1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5ddbc1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="css[2].txt", cAlternateFileName="CSS_2_~1.TXT")) returned 0x2e8598 [0105.757] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5ddbc1a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5ddbc1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5ddbc1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="css[2].txt", cAlternateFileName="CSS_2_~1.TXT")) returned 0 [0105.757] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0105.757] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\css[2].txt")) returned 1 [0105.758] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\css[2].txt")) returned 0xffffffff [0105.758] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0105.758] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0105.758] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0105.759] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0105.759] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0105.759] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0105.895] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x43, lpOverlapped=0x0) returned 1 [0105.896] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x50, lpOverlapped=0x0) returned 1 [0105.897] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0105.988] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.998] CloseHandle (hObject=0xe0) returned 1 [0105.998] CloseHandle (hObject=0xe4) returned 1 [0105.998] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\desktop.ini.dvodltmf")) returned 0 [0105.999] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\desktop.ini.dvodltmf")) returned 0x2020 [0105.999] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8598 [0105.999] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0105.999] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0105.999] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\desktop.ini")) returned 1 [0106.000] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\desktop.ini")) returned 0xffffffff [0106.000] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5114bad0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5114bad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x511bdef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x39a21, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="f8-028d9f-f30905ea[1]", cAlternateFileName="F8-028~1")) returned 1 [0106.000] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf893e70, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf893e70, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf893e70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7f78, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="fallback_728x90[1].jpg", cAlternateFileName="FALLBA~1.JPG")) returned 1 [0106.000] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\fallback_728x90[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0106.002] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\fallback_728x90[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0106.002] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7f78 [0106.002] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0106.002] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0106.093] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x7f78, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x7f78, lpOverlapped=0x0) returned 1 [0106.096] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x7f80, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x7f80, lpOverlapped=0x0) returned 1 [0106.097] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0106.117] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.129] CloseHandle (hObject=0xe4) returned 1 [0106.129] CloseHandle (hObject=0xe0) returned 1 [0106.129] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\fallback_728x90[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\fallback_728x90[1].jpg.dvodltmf")) returned 0 [0106.130] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\fallback_728x90[1].jpg.dvodltmf")) returned 0x2020 [0106.130] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf893e70, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf893e70, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf893e70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7f78, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="fallback_728x90[1].jpg", cAlternateFileName="FALLBA~1.JPG")) returned 0x2e8598 [0106.130] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf893e70, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf893e70, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf893e70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7f78, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="fallback_728x90[1].jpg", cAlternateFileName="FALLBA~1.JPG")) returned 0 [0106.130] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0106.130] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\fallback_728x90[1].jpg")) returned 1 [0106.140] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\fallback_728x90[1].jpg")) returned 0xffffffff [0106.140] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xca2, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=627518548[1]", cAlternateFileName="GETYPE~1")) returned 1 [0106.140] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde189b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde189b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbde189b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1305, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=852361999[1]", cAlternateFileName="GETYPE~2")) returned 1 [0106.140] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x551dcf90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x551dcf90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x551dcf90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="ie8[1].txt", cAlternateFileName="IE8_1_~1.TXT")) returned 1 [0106.140] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ie8[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0106.140] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ie8[1].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0106.141] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x66 [0106.141] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0106.141] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0106.226] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x66, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x66, lpOverlapped=0x0) returned 1 [0106.227] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x70, lpOverlapped=0x0) returned 1 [0106.228] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0106.248] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.257] CloseHandle (hObject=0xe0) returned 1 [0106.258] CloseHandle (hObject=0xe4) returned 1 [0106.258] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ie8[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ie8[1].txt.dvodltmf")) returned 0 [0106.258] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ie8[1].txt.dvodltmf")) returned 0x2020 [0106.258] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x551dcf90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x551dcf90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x551dcf90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="ie8[1].txt", cAlternateFileName="IE8_1_~1.TXT")) returned 0x2e8598 [0106.259] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x551dcf90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x551dcf90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x551dcf90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="ie8[1].txt", cAlternateFileName="IE8_1_~1.TXT")) returned 0 [0106.259] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0106.259] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ie8[1].txt")) returned 1 [0106.259] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ie8[1].txt")) returned 0xffffffff [0106.260] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44bff750, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44bff750, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44bff750, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="js[1]", cAlternateFileName="JS_1_~1")) returned 1 [0106.260] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54e4ae90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54e4ae90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e4ae90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x88e7, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="latest[1].eot", cAlternateFileName="LATEST~1.EOT")) returned 1 [0106.260] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\latest[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\latest[1].eot"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0106.260] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\latest[1].eot.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\latest[1].eot.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0106.260] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x88e7 [0106.260] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0106.261] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0106.346] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x88e7, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x88e7, lpOverlapped=0x0) returned 1 [0106.348] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x88f0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x88f0, lpOverlapped=0x0) returned 1 [0106.349] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0106.374] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.383] CloseHandle (hObject=0xe4) returned 1 [0106.383] CloseHandle (hObject=0xe0) returned 1 [0106.383] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\latest[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\latest[1].eot"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\latest[1].eot.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\latest[1].eot.dvodltmf")) returned 0 [0106.384] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\latest[1].eot.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\latest[1].eot.dvodltmf")) returned 0x2020 [0106.384] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\latest[1].eot", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54e4ae90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54e4ae90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e4ae90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x88e7, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="latest[1].eot", cAlternateFileName="LATEST~1.EOT")) returned 0x2e8598 [0106.384] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54e4ae90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54e4ae90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e4ae90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x88e7, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="latest[1].eot", cAlternateFileName="LATEST~1.EOT")) returned 0 [0106.384] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0106.384] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\latest[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\latest[1].eot")) returned 1 [0106.385] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\latest[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\latest[1].eot")) returned 0xffffffff [0106.385] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54772f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54772f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54772f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1180, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="meversion[1]", cAlternateFileName="MEVERS~1")) returned 1 [0106.385] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfaa91b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfaa91b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfaa91b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="only[1].htm", cAlternateFileName="ONLY_1~1.HTM")) returned 1 [0106.385] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\only[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\only[1].htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0106.387] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\only[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\only[1].htm.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0106.388] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0106.388] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0106.388] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0106.477] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x10, lpOverlapped=0x0) returned 1 [0106.478] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0106.498] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.508] CloseHandle (hObject=0xe0) returned 1 [0106.508] CloseHandle (hObject=0xe4) returned 1 [0106.508] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\only[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\only[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\only[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\only[1].htm.dvodltmf")) returned 0 [0106.509] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\only[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\only[1].htm.dvodltmf")) returned 0x2020 [0106.509] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\only[1].htm", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfaa91b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfaa91b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfaa91b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="only[1].htm", cAlternateFileName="ONLY_1~1.HTM")) returned 0x2e8598 [0106.509] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfaa91b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfaa91b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfaa91b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="only[1].htm", cAlternateFileName="ONLY_1~1.HTM")) returned 0 [0106.509] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0106.509] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\only[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\only[1].htm")) returned 1 [0106.509] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\only[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\only[1].htm")) returned 0xffffffff [0106.509] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x56ed3860, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x56ed3860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x56ed3860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="Passport[1].htm", cAlternateFileName="PASSPO~1.HTM")) returned 1 [0106.509] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\passport[1].htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0106.510] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\passport[1].htm.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0106.511] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x140 [0106.511] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0106.511] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0106.596] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x140, lpOverlapped=0x0) returned 1 [0106.597] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x150, lpOverlapped=0x0) returned 1 [0106.598] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0106.618] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.628] CloseHandle (hObject=0xe4) returned 1 [0106.628] CloseHandle (hObject=0xe0) returned 1 [0106.628] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\passport[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\passport[1].htm.dvodltmf")) returned 0 [0106.629] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\passport[1].htm.dvodltmf")) returned 0x2020 [0106.629] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x56ed3860, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x56ed3860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x56ed3860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Passport[1].htm", cAlternateFileName="PASSPO~1.HTM")) returned 0x2e8598 [0106.629] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x56ed3860, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x56ed3860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x56ed3860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Passport[1].htm", cAlternateFileName="PASSPO~1.HTM")) returned 0 [0106.629] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0106.629] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\passport[1].htm")) returned 1 [0106.630] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\passport[1].htm")) returned 0xffffffff [0106.630] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61282d80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61282d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9f32, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="plusone[1].js", cAlternateFileName="PLUSON~1.JS")) returned 1 [0106.630] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\plusone[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0106.631] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\plusone[1].js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0106.632] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9f32 [0106.632] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0106.632] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0106.718] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x9f32, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x9f32, lpOverlapped=0x0) returned 1 [0106.722] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x9f40, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x9f40, lpOverlapped=0x0) returned 1 [0106.723] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0106.743] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.752] CloseHandle (hObject=0xe0) returned 1 [0106.753] CloseHandle (hObject=0xe4) returned 1 [0106.753] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\plusone[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\plusone[1].js.dvodltmf")) returned 0 [0106.753] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\plusone[1].js.dvodltmf")) returned 0x2020 [0106.753] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61282d80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61282d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9f32, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="plusone[1].js", cAlternateFileName="PLUSON~1.JS")) returned 0x2e8598 [0106.754] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61282d80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61282d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9f32, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="plusone[1].js", cAlternateFileName="PLUSON~1.JS")) returned 0 [0106.754] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0106.754] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\plusone[1].js")) returned 1 [0106.755] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\plusone[1].js")) returned 0xffffffff [0106.755] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6371bfc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6371bfc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6371bfc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="postmessageRelay[1].htm", cAlternateFileName="POSTME~1.HTM")) returned 1 [0106.755] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\postmessagerelay[1].htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0106.756] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\postmessagerelay[1].htm.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0106.756] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1fa [0106.756] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0106.756] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0106.843] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1fa, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1fa, lpOverlapped=0x0) returned 1 [0106.844] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x200, lpOverlapped=0x0) returned 1 [0106.845] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0106.864] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.874] CloseHandle (hObject=0xe4) returned 1 [0106.874] CloseHandle (hObject=0xe0) returned 1 [0106.874] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\postmessagerelay[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\postmessagerelay[1].htm.dvodltmf")) returned 0 [0106.875] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\postmessagerelay[1].htm.dvodltmf")) returned 0x2020 [0106.875] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6371bfc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6371bfc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6371bfc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="postmessageRelay[1].htm", cAlternateFileName="POSTME~1.HTM")) returned 0x2e8598 [0106.875] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6371bfc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6371bfc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6371bfc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="postmessageRelay[1].htm", cAlternateFileName="POSTME~1.HTM")) returned 0 [0106.875] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0106.875] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\postmessagerelay[1].htm")) returned 1 [0106.876] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\postmessagerelay[1].htm")) returned 0xffffffff [0106.876] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x555ac120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x555ac120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55a97d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19a6f, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="search[1].htm", cAlternateFileName="SEARCH~1.HTM")) returned 1 [0106.876] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\search[1].htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0106.876] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\search[1].htm.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0106.876] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19a6f [0106.876] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0106.877] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0106.959] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x19a6f, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x19a6f, lpOverlapped=0x0) returned 1 [0106.970] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x19a70, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x19a70, lpOverlapped=0x0) returned 1 [0106.973] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0106.992] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.002] CloseHandle (hObject=0xe0) returned 1 [0107.002] CloseHandle (hObject=0xe4) returned 1 [0107.002] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\search[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\search[1].htm.dvodltmf")) returned 0 [0107.002] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\search[1].htm.dvodltmf")) returned 0x2020 [0107.003] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x555ac120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x555ac120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55a97d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19a6f, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="search[1].htm", cAlternateFileName="SEARCH~1.HTM")) returned 0x2e8598 [0107.003] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x555ac120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x555ac120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55a97d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19a6f, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="search[1].htm", cAlternateFileName="SEARCH~1.HTM")) returned 0 [0107.003] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0107.003] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\search[1].htm")) returned 1 [0107.004] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\search[1].htm")) returned 0xffffffff [0107.004] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54772f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54772f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54772f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c85b, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="uhf-west-european-default.min[1].css", cAlternateFileName="UHF-WE~1.CSS")) returned 1 [0107.004] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\uhf-west-european-default.min[1].css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0107.005] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\uhf-west-european-default.min[1].css.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0107.005] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c85b [0107.005] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0107.005] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0107.089] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1c85b, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1c85b, lpOverlapped=0x0) returned 1 [0107.092] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1c860, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1c860, lpOverlapped=0x0) returned 1 [0107.095] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0107.115] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.124] CloseHandle (hObject=0xe4) returned 1 [0107.124] CloseHandle (hObject=0xe0) returned 1 [0107.125] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\uhf-west-european-default.min[1].css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\uhf-west-european-default.min[1].css.dvodltmf")) returned 0 [0107.125] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\uhf-west-european-default.min[1].css.dvodltmf")) returned 0x2020 [0107.125] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54772f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54772f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54772f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c85b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="uhf-west-european-default.min[1].css", cAlternateFileName="UHF-WE~1.CSS")) returned 0x2e8598 [0107.126] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54772f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54772f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54772f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c85b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="uhf-west-european-default.min[1].css", cAlternateFileName="UHF-WE~1.CSS")) returned 0 [0107.126] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0107.126] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\uhf-west-european-default.min[1].css")) returned 1 [0107.127] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\uhf-west-european-default.min[1].css")) returned 0xffffffff [0107.127] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54726c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54726c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54726c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1687, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="WebCore.4.19.0.ltr.light.min[1].css", cAlternateFileName="WEBCOR~1.CSS")) returned 1 [0107.127] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\webcore.4.19.0.ltr.light.min[1].css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0107.127] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\webcore.4.19.0.ltr.light.min[1].css.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0107.128] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1687 [0107.128] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0107.128] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0107.213] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1687, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1687, lpOverlapped=0x0) returned 1 [0107.215] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1690, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1690, lpOverlapped=0x0) returned 1 [0107.216] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0107.235] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.245] CloseHandle (hObject=0xe0) returned 1 [0107.245] CloseHandle (hObject=0xe4) returned 1 [0107.245] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\webcore.4.19.0.ltr.light.min[1].css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\webcore.4.19.0.ltr.light.min[1].css.dvodltmf")) returned 0 [0107.246] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\webcore.4.19.0.ltr.light.min[1].css.dvodltmf")) returned 0x2020 [0107.246] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54726c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54726c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54726c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1687, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="WebCore.4.19.0.ltr.light.min[1].css", cAlternateFileName="WEBCOR~1.CSS")) returned 0x2e8598 [0107.246] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54726c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54726c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54726c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1687, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="WebCore.4.19.0.ltr.light.min[1].css", cAlternateFileName="WEBCOR~1.CSS")) returned 0 [0107.246] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0107.246] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\webcore.4.19.0.ltr.light.min[1].css")) returned 1 [0107.247] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\webcore.4.19.0.ltr.light.min[1].css")) returned 0xffffffff [0107.247] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54726c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54726c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54726c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1687, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="WebCore.4.19.0.ltr.light.min[1].css", cAlternateFileName="WEBCOR~1.CSS")) returned 0 [0107.247] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0107.247] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e302e39, dwReserved1=0x2e72746c, cFileName="ABV8L7MY", cAlternateFileName="")) returned 1 [0107.247] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0107.249] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="..", cAlternateFileName="")) returned 1 [0107.250] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfa36d90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfa36d90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfa83050, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xe455, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="000000929096[1].gif", cAlternateFileName="000000~1.GIF")) returned 1 [0107.250] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\000000929096[1].gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0107.251] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\000000929096[1].gif.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0107.251] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe455 [0107.251] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0107.252] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0107.336] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe455, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0xe455, lpOverlapped=0x0) returned 1 [0107.339] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe460, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0xe460, lpOverlapped=0x0) returned 1 [0107.340] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0107.407] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.421] CloseHandle (hObject=0xe4) returned 1 [0107.421] CloseHandle (hObject=0xe0) returned 1 [0107.421] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\000000929096[1].gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\000000929096[1].gif.dvodltmf")) returned 0 [0107.422] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\000000929096[1].gif.dvodltmf")) returned 0x2020 [0107.422] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfa36d90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfa36d90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfa83050, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xe455, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="000000929096[1].gif", cAlternateFileName="000000~1.GIF")) returned 0x2e8598 [0107.422] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfa36d90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfa36d90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfa83050, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xe455, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="000000929096[1].gif", cAlternateFileName="000000~1.GIF")) returned 0 [0107.422] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0107.422] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\000000929096[1].gif")) returned 1 [0107.423] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\000000929096[1].gif")) returned 0xffffffff [0107.423] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6384cac0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6384cac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6384cac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2929, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="1223855322-postmessagerelay[1].js", cAlternateFileName="122385~1.JS")) returned 1 [0107.423] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\1223855322-postmessagerelay[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0107.424] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\1223855322-postmessagerelay[1].js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0107.424] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2929 [0107.424] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0107.424] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0107.511] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2929, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2929, lpOverlapped=0x0) returned 1 [0107.513] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2930, lpOverlapped=0x0) returned 1 [0107.514] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0107.533] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.543] CloseHandle (hObject=0xe0) returned 1 [0107.543] CloseHandle (hObject=0xe4) returned 1 [0107.543] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\1223855322-postmessagerelay[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\1223855322-postmessagerelay[1].js.dvodltmf")) returned 0 [0107.544] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\1223855322-postmessagerelay[1].js.dvodltmf")) returned 0x2020 [0107.544] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6384cac0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6384cac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6384cac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2929, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="1223855322-postmessagerelay[1].js", cAlternateFileName="122385~1.JS")) returned 0x2e8598 [0107.544] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6384cac0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6384cac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6384cac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2929, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="1223855322-postmessagerelay[1].js", cAlternateFileName="122385~1.JS")) returned 0 [0107.544] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0107.544] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\1223855322-postmessagerelay[1].js")) returned 1 [0107.545] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\1223855322-postmessagerelay[1].js")) returned 0xffffffff [0107.545] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AA3e1oO[1].png", cAlternateFileName="AA3E1O~1.PNG")) returned 1 [0107.545] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa3e1oo[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0107.546] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa3e1oo[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0107.546] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29b [0107.546] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0107.546] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0107.632] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x29b, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x29b, lpOverlapped=0x0) returned 1 [0107.634] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2a0, lpOverlapped=0x0) returned 1 [0107.635] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0107.654] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.663] CloseHandle (hObject=0xe4) returned 1 [0107.663] CloseHandle (hObject=0xe0) returned 1 [0107.664] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa3e1oo[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa3e1oo[1].png.dvodltmf")) returned 0 [0107.664] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa3e1oo[1].png.dvodltmf")) returned 0x2020 [0107.664] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AA3e1oO[1].png", cAlternateFileName="AA3E1O~1.PNG")) returned 0x2e8598 [0107.665] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AA3e1oO[1].png", cAlternateFileName="AA3E1O~1.PNG")) returned 0 [0107.665] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0107.665] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa3e1oo[1].png")) returned 1 [0107.666] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa3e1oo[1].png")) returned 0xffffffff [0107.666] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459d37f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459d37f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459d37f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AA429NP[1].png", cAlternateFileName="AA429N~1.PNG")) returned 1 [0107.666] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa429np[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0107.667] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa429np[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0107.667] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x265 [0107.667] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0107.667] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0107.832] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x265, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x265, lpOverlapped=0x0) returned 1 [0108.452] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x270, lpOverlapped=0x0) returned 1 [0108.453] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0108.473] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.483] CloseHandle (hObject=0xe0) returned 1 [0108.483] CloseHandle (hObject=0xe4) returned 1 [0108.483] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa429np[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa429np[1].png.dvodltmf")) returned 0 [0108.484] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa429np[1].png.dvodltmf")) returned 0x2020 [0108.484] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459d37f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459d37f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459d37f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AA429NP[1].png", cAlternateFileName="AA429N~1.PNG")) returned 0x2e8598 [0108.484] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459d37f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459d37f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459d37f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AA429NP[1].png", cAlternateFileName="AA429N~1.PNG")) returned 0 [0108.484] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0108.484] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa429np[1].png")) returned 1 [0108.485] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa429np[1].png")) returned 0xffffffff [0108.485] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530d5e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530d5e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530fbfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x252, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AA42pjY[1].png", cAlternateFileName="AA42PJ~1.PNG")) returned 1 [0108.485] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa42pjy[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0108.485] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa42pjy[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0108.486] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x252 [0108.486] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0108.486] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0108.573] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x252, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x252, lpOverlapped=0x0) returned 1 [0108.574] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x260, lpOverlapped=0x0) returned 1 [0108.575] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0108.594] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.604] CloseHandle (hObject=0xe4) returned 1 [0108.604] CloseHandle (hObject=0xe0) returned 1 [0108.604] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa42pjy[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa42pjy[1].png.dvodltmf")) returned 0 [0108.605] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa42pjy[1].png.dvodltmf")) returned 0x2020 [0108.605] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530d5e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530d5e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530fbfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x252, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AA42pjY[1].png", cAlternateFileName="AA42PJ~1.PNG")) returned 0x2e8598 [0108.605] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530d5e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530d5e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530fbfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x252, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AA42pjY[1].png", cAlternateFileName="AA42PJ~1.PNG")) returned 0 [0108.605] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0108.605] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa42pjy[1].png")) returned 1 [0108.606] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa42pjy[1].png")) returned 0xffffffff [0108.606] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe327870, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe327870, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe327870, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AA61AKN[2].png", cAlternateFileName="AA61AK~2.PNG")) returned 1 [0108.606] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa61akn[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0108.607] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa61akn[2].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0108.607] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x248 [0108.607] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0108.607] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0108.692] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x248, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x248, lpOverlapped=0x0) returned 1 [0108.694] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x250, lpOverlapped=0x0) returned 1 [0108.695] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0108.714] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.723] CloseHandle (hObject=0xe0) returned 1 [0108.723] CloseHandle (hObject=0xe4) returned 1 [0108.724] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa61akn[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa61akn[2].png.dvodltmf")) returned 0 [0108.724] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa61akn[2].png.dvodltmf")) returned 0x2020 [0108.724] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe327870, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe327870, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe327870, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AA61AKN[2].png", cAlternateFileName="AA61AK~2.PNG")) returned 0x2e8598 [0108.724] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe327870, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe327870, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe327870, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AA61AKN[2].png", cAlternateFileName="AA61AK~2.PNG")) returned 0 [0108.724] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0108.724] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa61akn[2].png")) returned 1 [0108.725] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa61akn[2].png")) returned 0xffffffff [0108.725] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AA6KizP[2].png", cAlternateFileName="AA6KIZ~2.PNG")) returned 1 [0108.725] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa6kizp[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0108.726] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa6kizp[2].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0108.726] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x21b [0108.726] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0108.726] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0108.810] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x21b, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x21b, lpOverlapped=0x0) returned 1 [0108.811] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x220, lpOverlapped=0x0) returned 1 [0108.812] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0108.831] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.841] CloseHandle (hObject=0xe4) returned 1 [0108.841] CloseHandle (hObject=0xe0) returned 1 [0108.841] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa6kizp[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa6kizp[2].png.dvodltmf")) returned 0 [0108.842] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa6kizp[2].png.dvodltmf")) returned 0x2020 [0108.842] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AA6KizP[2].png", cAlternateFileName="AA6KIZ~2.PNG")) returned 0x2e8598 [0108.842] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AA6KizP[2].png", cAlternateFileName="AA6KIZ~2.PNG")) returned 0 [0108.842] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0108.842] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa6kizp[2].png")) returned 1 [0108.843] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa6kizp[2].png")) returned 0xffffffff [0108.843] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x27b, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AA7XCQ3[1].png", cAlternateFileName="AA7XCQ~1.PNG")) returned 1 [0108.843] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa7xcq3[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0108.844] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa7xcq3[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0108.844] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x27b [0108.844] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0108.845] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0108.932] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x27b, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x27b, lpOverlapped=0x0) returned 1 [0108.933] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x280, lpOverlapped=0x0) returned 1 [0108.934] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0108.954] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.964] CloseHandle (hObject=0xe0) returned 1 [0108.964] CloseHandle (hObject=0xe4) returned 1 [0108.964] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa7xcq3[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa7xcq3[1].png.dvodltmf")) returned 0 [0108.965] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa7xcq3[1].png.dvodltmf")) returned 0x2020 [0108.965] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x27b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AA7XCQ3[1].png", cAlternateFileName="AA7XCQ~1.PNG")) returned 0x2e8598 [0108.965] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x27b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AA7XCQ3[1].png", cAlternateFileName="AA7XCQ~1.PNG")) returned 0 [0108.965] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0108.965] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa7xcq3[1].png")) returned 1 [0108.966] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa7xcq3[1].png")) returned 0xffffffff [0108.966] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45510bf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45510bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AA8Tave[1].png", cAlternateFileName="AA8TAV~1.PNG")) returned 1 [0108.966] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa8tave[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0108.966] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa8tave[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0108.966] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x268 [0108.967] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0108.967] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0109.059] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x268, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x268, lpOverlapped=0x0) returned 1 [0109.061] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x270, lpOverlapped=0x0) returned 1 [0109.062] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0109.081] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.091] CloseHandle (hObject=0xe4) returned 1 [0109.091] CloseHandle (hObject=0xe0) returned 1 [0109.091] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa8tave[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa8tave[1].png.dvodltmf")) returned 0 [0109.092] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa8tave[1].png.dvodltmf")) returned 0x2020 [0109.092] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45510bf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45510bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AA8Tave[1].png", cAlternateFileName="AA8TAV~1.PNG")) returned 0x2e8598 [0109.092] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45510bf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45510bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AA8Tave[1].png", cAlternateFileName="AA8TAV~1.PNG")) returned 0 [0109.092] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0109.092] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa8tave[1].png")) returned 1 [0109.093] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa8tave[1].png")) returned 0xffffffff [0109.093] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x21e, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AAfOIDq[1].png", cAlternateFileName="AAFOID~1.PNG")) returned 1 [0109.093] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aafoidq[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0109.093] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aafoidq[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0109.094] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x21e [0109.094] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0109.094] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0109.177] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x21e, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x21e, lpOverlapped=0x0) returned 1 [0109.179] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x220, lpOverlapped=0x0) returned 1 [0109.179] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0109.198] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.208] CloseHandle (hObject=0xe0) returned 1 [0109.208] CloseHandle (hObject=0xe4) returned 1 [0109.208] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aafoidq[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aafoidq[1].png.dvodltmf")) returned 0 [0109.209] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aafoidq[1].png.dvodltmf")) returned 0x2020 [0109.209] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x21e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AAfOIDq[1].png", cAlternateFileName="AAFOID~1.PNG")) returned 0x2e8598 [0109.209] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x21e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AAfOIDq[1].png", cAlternateFileName="AAFOID~1.PNG")) returned 0 [0109.209] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0109.209] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aafoidq[1].png")) returned 1 [0109.210] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aafoidq[1].png")) returned 0xffffffff [0109.210] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2e3, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AAkhMz9[2].png", cAlternateFileName="AAKHMZ~2.PNG")) returned 1 [0109.210] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aakhmz9[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0109.211] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aakhmz9[2].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0109.211] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2e3 [0109.211] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0109.211] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0109.295] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2e3, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2e3, lpOverlapped=0x0) returned 1 [0109.297] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2f0, lpOverlapped=0x0) returned 1 [0109.298] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0109.317] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.327] CloseHandle (hObject=0xe4) returned 1 [0109.327] CloseHandle (hObject=0xe0) returned 1 [0109.327] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aakhmz9[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aakhmz9[2].png.dvodltmf")) returned 0 [0109.328] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aakhmz9[2].png.dvodltmf")) returned 0x2020 [0109.328] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2e3, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AAkhMz9[2].png", cAlternateFileName="AAKHMZ~2.PNG")) returned 0x2e8598 [0109.328] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2e3, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AAkhMz9[2].png", cAlternateFileName="AAKHMZ~2.PNG")) returned 0 [0109.328] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0109.328] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aakhmz9[2].png")) returned 1 [0109.329] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aakhmz9[2].png")) returned 0xffffffff [0109.329] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AAmRY2Q[1].png", cAlternateFileName="AAMRY2~1.PNG")) returned 1 [0109.329] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aamry2q[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0109.329] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aamry2q[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0109.330] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12c [0109.330] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0109.330] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0109.418] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x12c, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x12c, lpOverlapped=0x0) returned 1 [0109.420] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x130, lpOverlapped=0x0) returned 1 [0109.421] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0109.441] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.450] CloseHandle (hObject=0xe0) returned 1 [0109.451] CloseHandle (hObject=0xe4) returned 1 [0109.451] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aamry2q[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aamry2q[1].png.dvodltmf")) returned 0 [0109.451] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aamry2q[1].png.dvodltmf")) returned 0x2020 [0109.451] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AAmRY2Q[1].png", cAlternateFileName="AAMRY2~1.PNG")) returned 0x2e8598 [0109.452] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AAmRY2Q[1].png", cAlternateFileName="AAMRY2~1.PNG")) returned 0 [0109.452] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0109.452] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aamry2q[1].png")) returned 1 [0109.453] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aamry2q[1].png")) returned 0xffffffff [0109.453] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AAni8qk[1].png", cAlternateFileName="AANI8Q~1.PNG")) returned 1 [0109.453] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aani8qk[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0109.453] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aani8qk[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0109.453] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x391 [0109.453] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0109.454] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0109.538] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x391, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x391, lpOverlapped=0x0) returned 1 [0109.539] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x3a0, lpOverlapped=0x0) returned 1 [0109.540] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0109.560] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.569] CloseHandle (hObject=0xe4) returned 1 [0109.569] CloseHandle (hObject=0xe0) returned 1 [0109.569] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aani8qk[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aani8qk[1].png.dvodltmf")) returned 0 [0109.570] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aani8qk[1].png.dvodltmf")) returned 0x2020 [0109.570] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AAni8qk[1].png", cAlternateFileName="AANI8Q~1.PNG")) returned 0x2e8598 [0109.570] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AAni8qk[1].png", cAlternateFileName="AANI8Q~1.PNG")) returned 0 [0109.570] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0109.570] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aani8qk[1].png")) returned 1 [0109.571] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aani8qk[1].png")) returned 0xffffffff [0109.571] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf1239b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf1239b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf1239b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7a52, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="adition[1].js", cAlternateFileName="ADITIO~1.JS")) returned 1 [0109.571] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\adition[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0109.571] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\adition[1].js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0109.572] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7a52 [0109.572] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0109.572] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0109.657] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x7a52, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x7a52, lpOverlapped=0x0) returned 1 [0109.659] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x7a60, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x7a60, lpOverlapped=0x0) returned 1 [0109.661] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0109.681] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.690] CloseHandle (hObject=0xe0) returned 1 [0109.690] CloseHandle (hObject=0xe4) returned 1 [0109.690] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\adition[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\adition[1].js.dvodltmf")) returned 0 [0109.691] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\adition[1].js.dvodltmf")) returned 0x2020 [0109.691] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf1239b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf1239b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf1239b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7a52, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="adition[1].js", cAlternateFileName="ADITIO~1.JS")) returned 0x2e8598 [0109.691] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf1239b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf1239b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf1239b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7a52, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="adition[1].js", cAlternateFileName="ADITIO~1.JS")) returned 0 [0109.691] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0109.691] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\adition[1].js")) returned 1 [0109.693] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\adition[1].js")) returned 0xffffffff [0109.693] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53bfe570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bfe570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53c4a830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e3, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="async_usersync[1].htm", cAlternateFileName="ASYNC_~1.HTM")) returned 1 [0109.693] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\async_usersync[1].htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0109.693] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\async_usersync[1].htm.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0109.694] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e3 [0109.694] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0109.694] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0109.819] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3e3, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x3e3, lpOverlapped=0x0) returned 1 [0109.821] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x3f0, lpOverlapped=0x0) returned 1 [0109.822] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0109.842] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.852] CloseHandle (hObject=0xe4) returned 1 [0109.852] CloseHandle (hObject=0xe0) returned 1 [0109.853] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\async_usersync[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\async_usersync[1].htm.dvodltmf")) returned 0 [0109.853] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\async_usersync[1].htm.dvodltmf")) returned 0x2020 [0109.853] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53bfe570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bfe570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53c4a830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e3, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="async_usersync[1].htm", cAlternateFileName="ASYNC_~1.HTM")) returned 0x2e8598 [0109.853] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53bfe570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bfe570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53c4a830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e3, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="async_usersync[1].htm", cAlternateFileName="ASYNC_~1.HTM")) returned 0 [0109.853] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0109.854] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\async_usersync[1].htm")) returned 1 [0109.854] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\async_usersync[1].htm")) returned 0xffffffff [0109.854] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53bb22b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bb22b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53bfe570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5feb, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg", cAlternateFileName="B367C0~1.JPG")) returned 1 [0109.854] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0109.855] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0109.855] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5feb [0109.855] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0109.855] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0109.939] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x5feb, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x5feb, lpOverlapped=0x0) returned 1 [0109.941] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x5ff0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x5ff0, lpOverlapped=0x0) returned 1 [0109.942] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0109.962] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.971] CloseHandle (hObject=0xe0) returned 1 [0109.971] CloseHandle (hObject=0xe4) returned 1 [0109.972] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg.dvodltmf")) returned 0 [0109.972] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg.dvodltmf")) returned 0x2020 [0109.972] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53bb22b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bb22b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53bfe570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5feb, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg", cAlternateFileName="B367C0~1.JPG")) returned 0x2e8598 [0109.972] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53bb22b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bb22b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53bfe570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5feb, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg", cAlternateFileName="B367C0~1.JPG")) returned 0 [0109.973] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0109.973] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg")) returned 1 [0109.974] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg")) returned 0xffffffff [0109.974] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459613d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1aa, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BB8jcOr[2].png", cAlternateFileName="BB8JCO~2.PNG")) returned 1 [0109.974] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bb8jcor[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0109.974] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bb8jcor[2].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0109.975] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1aa [0109.975] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0109.975] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0110.066] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1aa, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1aa, lpOverlapped=0x0) returned 1 [0110.067] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1b0, lpOverlapped=0x0) returned 1 [0110.068] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0110.088] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0110.097] CloseHandle (hObject=0xe4) returned 1 [0110.097] CloseHandle (hObject=0xe0) returned 1 [0110.097] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bb8jcor[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bb8jcor[2].png.dvodltmf")) returned 0 [0110.098] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bb8jcor[2].png.dvodltmf")) returned 0x2020 [0110.098] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459613d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1aa, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BB8jcOr[2].png", cAlternateFileName="BB8JCO~2.PNG")) returned 0x2e8598 [0110.098] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459613d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1aa, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BB8jcOr[2].png", cAlternateFileName="BB8JCO~2.PNG")) returned 0 [0110.098] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0110.098] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bb8jcor[2].png")) returned 1 [0110.099] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bb8jcor[2].png")) returned 0xffffffff [0110.099] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c22, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBB8ZbM[1].jpg", cAlternateFileName="BBB8ZB~1.JPG")) returned 1 [0110.100] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb8zbm[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0110.100] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb8zbm[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0110.100] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c22 [0110.100] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0110.100] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0110.183] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1c22, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1c22, lpOverlapped=0x0) returned 1 [0110.185] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1c30, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1c30, lpOverlapped=0x0) returned 1 [0110.186] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0110.205] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0110.215] CloseHandle (hObject=0xe0) returned 1 [0110.215] CloseHandle (hObject=0xe4) returned 1 [0110.215] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb8zbm[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb8zbm[1].jpg.dvodltmf")) returned 0 [0110.216] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb8zbm[1].jpg.dvodltmf")) returned 0x2020 [0110.216] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c22, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBB8ZbM[1].jpg", cAlternateFileName="BBB8ZB~1.JPG")) returned 0x2e8598 [0110.216] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c22, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBB8ZbM[1].jpg", cAlternateFileName="BBB8ZB~1.JPG")) returned 0 [0110.216] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0110.216] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb8zbm[1].jpg")) returned 1 [0110.217] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb8zbm[1].jpg")) returned 0xffffffff [0110.217] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x234, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBB9wH0[1].png", cAlternateFileName="BBB9WH~1.PNG")) returned 1 [0110.217] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb9wh0[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0110.218] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb9wh0[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0110.218] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x234 [0110.218] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0110.218] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0110.302] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x234, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x234, lpOverlapped=0x0) returned 1 [0110.306] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x240, lpOverlapped=0x0) returned 1 [0110.307] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0110.326] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0110.336] CloseHandle (hObject=0xe4) returned 1 [0110.336] CloseHandle (hObject=0xe0) returned 1 [0110.336] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb9wh0[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb9wh0[1].png.dvodltmf")) returned 0 [0110.336] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb9wh0[1].png.dvodltmf")) returned 0x2020 [0110.337] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x234, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBB9wH0[1].png", cAlternateFileName="BBB9WH~1.PNG")) returned 0x2e8598 [0110.337] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x234, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBB9wH0[1].png", cAlternateFileName="BBB9WH~1.PNG")) returned 0 [0110.337] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0110.337] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb9wh0[1].png")) returned 1 [0110.338] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb9wh0[1].png")) returned 0xffffffff [0110.338] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x642446e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x642446e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x642446e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ac7, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBCFjo[1].jpg", cAlternateFileName="BBBCFJ~1.JPG")) returned 1 [0110.338] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbcfjo[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0110.338] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbcfjo[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0110.339] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ac7 [0110.339] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0110.339] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0110.421] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2ac7, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2ac7, lpOverlapped=0x0) returned 1 [0110.422] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2ad0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2ad0, lpOverlapped=0x0) returned 1 [0110.424] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0110.443] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0110.452] CloseHandle (hObject=0xe0) returned 1 [0110.452] CloseHandle (hObject=0xe4) returned 1 [0110.452] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbcfjo[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbcfjo[1].jpg.dvodltmf")) returned 0 [0110.453] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbcfjo[1].jpg.dvodltmf")) returned 0x2020 [0110.453] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x642446e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x642446e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x642446e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ac7, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBCFjo[1].jpg", cAlternateFileName="BBBCFJ~1.JPG")) returned 0x2e8598 [0110.453] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x642446e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x642446e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x642446e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ac7, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBCFjo[1].jpg", cAlternateFileName="BBBCFJ~1.JPG")) returned 0 [0110.453] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0110.453] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbcfjo[1].jpg")) returned 1 [0110.454] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbcfjo[1].jpg")) returned 0xffffffff [0110.454] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533cf9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533cf9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533cf9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7c9, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBDtcM[1].jpg", cAlternateFileName="BBBDTC~1.JPG")) returned 1 [0110.454] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbdtcm[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0110.455] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbdtcm[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0110.456] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7c9 [0110.456] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0110.456] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0110.538] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x7c9, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x7c9, lpOverlapped=0x0) returned 1 [0110.539] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x7d0, lpOverlapped=0x0) returned 1 [0110.540] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0110.560] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0110.569] CloseHandle (hObject=0xe4) returned 1 [0110.569] CloseHandle (hObject=0xe0) returned 1 [0110.569] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbdtcm[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbdtcm[1].jpg.dvodltmf")) returned 0 [0110.570] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbdtcm[1].jpg.dvodltmf")) returned 0x2020 [0110.570] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533cf9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533cf9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533cf9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7c9, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBDtcM[1].jpg", cAlternateFileName="BBBDTC~1.JPG")) returned 0x2e8598 [0110.570] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533cf9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533cf9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533cf9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7c9, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBDtcM[1].jpg", cAlternateFileName="BBBDTC~1.JPG")) returned 0 [0110.570] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0110.570] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbdtcm[1].jpg")) returned 1 [0110.571] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbdtcm[1].jpg")) returned 0xffffffff [0110.571] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b8c150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b8c150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53b8c150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1f19, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBIeNJ[1].jpg", cAlternateFileName="BBBIEN~1.JPG")) returned 1 [0110.571] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbienj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0110.572] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbienj[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0110.572] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f19 [0110.572] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0110.573] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0110.658] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1f19, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1f19, lpOverlapped=0x0) returned 1 [0110.659] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1f20, lpOverlapped=0x0) returned 1 [0110.660] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0110.680] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0110.689] CloseHandle (hObject=0xe0) returned 1 [0110.690] CloseHandle (hObject=0xe4) returned 1 [0110.690] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbienj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbienj[1].jpg.dvodltmf")) returned 0 [0110.690] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbienj[1].jpg.dvodltmf")) returned 0x2020 [0110.690] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b8c150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b8c150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53b8c150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1f19, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBIeNJ[1].jpg", cAlternateFileName="BBBIEN~1.JPG")) returned 0x2e8598 [0110.691] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b8c150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b8c150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53b8c150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1f19, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBIeNJ[1].jpg", cAlternateFileName="BBBIEN~1.JPG")) returned 0 [0110.691] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0110.691] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbienj[1].jpg")) returned 1 [0110.692] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbienj[1].jpg")) returned 0xffffffff [0110.692] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53598a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53598a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53598a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x711, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBImKX[1].jpg", cAlternateFileName="BBBIMK~1.JPG")) returned 1 [0110.692] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbimkx[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0110.693] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbimkx[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0110.693] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x711 [0110.693] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0110.694] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0110.794] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x711, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x711, lpOverlapped=0x0) returned 1 [0110.796] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x720, lpOverlapped=0x0) returned 1 [0110.797] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0110.817] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0110.826] CloseHandle (hObject=0xe4) returned 1 [0110.826] CloseHandle (hObject=0xe0) returned 1 [0110.826] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbimkx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbimkx[1].jpg.dvodltmf")) returned 0 [0110.827] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbimkx[1].jpg.dvodltmf")) returned 0x2020 [0110.827] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53598a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53598a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53598a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x711, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBImKX[1].jpg", cAlternateFileName="BBBIMK~1.JPG")) returned 0x2e8598 [0110.827] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53598a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53598a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53598a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x711, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBImKX[1].jpg", cAlternateFileName="BBBIMK~1.JPG")) returned 0 [0110.827] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0110.827] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbimkx[1].jpg")) returned 1 [0110.828] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbimkx[1].jpg")) returned 0xffffffff [0110.828] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b9c870, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b9c870, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b9c870, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2569, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBL4R9[1].jpg", cAlternateFileName="BBBL4R~1.JPG")) returned 1 [0110.828] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbl4r9[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0110.829] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbl4r9[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0110.829] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2569 [0110.829] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0110.829] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0110.914] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2569, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2569, lpOverlapped=0x0) returned 1 [0110.916] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2570, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2570, lpOverlapped=0x0) returned 1 [0110.917] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0110.938] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0110.947] CloseHandle (hObject=0xe0) returned 1 [0110.947] CloseHandle (hObject=0xe4) returned 1 [0110.948] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbl4r9[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbl4r9[1].jpg.dvodltmf")) returned 0 [0110.948] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbl4r9[1].jpg.dvodltmf")) returned 0x2020 [0110.948] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b9c870, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b9c870, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b9c870, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2569, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBL4R9[1].jpg", cAlternateFileName="BBBL4R~1.JPG")) returned 0x2e8598 [0110.949] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b9c870, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b9c870, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b9c870, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2569, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBL4R9[1].jpg", cAlternateFileName="BBBL4R~1.JPG")) returned 0 [0110.949] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0110.949] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbl4r9[1].jpg")) returned 1 [0110.950] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbl4r9[1].jpg")) returned 0xffffffff [0110.950] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30d2, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBLhTZ[1].jpg", cAlternateFileName="BBBLHT~1.JPG")) returned 1 [0110.950] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbblhtz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0110.951] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbblhtz[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0110.951] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x30d2 [0110.951] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0110.952] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0111.049] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x30d2, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x30d2, lpOverlapped=0x0) returned 1 [0111.051] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x30e0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x30e0, lpOverlapped=0x0) returned 1 [0111.052] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0111.071] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0111.081] CloseHandle (hObject=0xe4) returned 1 [0111.081] CloseHandle (hObject=0xe0) returned 1 [0111.084] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbblhtz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbblhtz[1].jpg.dvodltmf")) returned 0 [0111.085] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbblhtz[1].jpg.dvodltmf")) returned 0x2020 [0111.085] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30d2, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBLhTZ[1].jpg", cAlternateFileName="BBBLHT~1.JPG")) returned 0x2e8598 [0111.085] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30d2, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBLhTZ[1].jpg", cAlternateFileName="BBBLHT~1.JPG")) returned 0 [0111.085] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0111.085] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbblhtz[1].jpg")) returned 1 [0111.086] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbblhtz[1].jpg")) returned 0xffffffff [0111.086] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9b9, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBnhZY[1].jpg", cAlternateFileName="BBBNHZ~1.JPG")) returned 1 [0111.086] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbnhzy[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0111.087] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbnhzy[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0111.087] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9b9 [0111.087] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0111.087] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0111.170] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x9b9, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x9b9, lpOverlapped=0x0) returned 1 [0111.172] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x9c0, lpOverlapped=0x0) returned 1 [0111.173] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0111.192] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0111.201] CloseHandle (hObject=0xe0) returned 1 [0111.201] CloseHandle (hObject=0xe4) returned 1 [0111.201] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbnhzy[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbnhzy[1].jpg.dvodltmf")) returned 0 [0111.202] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbnhzy[1].jpg.dvodltmf")) returned 0x2020 [0111.202] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9b9, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBnhZY[1].jpg", cAlternateFileName="BBBNHZ~1.JPG")) returned 0x2e8598 [0111.202] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9b9, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBnhZY[1].jpg", cAlternateFileName="BBBNHZ~1.JPG")) returned 0 [0111.202] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0111.202] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbnhzy[1].jpg")) returned 1 [0111.203] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbnhzy[1].jpg")) returned 0xffffffff [0111.203] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x671dfee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x671dfee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x67206040, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48f4, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBPhAr[1].jpg", cAlternateFileName="BBBPHA~1.JPG")) returned 1 [0111.203] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbphar[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0111.203] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbphar[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0111.204] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x48f4 [0111.204] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0111.204] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0111.287] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x48f4, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x48f4, lpOverlapped=0x0) returned 1 [0111.289] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4900, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x4900, lpOverlapped=0x0) returned 1 [0111.290] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0111.310] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0111.319] CloseHandle (hObject=0xe4) returned 1 [0111.319] CloseHandle (hObject=0xe0) returned 1 [0111.319] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbphar[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbphar[1].jpg.dvodltmf")) returned 0 [0111.320] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbphar[1].jpg.dvodltmf")) returned 0x2020 [0111.320] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x671dfee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x671dfee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x67206040, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48f4, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBPhAr[1].jpg", cAlternateFileName="BBBPHA~1.JPG")) returned 0x2e8598 [0111.320] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x671dfee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x671dfee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x67206040, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48f4, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBPhAr[1].jpg", cAlternateFileName="BBBPHA~1.JPG")) returned 0 [0111.320] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0111.320] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbphar[1].jpg")) returned 1 [0111.321] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbphar[1].jpg")) returned 0xffffffff [0111.321] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c21, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBPiby[1].jpg", cAlternateFileName="BBBPIB~1.JPG")) returned 1 [0111.321] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpiby[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0111.321] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpiby[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0111.322] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c21 [0111.322] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0111.322] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0111.409] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1c21, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1c21, lpOverlapped=0x0) returned 1 [0111.411] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1c30, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1c30, lpOverlapped=0x0) returned 1 [0111.412] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0111.431] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0111.441] CloseHandle (hObject=0xe0) returned 1 [0111.441] CloseHandle (hObject=0xe4) returned 1 [0111.441] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpiby[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpiby[1].jpg.dvodltmf")) returned 0 [0111.442] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpiby[1].jpg.dvodltmf")) returned 0x2020 [0111.442] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c21, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBPiby[1].jpg", cAlternateFileName="BBBPIB~1.JPG")) returned 0x2e8598 [0111.442] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c21, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBPiby[1].jpg", cAlternateFileName="BBBPIB~1.JPG")) returned 0 [0111.442] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0111.442] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpiby[1].jpg")) returned 1 [0111.443] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpiby[1].jpg")) returned 0xffffffff [0111.443] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x16bf, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBPmXJ[1].jpg", cAlternateFileName="BBBPMX~1.JPG")) returned 1 [0111.443] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpmxj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0111.443] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpmxj[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0111.444] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16bf [0111.444] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0111.444] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0111.528] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x16bf, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x16bf, lpOverlapped=0x0) returned 1 [0111.534] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x16c0, lpOverlapped=0x0) returned 1 [0111.535] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0111.554] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0111.563] CloseHandle (hObject=0xe4) returned 1 [0111.563] CloseHandle (hObject=0xe0) returned 1 [0111.564] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpmxj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpmxj[1].jpg.dvodltmf")) returned 0 [0111.564] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpmxj[1].jpg.dvodltmf")) returned 0x2020 [0111.565] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x16bf, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBPmXJ[1].jpg", cAlternateFileName="BBBPMX~1.JPG")) returned 0x2e8598 [0111.565] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x16bf, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBPmXJ[1].jpg", cAlternateFileName="BBBPMX~1.JPG")) returned 0 [0111.565] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0111.565] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpmxj[1].jpg")) returned 1 [0111.566] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpmxj[1].jpg")) returned 0xffffffff [0111.566] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530d5e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530d5e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x21feb, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBPS37[1].png", cAlternateFileName="BBBPS3~1.PNG")) returned 1 [0111.566] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbps37[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0111.566] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbps37[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0111.567] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x21feb [0111.567] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0111.567] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0111.651] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x21feb, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x21feb, lpOverlapped=0x0) returned 1 [0111.654] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x21ff0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x21ff0, lpOverlapped=0x0) returned 1 [0111.657] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0111.677] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0111.686] CloseHandle (hObject=0xe0) returned 1 [0111.686] CloseHandle (hObject=0xe4) returned 1 [0111.686] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbps37[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbps37[1].png.dvodltmf")) returned 0 [0111.687] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbps37[1].png.dvodltmf")) returned 0x2020 [0111.687] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530d5e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530d5e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x21feb, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBPS37[1].png", cAlternateFileName="BBBPS3~1.PNG")) returned 0x2e8598 [0111.687] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530d5e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530d5e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x21feb, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBPS37[1].png", cAlternateFileName="BBBPS3~1.PNG")) returned 0 [0111.687] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0111.687] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbps37[1].png")) returned 1 [0111.689] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbps37[1].png")) returned 0xffffffff [0111.689] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12f9, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBQiBF[1].jpg", cAlternateFileName="BBBQIB~1.JPG")) returned 1 [0111.690] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbqibf[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0111.690] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbqibf[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0111.691] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12f9 [0111.691] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0111.691] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0111.792] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x12f9, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x12f9, lpOverlapped=0x0) returned 1 [0111.794] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1300, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1300, lpOverlapped=0x0) returned 1 [0111.795] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0111.814] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0111.823] CloseHandle (hObject=0xe4) returned 1 [0111.823] CloseHandle (hObject=0xe0) returned 1 [0111.824] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbqibf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbqibf[1].jpg.dvodltmf")) returned 0 [0111.824] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbqibf[1].jpg.dvodltmf")) returned 0x2020 [0111.824] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12f9, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBQiBF[1].jpg", cAlternateFileName="BBBQIB~1.JPG")) returned 0x2e8598 [0111.824] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12f9, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBQiBF[1].jpg", cAlternateFileName="BBBQIB~1.JPG")) returned 0 [0111.824] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0111.825] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbqibf[1].jpg")) returned 1 [0111.825] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbqibf[1].jpg")) returned 0xffffffff [0111.825] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533cf9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533cf9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533cf9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9a9, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBty8h[1].jpg", cAlternateFileName="BBBTY8~1.JPG")) returned 1 [0111.826] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbty8h[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0111.826] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbty8h[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0111.826] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9a9 [0111.826] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0111.826] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0111.909] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x9a9, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x9a9, lpOverlapped=0x0) returned 1 [0111.911] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x9b0, lpOverlapped=0x0) returned 1 [0111.912] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0111.931] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0111.941] CloseHandle (hObject=0xe0) returned 1 [0111.941] CloseHandle (hObject=0xe4) returned 1 [0111.941] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbty8h[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbty8h[1].jpg.dvodltmf")) returned 0 [0111.942] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbty8h[1].jpg.dvodltmf")) returned 0x2020 [0111.942] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533cf9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533cf9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533cf9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9a9, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBty8h[1].jpg", cAlternateFileName="BBBTY8~1.JPG")) returned 0x2e8598 [0111.942] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533cf9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533cf9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533cf9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9a9, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBty8h[1].jpg", cAlternateFileName="BBBTY8~1.JPG")) returned 0 [0111.942] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0111.942] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbty8h[1].jpg")) returned 1 [0111.943] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbty8h[1].jpg")) returned 0xffffffff [0111.943] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5303d8d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5303d8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5303d8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1b08, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBVACL[1].jpg", cAlternateFileName="BBBVAC~1.JPG")) returned 1 [0111.943] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvacl[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0111.944] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvacl[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0111.944] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b08 [0111.944] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0111.945] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0112.028] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1b08, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1b08, lpOverlapped=0x0) returned 1 [0112.030] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1b10, lpOverlapped=0x0) returned 1 [0112.031] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0112.059] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.068] CloseHandle (hObject=0xe4) returned 1 [0112.069] CloseHandle (hObject=0xe0) returned 1 [0112.069] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvacl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvacl[1].jpg.dvodltmf")) returned 0 [0112.069] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvacl[1].jpg.dvodltmf")) returned 0x2020 [0112.069] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5303d8d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5303d8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5303d8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1b08, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBVACL[1].jpg", cAlternateFileName="BBBVAC~1.JPG")) returned 0x2e8598 [0112.070] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5303d8d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5303d8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5303d8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1b08, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBVACL[1].jpg", cAlternateFileName="BBBVAC~1.JPG")) returned 0 [0112.070] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0112.070] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvacl[1].jpg")) returned 1 [0112.071] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvacl[1].jpg")) returned 0xffffffff [0112.071] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5e29b2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e29b2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e29b2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c41, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBVGyR[1].jpg", cAlternateFileName="BBBVGY~1.JPG")) returned 1 [0112.071] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvgyr[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0112.071] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvgyr[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0112.071] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c41 [0112.071] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0112.072] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0112.166] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1c41, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1c41, lpOverlapped=0x0) returned 1 [0112.168] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1c50, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1c50, lpOverlapped=0x0) returned 1 [0112.169] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0112.202] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.212] CloseHandle (hObject=0xe0) returned 1 [0112.213] CloseHandle (hObject=0xe4) returned 1 [0112.214] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvgyr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvgyr[1].jpg.dvodltmf")) returned 0 [0112.215] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvgyr[1].jpg.dvodltmf")) returned 0x2020 [0112.215] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5e29b2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e29b2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e29b2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c41, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBVGyR[1].jpg", cAlternateFileName="BBBVGY~1.JPG")) returned 0x2e8598 [0112.216] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5e29b2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e29b2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e29b2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c41, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBVGyR[1].jpg", cAlternateFileName="BBBVGY~1.JPG")) returned 0 [0112.216] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0112.216] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvgyr[1].jpg")) returned 1 [0112.217] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvgyr[1].jpg")) returned 0xffffffff [0112.217] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x950, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBVMtX[1].jpg", cAlternateFileName="BBBVMT~1.JPG")) returned 1 [0112.217] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvmtx[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0112.221] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvmtx[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0112.222] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x950 [0112.222] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0112.222] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0112.309] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x950, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x950, lpOverlapped=0x0) returned 1 [0112.311] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x960, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x960, lpOverlapped=0x0) returned 1 [0112.312] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0112.332] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.341] CloseHandle (hObject=0xe4) returned 1 [0112.341] CloseHandle (hObject=0xe0) returned 1 [0112.341] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvmtx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvmtx[1].jpg.dvodltmf")) returned 0 [0112.342] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvmtx[1].jpg.dvodltmf")) returned 0x2020 [0112.342] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x950, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBVMtX[1].jpg", cAlternateFileName="BBBVMT~1.JPG")) returned 0x2e8598 [0112.342] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x950, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBVMtX[1].jpg", cAlternateFileName="BBBVMT~1.JPG")) returned 0 [0112.342] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0112.342] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvmtx[1].jpg")) returned 1 [0112.343] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvmtx[1].jpg")) returned 0xffffffff [0112.343] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5530da90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5530da90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5530da90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1bba, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBVYsu[1].jpg", cAlternateFileName="BBBVYS~1.JPG")) returned 1 [0112.343] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvysu[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0112.344] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvysu[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0112.345] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1bba [0112.345] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0112.345] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0112.428] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1bba, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1bba, lpOverlapped=0x0) returned 1 [0112.430] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1bc0, lpOverlapped=0x0) returned 1 [0112.431] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0112.450] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.460] CloseHandle (hObject=0xe0) returned 1 [0112.460] CloseHandle (hObject=0xe4) returned 1 [0112.460] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvysu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvysu[1].jpg.dvodltmf")) returned 0 [0112.460] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvysu[1].jpg.dvodltmf")) returned 0x2020 [0112.461] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5530da90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5530da90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5530da90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1bba, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBVYsu[1].jpg", cAlternateFileName="BBBVYS~1.JPG")) returned 0x2e8598 [0112.461] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5530da90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5530da90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5530da90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1bba, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBVYsu[1].jpg", cAlternateFileName="BBBVYS~1.JPG")) returned 0 [0112.461] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0112.461] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvysu[1].jpg")) returned 1 [0112.462] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvysu[1].jpg")) returned 0xffffffff [0112.462] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5154fff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5154fff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51576150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x76a, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBWLtW[1].jpg", cAlternateFileName="BBBWLT~1.JPG")) returned 1 [0112.462] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbwltw[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0112.462] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbwltw[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0112.462] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x76a [0112.462] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0112.463] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0112.555] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x76a, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x76a, lpOverlapped=0x0) returned 1 [0112.556] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x770, lpOverlapped=0x0) returned 1 [0112.557] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0112.576] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.586] CloseHandle (hObject=0xe4) returned 1 [0112.586] CloseHandle (hObject=0xe0) returned 1 [0112.586] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbwltw[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbwltw[1].jpg.dvodltmf")) returned 0 [0112.587] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbwltw[1].jpg.dvodltmf")) returned 0x2020 [0112.587] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5154fff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5154fff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51576150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x76a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBWLtW[1].jpg", cAlternateFileName="BBBWLT~1.JPG")) returned 0x2e8598 [0112.587] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5154fff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5154fff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51576150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x76a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBWLtW[1].jpg", cAlternateFileName="BBBWLT~1.JPG")) returned 0 [0112.587] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0112.587] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbwltw[1].jpg")) returned 1 [0112.588] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbwltw[1].jpg")) returned 0xffffffff [0112.588] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f32f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f32f30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f32f30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x95f, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBX3xB[1].jpg", cAlternateFileName="BBBX3X~1.JPG")) returned 1 [0112.588] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbx3xb[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0112.589] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbx3xb[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0112.589] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x95f [0112.589] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0112.590] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0112.675] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x95f, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x95f, lpOverlapped=0x0) returned 1 [0112.676] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x960, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x960, lpOverlapped=0x0) returned 1 [0112.677] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0112.696] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.706] CloseHandle (hObject=0xe0) returned 1 [0112.706] CloseHandle (hObject=0xe4) returned 1 [0112.706] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbx3xb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbx3xb[1].jpg.dvodltmf")) returned 0 [0112.707] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbx3xb[1].jpg.dvodltmf")) returned 0x2020 [0112.707] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f32f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f32f30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f32f30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x95f, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBX3xB[1].jpg", cAlternateFileName="BBBX3X~1.JPG")) returned 0x2e8598 [0112.707] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f32f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f32f30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f32f30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x95f, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBX3xB[1].jpg", cAlternateFileName="BBBX3X~1.JPG")) returned 0 [0112.707] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0112.707] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbx3xb[1].jpg")) returned 1 [0112.708] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbx3xb[1].jpg")) returned 0xffffffff [0112.708] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533112f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533112f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533112f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x241e, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBY98e[1].jpg", cAlternateFileName="BBBY98~1.JPG")) returned 1 [0112.708] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbby98e[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0112.709] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbby98e[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0112.710] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x241e [0112.710] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0112.711] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0112.795] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x241e, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x241e, lpOverlapped=0x0) returned 1 [0112.797] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2420, lpOverlapped=0x0) returned 1 [0112.798] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0112.817] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.826] CloseHandle (hObject=0xe4) returned 1 [0112.827] CloseHandle (hObject=0xe0) returned 1 [0112.827] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbby98e[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbby98e[1].jpg.dvodltmf")) returned 0 [0112.827] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbby98e[1].jpg.dvodltmf")) returned 0x2020 [0112.827] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533112f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533112f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533112f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x241e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBY98e[1].jpg", cAlternateFileName="BBBY98~1.JPG")) returned 0x2e8598 [0112.828] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533112f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533112f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533112f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x241e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBY98e[1].jpg", cAlternateFileName="BBBY98~1.JPG")) returned 0 [0112.828] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0112.828] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbby98e[1].jpg")) returned 1 [0112.829] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbby98e[1].jpg")) returned 0xffffffff [0112.829] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x938, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBZYVP[1].jpg", cAlternateFileName="BBBZYV~1.JPG")) returned 1 [0112.829] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbzyvp[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0112.830] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbzyvp[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0112.830] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x938 [0112.830] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0112.830] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0112.913] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x938, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x938, lpOverlapped=0x0) returned 1 [0112.915] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x940, lpOverlapped=0x0) returned 1 [0112.916] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0112.935] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.944] CloseHandle (hObject=0xe0) returned 1 [0112.944] CloseHandle (hObject=0xe4) returned 1 [0112.944] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbzyvp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbzyvp[1].jpg.dvodltmf")) returned 0 [0112.945] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbzyvp[1].jpg.dvodltmf")) returned 0x2020 [0112.945] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x938, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBZYVP[1].jpg", cAlternateFileName="BBBZYV~1.JPG")) returned 0x2e8598 [0112.945] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x938, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBZYVP[1].jpg", cAlternateFileName="BBBZYV~1.JPG")) returned 0 [0112.945] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0112.945] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbzyvp[1].jpg")) returned 1 [0112.946] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbzyvp[1].jpg")) returned 0xffffffff [0112.946] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x192a, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBC04o2[1].jpg", cAlternateFileName="BBC04O~1.JPG")) returned 1 [0112.946] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04o2[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0112.946] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04o2[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0112.947] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x192a [0112.947] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0112.947] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0113.032] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x192a, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x192a, lpOverlapped=0x0) returned 1 [0113.034] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1930, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1930, lpOverlapped=0x0) returned 1 [0113.035] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0113.054] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.071] CloseHandle (hObject=0xe4) returned 1 [0113.071] CloseHandle (hObject=0xe0) returned 1 [0113.072] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04o2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04o2[1].jpg.dvodltmf")) returned 0 [0113.072] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04o2[1].jpg.dvodltmf")) returned 0x2020 [0113.072] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x192a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBC04o2[1].jpg", cAlternateFileName="BBC04O~1.JPG")) returned 0x2e8598 [0113.072] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x192a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBC04o2[1].jpg", cAlternateFileName="BBC04O~1.JPG")) returned 0 [0113.073] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0113.073] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04o2[1].jpg")) returned 1 [0113.073] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04o2[1].jpg")) returned 0xffffffff [0113.074] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23fb, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBC04ok[1].jpg", cAlternateFileName="BBC04O~2.JPG")) returned 1 [0113.074] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04ok[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0113.074] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04ok[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0113.074] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x23fb [0113.074] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0113.075] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0113.158] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x23fb, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x23fb, lpOverlapped=0x0) returned 1 [0113.160] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2400, lpOverlapped=0x0) returned 1 [0113.161] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0113.180] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.190] CloseHandle (hObject=0xe0) returned 1 [0113.190] CloseHandle (hObject=0xe4) returned 1 [0113.190] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04ok[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04ok[1].jpg.dvodltmf")) returned 0 [0113.190] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04ok[1].jpg.dvodltmf")) returned 0x2020 [0113.191] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23fb, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBC04ok[1].jpg", cAlternateFileName="BBC04O~2.JPG")) returned 0x2e8598 [0113.191] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23fb, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBC04ok[1].jpg", cAlternateFileName="BBC04O~2.JPG")) returned 0 [0113.191] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0113.191] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04ok[1].jpg")) returned 1 [0113.192] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04ok[1].jpg")) returned 0xffffffff [0113.192] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539e9230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539e9230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539e9230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a99, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBC04we[1].jpg", cAlternateFileName="BBC04W~1.JPG")) returned 1 [0113.192] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04we[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0113.192] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04we[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0113.193] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2a99 [0113.193] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0113.193] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0113.281] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2a99, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2a99, lpOverlapped=0x0) returned 1 [0113.283] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2aa0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2aa0, lpOverlapped=0x0) returned 1 [0113.284] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0113.304] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.313] CloseHandle (hObject=0xe4) returned 1 [0113.313] CloseHandle (hObject=0xe0) returned 1 [0113.313] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04we[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04we[1].jpg.dvodltmf")) returned 0 [0113.314] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04we[1].jpg.dvodltmf")) returned 0x2020 [0113.314] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539e9230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539e9230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539e9230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a99, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBC04we[1].jpg", cAlternateFileName="BBC04W~1.JPG")) returned 0x2e8598 [0113.314] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539e9230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539e9230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539e9230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a99, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBC04we[1].jpg", cAlternateFileName="BBC04W~1.JPG")) returned 0 [0113.315] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0113.315] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04we[1].jpg")) returned 1 [0113.316] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04we[1].jpg")) returned 0xffffffff [0113.316] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e02430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e02430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBC05rl[1].jpg", cAlternateFileName="BBC05R~1.JPG")) returned 1 [0113.316] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0113.316] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0113.316] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3200 [0113.316] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0113.317] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0113.539] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3200, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x3200, lpOverlapped=0x0) returned 1 [0113.541] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3210, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x3210, lpOverlapped=0x0) returned 1 [0113.542] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0113.562] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.572] CloseHandle (hObject=0xe0) returned 1 [0113.572] CloseHandle (hObject=0xe4) returned 1 [0113.572] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[1].jpg.dvodltmf")) returned 0 [0113.573] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[1].jpg.dvodltmf")) returned 0x2020 [0113.573] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e02430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e02430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBC05rl[1].jpg", cAlternateFileName="BBC05R~1.JPG")) returned 0x2e8598 [0113.573] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e02430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e02430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBC05rl[1].jpg", cAlternateFileName="BBC05R~1.JPG")) returned 0 [0113.573] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0113.573] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[1].jpg")) returned 1 [0113.574] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[1].jpg")) returned 0xffffffff [0113.574] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ec0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ec0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ec0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7e1, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBC05rl[2].jpg", cAlternateFileName="BBC05R~2.JPG")) returned 1 [0113.574] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0113.575] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[2].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0113.576] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7e1 [0113.576] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0113.576] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0113.663] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x7e1, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x7e1, lpOverlapped=0x0) returned 1 [0113.665] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x7f0, lpOverlapped=0x0) returned 1 [0113.666] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0113.685] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.694] CloseHandle (hObject=0xe4) returned 1 [0113.694] CloseHandle (hObject=0xe0) returned 1 [0113.694] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[2].jpg.dvodltmf")) returned 0 [0113.695] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[2].jpg.dvodltmf")) returned 0x2020 [0113.695] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ec0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ec0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ec0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7e1, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBC05rl[2].jpg", cAlternateFileName="BBC05R~2.JPG")) returned 0x2e8598 [0113.695] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ec0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ec0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ec0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7e1, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBC05rl[2].jpg", cAlternateFileName="BBC05R~2.JPG")) returned 0 [0113.695] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0113.696] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[2].jpg")) returned 1 [0113.696] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[2].jpg")) returned 0xffffffff [0113.696] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ff1610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ff1610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ff1610, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1b4e, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBC0ATj[1].jpg", cAlternateFileName="BBC0AT~1.JPG")) returned 1 [0113.696] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0atj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0113.697] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0atj[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0113.698] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b4e [0113.698] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0113.698] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0113.786] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1b4e, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1b4e, lpOverlapped=0x0) returned 1 [0113.787] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1b50, lpOverlapped=0x0) returned 1 [0113.788] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0113.807] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.817] CloseHandle (hObject=0xe0) returned 1 [0113.817] CloseHandle (hObject=0xe4) returned 1 [0113.817] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0atj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0atj[1].jpg.dvodltmf")) returned 0 [0113.818] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0atj[1].jpg.dvodltmf")) returned 0x2020 [0113.818] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ff1610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ff1610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ff1610, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1b4e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBC0ATj[1].jpg", cAlternateFileName="BBC0AT~1.JPG")) returned 0x2e8598 [0113.818] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ff1610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ff1610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ff1610, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1b4e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBC0ATj[1].jpg", cAlternateFileName="BBC0AT~1.JPG")) returned 0 [0113.818] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0113.818] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0atj[1].jpg")) returned 1 [0113.819] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0atj[1].jpg")) returned 0xffffffff [0113.819] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5392ab50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5392ab50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5392ab50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x751, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBC0D8i[1].jpg", cAlternateFileName="BBC0D8~1.JPG")) returned 1 [0113.819] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0d8i[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0113.819] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0d8i[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0113.820] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x751 [0113.820] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0113.820] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0113.916] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x751, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x751, lpOverlapped=0x0) returned 1 [0113.918] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x760, lpOverlapped=0x0) returned 1 [0113.919] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0113.938] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.948] CloseHandle (hObject=0xe4) returned 1 [0113.948] CloseHandle (hObject=0xe0) returned 1 [0113.948] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0d8i[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0d8i[1].jpg.dvodltmf")) returned 0 [0113.949] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0d8i[1].jpg.dvodltmf")) returned 0x2020 [0113.949] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5392ab50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5392ab50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5392ab50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x751, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBC0D8i[1].jpg", cAlternateFileName="BBC0D8~1.JPG")) returned 0x2e8598 [0113.949] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5392ab50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5392ab50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5392ab50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x751, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBC0D8i[1].jpg", cAlternateFileName="BBC0D8~1.JPG")) returned 0 [0113.949] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0113.949] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0d8i[1].jpg")) returned 1 [0113.950] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0d8i[1].jpg")) returned 0xffffffff [0113.950] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51256470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51256470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51256470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x200e, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBC0g7a[1].jpg", cAlternateFileName="BBC0G7~1.JPG")) returned 1 [0113.950] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0g7a[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0113.950] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0g7a[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0113.951] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x200e [0113.951] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0113.951] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0114.036] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x200e, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x200e, lpOverlapped=0x0) returned 1 [0114.038] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2010, lpOverlapped=0x0) returned 1 [0114.039] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0114.059] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.068] CloseHandle (hObject=0xe0) returned 1 [0114.068] CloseHandle (hObject=0xe4) returned 1 [0114.077] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0g7a[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0g7a[1].jpg.dvodltmf")) returned 0 [0114.078] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0g7a[1].jpg.dvodltmf")) returned 0x2020 [0114.078] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51256470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51256470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51256470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x200e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBC0g7a[1].jpg", cAlternateFileName="BBC0G7~1.JPG")) returned 0x2e8598 [0114.078] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51256470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51256470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51256470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x200e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBC0g7a[1].jpg", cAlternateFileName="BBC0G7~1.JPG")) returned 0 [0114.078] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0114.079] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0g7a[1].jpg")) returned 1 [0114.080] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0g7a[1].jpg")) returned 0xffffffff [0114.080] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f7f1f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f7f1f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f7f1f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1dcb, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBC0w1b[1].jpg", cAlternateFileName="BBC0W1~1.JPG")) returned 1 [0114.080] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0w1b[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0114.081] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0w1b[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0114.081] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1dcb [0114.081] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0114.081] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0114.165] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1dcb, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1dcb, lpOverlapped=0x0) returned 1 [0114.167] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1dd0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1dd0, lpOverlapped=0x0) returned 1 [0114.168] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0114.187] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.197] CloseHandle (hObject=0xe4) returned 1 [0114.197] CloseHandle (hObject=0xe0) returned 1 [0114.197] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0w1b[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0w1b[1].jpg.dvodltmf")) returned 0 [0114.198] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0w1b[1].jpg.dvodltmf")) returned 0x2020 [0114.198] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f7f1f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f7f1f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f7f1f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1dcb, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBC0w1b[1].jpg", cAlternateFileName="BBC0W1~1.JPG")) returned 0x2e8598 [0114.198] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f7f1f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f7f1f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f7f1f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1dcb, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBC0w1b[1].jpg", cAlternateFileName="BBC0W1~1.JPG")) returned 0 [0114.198] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0114.198] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0w1b[1].jpg")) returned 1 [0114.199] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0w1b[1].jpg")) returned 0xffffffff [0114.199] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5530da90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5530da90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55333bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23ba, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBC0xLt[1].jpg", cAlternateFileName="BBC0XL~1.JPG")) returned 1 [0114.199] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0xlt[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0114.199] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0xlt[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0114.200] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x23ba [0114.200] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0114.200] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0114.284] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x23ba, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x23ba, lpOverlapped=0x0) returned 1 [0114.285] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x23c0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x23c0, lpOverlapped=0x0) returned 1 [0114.287] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0114.306] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.315] CloseHandle (hObject=0xe0) returned 1 [0114.315] CloseHandle (hObject=0xe4) returned 1 [0114.315] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0xlt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0xlt[1].jpg.dvodltmf")) returned 0 [0114.316] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0xlt[1].jpg.dvodltmf")) returned 0x2020 [0114.316] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5530da90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5530da90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55333bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23ba, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBC0xLt[1].jpg", cAlternateFileName="BBC0XL~1.JPG")) returned 0x2e8598 [0114.316] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5530da90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5530da90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55333bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23ba, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBC0xLt[1].jpg", cAlternateFileName="BBC0XL~1.JPG")) returned 0 [0114.316] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0114.316] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0xlt[1].jpg")) returned 1 [0114.317] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0xlt[1].jpg")) returned 0xffffffff [0114.317] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xb58, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBDWA22[1].jpg", cAlternateFileName="BBDWA2~1.JPG")) returned 1 [0114.317] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbdwa22[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0114.317] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbdwa22[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0114.319] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb58 [0114.319] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0114.319] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0114.410] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb58, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0xb58, lpOverlapped=0x0) returned 1 [0114.412] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0xb60, lpOverlapped=0x0) returned 1 [0114.413] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0114.432] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.441] CloseHandle (hObject=0xe4) returned 1 [0114.441] CloseHandle (hObject=0xe0) returned 1 [0114.441] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbdwa22[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbdwa22[1].jpg.dvodltmf")) returned 0 [0114.442] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbdwa22[1].jpg.dvodltmf")) returned 0x2020 [0114.442] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xb58, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBDWA22[1].jpg", cAlternateFileName="BBDWA2~1.JPG")) returned 0x2e8598 [0114.442] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xb58, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBDWA22[1].jpg", cAlternateFileName="BBDWA2~1.JPG")) returned 0 [0114.442] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0114.443] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbdwa22[1].jpg")) returned 1 [0114.443] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbdwa22[1].jpg")) returned 0xffffffff [0114.443] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x91d, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBE7d3b[1].jpg", cAlternateFileName="BBE7D3~1.JPG")) returned 1 [0114.444] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe7d3b[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0114.444] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe7d3b[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0114.445] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x91d [0114.445] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0114.445] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0114.530] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x91d, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x91d, lpOverlapped=0x0) returned 1 [0114.531] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x920, lpOverlapped=0x0) returned 1 [0114.532] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0114.552] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.561] CloseHandle (hObject=0xe0) returned 1 [0114.561] CloseHandle (hObject=0xe4) returned 1 [0114.561] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe7d3b[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe7d3b[1].jpg.dvodltmf")) returned 0 [0114.562] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe7d3b[1].jpg.dvodltmf")) returned 0x2020 [0114.562] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x91d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBE7d3b[1].jpg", cAlternateFileName="BBE7D3~1.JPG")) returned 0x2e8598 [0114.562] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x91d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBE7d3b[1].jpg", cAlternateFileName="BBE7D3~1.JPG")) returned 0 [0114.563] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0114.563] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe7d3b[1].jpg")) returned 1 [0114.564] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe7d3b[1].jpg")) returned 0xffffffff [0114.564] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45583010, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45583010, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x455a9170, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2850, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBE85ld[1].jpg", cAlternateFileName="BBE85L~1.JPG")) returned 1 [0114.564] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe85ld[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0114.564] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe85ld[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0114.564] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2850 [0114.564] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0114.565] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0114.652] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2850, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2850, lpOverlapped=0x0) returned 1 [0114.655] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2860, lpOverlapped=0x0) returned 1 [0114.656] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0114.676] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.685] CloseHandle (hObject=0xe4) returned 1 [0114.685] CloseHandle (hObject=0xe0) returned 1 [0114.685] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe85ld[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe85ld[1].jpg.dvodltmf")) returned 0 [0114.686] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe85ld[1].jpg.dvodltmf")) returned 0x2020 [0114.686] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45583010, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45583010, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x455a9170, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2850, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBE85ld[1].jpg", cAlternateFileName="BBE85L~1.JPG")) returned 0x2e8598 [0114.686] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45583010, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45583010, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x455a9170, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2850, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBE85ld[1].jpg", cAlternateFileName="BBE85L~1.JPG")) returned 0 [0114.686] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0114.686] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe85ld[1].jpg")) returned 1 [0114.687] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe85ld[1].jpg")) returned 0xffffffff [0114.687] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459613d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x16ca, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEdckp[1].jpg", cAlternateFileName="BBEDCK~1.JPG")) returned 1 [0114.688] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedckp[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0114.688] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedckp[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0114.688] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16ca [0114.688] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0114.689] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0114.786] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x16ca, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x16ca, lpOverlapped=0x0) returned 1 [0114.788] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x16d0, lpOverlapped=0x0) returned 1 [0114.789] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0114.809] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.819] CloseHandle (hObject=0xe0) returned 1 [0114.819] CloseHandle (hObject=0xe4) returned 1 [0114.819] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedckp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedckp[1].jpg.dvodltmf")) returned 0 [0114.820] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedckp[1].jpg.dvodltmf")) returned 0x2020 [0114.820] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459613d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x16ca, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEdckp[1].jpg", cAlternateFileName="BBEDCK~1.JPG")) returned 0x2e8598 [0114.820] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459613d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x16ca, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEdckp[1].jpg", cAlternateFileName="BBEDCK~1.JPG")) returned 0 [0114.820] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0114.820] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedckp[1].jpg")) returned 1 [0114.821] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedckp[1].jpg")) returned 0xffffffff [0114.822] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xafe, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEdMci[1].jpg", cAlternateFileName="BBEDMC~1.JPG")) returned 1 [0114.822] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedmci[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0114.822] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedmci[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0114.822] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xafe [0114.822] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0114.823] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0114.907] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xafe, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0xafe, lpOverlapped=0x0) returned 1 [0114.910] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb00, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0xb00, lpOverlapped=0x0) returned 1 [0114.911] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0114.931] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.940] CloseHandle (hObject=0xe4) returned 1 [0114.940] CloseHandle (hObject=0xe0) returned 1 [0114.940] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedmci[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedmci[1].jpg.dvodltmf")) returned 0 [0114.941] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedmci[1].jpg.dvodltmf")) returned 0x2020 [0114.941] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xafe, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEdMci[1].jpg", cAlternateFileName="BBEDMC~1.JPG")) returned 0x2e8598 [0114.941] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xafe, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEdMci[1].jpg", cAlternateFileName="BBEDMC~1.JPG")) returned 0 [0114.941] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0114.941] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedmci[1].jpg")) returned 1 [0114.942] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedmci[1].jpg")) returned 0xffffffff [0114.942] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4580a770, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4580a770, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4580a770, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2a48, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEdSLV[1].jpg", cAlternateFileName="BBEDSL~1.JPG")) returned 1 [0114.942] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedslv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0114.942] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedslv[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0114.943] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2a48 [0114.943] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0114.943] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0115.038] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2a48, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2a48, lpOverlapped=0x0) returned 1 [0115.040] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2a50, lpOverlapped=0x0) returned 1 [0115.041] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0115.060] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.069] CloseHandle (hObject=0xe0) returned 1 [0115.069] CloseHandle (hObject=0xe4) returned 1 [0115.069] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedslv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedslv[1].jpg.dvodltmf")) returned 0 [0115.070] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedslv[1].jpg.dvodltmf")) returned 0x2020 [0115.070] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4580a770, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4580a770, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4580a770, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2a48, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEdSLV[1].jpg", cAlternateFileName="BBEDSL~1.JPG")) returned 0x2e8598 [0115.070] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4580a770, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4580a770, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4580a770, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2a48, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEdSLV[1].jpg", cAlternateFileName="BBEDSL~1.JPG")) returned 0 [0115.070] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0115.070] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedslv[1].jpg")) returned 1 [0115.071] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedslv[1].jpg")) returned 0xffffffff [0115.071] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x87f, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEe2Pd[1].jpg", cAlternateFileName="BBEE2P~1.JPG")) returned 1 [0115.071] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee2pd[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0115.081] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee2pd[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0115.081] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x87f [0115.082] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0115.082] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0115.166] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x87f, lpOverlapped=0x0) returned 1 [0115.167] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x880, lpOverlapped=0x0) returned 1 [0115.168] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0115.188] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.197] CloseHandle (hObject=0xe4) returned 1 [0115.197] CloseHandle (hObject=0xe0) returned 1 [0115.197] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee2pd[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee2pd[1].jpg.dvodltmf")) returned 0 [0115.198] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee2pd[1].jpg.dvodltmf")) returned 0x2020 [0115.198] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x87f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEe2Pd[1].jpg", cAlternateFileName="BBEE2P~1.JPG")) returned 0x2e8598 [0115.198] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x87f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEe2Pd[1].jpg", cAlternateFileName="BBEE2P~1.JPG")) returned 0 [0115.198] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0115.199] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee2pd[1].jpg")) returned 1 [0115.199] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee2pd[1].jpg")) returned 0xffffffff [0115.199] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4587cb90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4587cb90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4587cb90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3faf, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEe4Oo[1].png", cAlternateFileName="BBEE4O~1.PNG")) returned 1 [0115.200] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee4oo[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0115.201] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee4oo[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0115.201] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3faf [0115.202] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0115.202] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0115.286] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3faf, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x3faf, lpOverlapped=0x0) returned 1 [0115.288] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3fb0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x3fb0, lpOverlapped=0x0) returned 1 [0115.289] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0115.309] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.318] CloseHandle (hObject=0xe0) returned 1 [0115.318] CloseHandle (hObject=0xe4) returned 1 [0115.318] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee4oo[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee4oo[1].png.dvodltmf")) returned 0 [0115.319] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee4oo[1].png.dvodltmf")) returned 0x2020 [0115.319] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4587cb90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4587cb90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4587cb90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3faf, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEe4Oo[1].png", cAlternateFileName="BBEE4O~1.PNG")) returned 0x2e8598 [0115.319] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4587cb90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4587cb90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4587cb90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3faf, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEe4Oo[1].png", cAlternateFileName="BBEE4O~1.PNG")) returned 0 [0115.320] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0115.320] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee4oo[1].png")) returned 1 [0115.321] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee4oo[1].png")) returned 0xffffffff [0115.321] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b505b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b505b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b505b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xaa9, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEe6Ew[1].jpg", cAlternateFileName="BBEE6E~1.JPG")) returned 1 [0115.321] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee6ew[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0115.322] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee6ew[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0115.322] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaa9 [0115.322] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0115.323] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0115.413] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xaa9, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0xaa9, lpOverlapped=0x0) returned 1 [0115.415] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0xab0, lpOverlapped=0x0) returned 1 [0115.416] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0115.436] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.445] CloseHandle (hObject=0xe4) returned 1 [0115.445] CloseHandle (hObject=0xe0) returned 1 [0115.445] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee6ew[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee6ew[1].jpg.dvodltmf")) returned 0 [0115.446] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee6ew[1].jpg.dvodltmf")) returned 0x2020 [0115.446] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b505b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b505b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b505b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xaa9, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEe6Ew[1].jpg", cAlternateFileName="BBEE6E~1.JPG")) returned 0x2e8598 [0115.446] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b505b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b505b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b505b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xaa9, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEe6Ew[1].jpg", cAlternateFileName="BBEE6E~1.JPG")) returned 0 [0115.446] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0115.446] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee6ew[1].jpg")) returned 1 [0115.447] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee6ew[1].jpg")) returned 0xffffffff [0115.447] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454c4930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1d26, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEeFp3[1].jpg", cAlternateFileName="BBEEFP~1.JPG")) returned 1 [0115.447] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeefp3[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0115.448] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeefp3[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0115.448] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d26 [0115.448] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0115.448] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0115.534] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1d26, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1d26, lpOverlapped=0x0) returned 1 [0115.536] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1d30, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1d30, lpOverlapped=0x0) returned 1 [0115.537] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0115.556] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.565] CloseHandle (hObject=0xe0) returned 1 [0115.565] CloseHandle (hObject=0xe4) returned 1 [0115.565] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeefp3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeefp3[1].jpg.dvodltmf")) returned 0 [0115.566] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeefp3[1].jpg.dvodltmf")) returned 0x2020 [0115.566] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454c4930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1d26, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEeFp3[1].jpg", cAlternateFileName="BBEEFP~1.JPG")) returned 0x2e8598 [0115.566] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454c4930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1d26, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEeFp3[1].jpg", cAlternateFileName="BBEEFP~1.JPG")) returned 0 [0115.566] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0115.566] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeefp3[1].jpg")) returned 1 [0115.567] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeefp3[1].jpg")) returned 0xffffffff [0115.567] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe3bfdf0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe3bfdf0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe3bfdf0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEeGwU[1].jpg", cAlternateFileName="BBEEGW~1.JPG")) returned 1 [0115.567] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeegwu[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0115.567] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeegwu[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0115.568] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x780 [0115.568] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0115.568] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0115.654] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x780, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x780, lpOverlapped=0x0) returned 1 [0115.656] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x790, lpOverlapped=0x0) returned 1 [0115.657] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0115.676] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.685] CloseHandle (hObject=0xe4) returned 1 [0115.686] CloseHandle (hObject=0xe0) returned 1 [0115.686] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeegwu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeegwu[1].jpg.dvodltmf")) returned 0 [0115.686] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeegwu[1].jpg.dvodltmf")) returned 0x2020 [0115.686] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe3bfdf0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe3bfdf0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe3bfdf0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEeGwU[1].jpg", cAlternateFileName="BBEEGW~1.JPG")) returned 0x2e8598 [0115.687] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe3bfdf0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe3bfdf0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe3bfdf0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEeGwU[1].jpg", cAlternateFileName="BBEEGW~1.JPG")) returned 0 [0115.687] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0115.687] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeegwu[1].jpg")) returned 1 [0115.688] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeegwu[1].jpg")) returned 0xffffffff [0115.688] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b505b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b505b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b505b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7be, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEeUg0[1].jpg", cAlternateFileName="BBEEUG~1.JPG")) returned 1 [0115.688] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeug0[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0115.688] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeug0[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0115.688] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7be [0115.689] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0115.689] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0115.775] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x7be, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x7be, lpOverlapped=0x0) returned 1 [0115.793] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x7c0, lpOverlapped=0x0) returned 1 [0115.794] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0115.813] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.822] CloseHandle (hObject=0xe0) returned 1 [0115.822] CloseHandle (hObject=0xe4) returned 1 [0115.823] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeug0[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeug0[1].jpg.dvodltmf")) returned 0 [0115.823] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeug0[1].jpg.dvodltmf")) returned 0x2020 [0115.823] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b505b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b505b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b505b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7be, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEeUg0[1].jpg", cAlternateFileName="BBEEUG~1.JPG")) returned 0x2e8598 [0115.824] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b505b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b505b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b505b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7be, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEeUg0[1].jpg", cAlternateFileName="BBEEUG~1.JPG")) returned 0 [0115.824] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0115.824] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeug0[1].jpg")) returned 1 [0115.825] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeug0[1].jpg")) returned 0xffffffff [0115.825] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3a2a, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEeZnr[1].jpg", cAlternateFileName="BBEEZN~1.JPG")) returned 1 [0115.829] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeznr[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0115.829] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeznr[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0115.832] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a2a [0115.832] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0115.833] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0115.921] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3a2a, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x3a2a, lpOverlapped=0x0) returned 1 [0115.923] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3a30, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x3a30, lpOverlapped=0x0) returned 1 [0115.924] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0115.943] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.954] CloseHandle (hObject=0xe4) returned 1 [0115.954] CloseHandle (hObject=0xe0) returned 1 [0115.954] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeznr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeznr[1].jpg.dvodltmf")) returned 0 [0115.955] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeznr[1].jpg.dvodltmf")) returned 0x2020 [0115.955] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3a2a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEeZnr[1].jpg", cAlternateFileName="BBEEZN~1.JPG")) returned 0x2e8598 [0115.955] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3a2a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEeZnr[1].jpg", cAlternateFileName="BBEEZN~1.JPG")) returned 0 [0115.955] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0115.955] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeznr[1].jpg")) returned 1 [0115.956] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeznr[1].jpg")) returned 0xffffffff [0115.956] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2f76, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEf5Lq[1].jpg", cAlternateFileName="BBEF5L~1.JPG")) returned 1 [0115.956] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbef5lq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0115.956] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbef5lq[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0115.957] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2f76 [0115.957] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0115.957] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0116.105] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2f76, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2f76, lpOverlapped=0x0) returned 1 [0116.107] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2f80, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2f80, lpOverlapped=0x0) returned 1 [0116.109] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0116.128] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.138] CloseHandle (hObject=0xe0) returned 1 [0116.138] CloseHandle (hObject=0xe4) returned 1 [0116.138] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbef5lq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbef5lq[1].jpg.dvodltmf")) returned 0 [0116.139] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbef5lq[1].jpg.dvodltmf")) returned 0x2020 [0116.139] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2f76, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEf5Lq[1].jpg", cAlternateFileName="BBEF5L~1.JPG")) returned 0x2e8598 [0116.139] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2f76, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEf5Lq[1].jpg", cAlternateFileName="BBEF5L~1.JPG")) returned 0 [0116.139] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0116.139] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbef5lq[1].jpg")) returned 1 [0116.140] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbef5lq[1].jpg")) returned 0xffffffff [0116.140] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4574c090, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x786, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEfwtU[1].jpg", cAlternateFileName="BBEFWT~1.JPG")) returned 1 [0116.140] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefwtu[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0116.159] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefwtu[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0116.159] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x786 [0116.160] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0116.160] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0116.246] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x786, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x786, lpOverlapped=0x0) returned 1 [0116.334] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x790, lpOverlapped=0x0) returned 1 [0116.335] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0116.354] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.369] CloseHandle (hObject=0xe4) returned 1 [0116.369] CloseHandle (hObject=0xe0) returned 1 [0116.369] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefwtu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefwtu[1].jpg.dvodltmf")) returned 0 [0116.370] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefwtu[1].jpg.dvodltmf")) returned 0x2020 [0116.370] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4574c090, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x786, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEfwtU[1].jpg", cAlternateFileName="BBEFWT~1.JPG")) returned 0x2e8598 [0116.370] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4574c090, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x786, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEfwtU[1].jpg", cAlternateFileName="BBEFWT~1.JPG")) returned 0 [0116.370] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0116.370] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefwtu[1].jpg")) returned 1 [0116.371] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefwtu[1].jpg")) returned 0xffffffff [0116.371] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xa07, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEfzSd[1].jpg", cAlternateFileName="BBEFZS~1.JPG")) returned 1 [0116.371] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefzsd[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0116.372] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefzsd[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0116.373] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa07 [0116.373] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0116.373] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0116.466] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa07, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0xa07, lpOverlapped=0x0) returned 1 [0116.555] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0xa10, lpOverlapped=0x0) returned 1 [0116.556] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0116.575] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.585] CloseHandle (hObject=0xe0) returned 1 [0116.585] CloseHandle (hObject=0xe4) returned 1 [0116.585] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefzsd[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefzsd[1].jpg.dvodltmf")) returned 0 [0116.586] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefzsd[1].jpg.dvodltmf")) returned 0x2020 [0116.586] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xa07, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEfzSd[1].jpg", cAlternateFileName="BBEFZS~1.JPG")) returned 0x2e8598 [0116.586] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xa07, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEfzSd[1].jpg", cAlternateFileName="BBEFZS~1.JPG")) returned 0 [0116.586] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0116.586] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefzsd[1].jpg")) returned 1 [0116.587] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefzsd[1].jpg")) returned 0xffffffff [0116.587] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454eaa90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454eaa90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454eaa90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1998, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEgCuQ[1].jpg", cAlternateFileName="BBEGCU~1.JPG")) returned 1 [0116.587] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegcuq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0116.588] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegcuq[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0116.588] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1998 [0116.588] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0116.589] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0116.676] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1998, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1998, lpOverlapped=0x0) returned 1 [0116.678] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x19a0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x19a0, lpOverlapped=0x0) returned 1 [0116.679] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0116.698] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.707] CloseHandle (hObject=0xe4) returned 1 [0116.707] CloseHandle (hObject=0xe0) returned 1 [0116.708] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegcuq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegcuq[1].jpg.dvodltmf")) returned 0 [0116.708] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegcuq[1].jpg.dvodltmf")) returned 0x2020 [0116.708] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454eaa90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454eaa90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454eaa90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1998, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEgCuQ[1].jpg", cAlternateFileName="BBEGCU~1.JPG")) returned 0x2e8598 [0116.709] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454eaa90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454eaa90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454eaa90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1998, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEgCuQ[1].jpg", cAlternateFileName="BBEGCU~1.JPG")) returned 0 [0116.709] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0116.709] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegcuq[1].jpg")) returned 1 [0116.710] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegcuq[1].jpg")) returned 0xffffffff [0116.710] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454eaa90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1a65, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEgHzB[1].jpg", cAlternateFileName="BBEGHZ~1.JPG")) returned 1 [0116.710] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeghzb[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0116.710] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeghzb[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0116.710] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a65 [0116.710] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0116.711] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0116.794] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1a65, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1a65, lpOverlapped=0x0) returned 1 [0116.797] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1a70, lpOverlapped=0x0) returned 1 [0116.798] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0116.817] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.827] CloseHandle (hObject=0xe0) returned 1 [0116.827] CloseHandle (hObject=0xe4) returned 1 [0116.827] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeghzb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeghzb[1].jpg.dvodltmf")) returned 0 [0116.828] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeghzb[1].jpg.dvodltmf")) returned 0x2020 [0116.828] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454eaa90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1a65, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEgHzB[1].jpg", cAlternateFileName="BBEGHZ~1.JPG")) returned 0x2e8598 [0116.828] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454eaa90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1a65, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEgHzB[1].jpg", cAlternateFileName="BBEGHZ~1.JPG")) returned 0 [0116.828] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0116.828] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeghzb[1].jpg")) returned 1 [0116.829] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeghzb[1].jpg")) returned 0xffffffff [0116.829] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde8add0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde8add0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdeb0f30, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5a45, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEgIl2[1].jpg", cAlternateFileName="BBEGIL~1.JPG")) returned 1 [0116.829] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0116.829] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0116.830] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5a45 [0116.830] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0116.830] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0116.914] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x5a45, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x5a45, lpOverlapped=0x0) returned 1 [0116.919] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x5a50, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x5a50, lpOverlapped=0x0) returned 1 [0116.920] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0116.939] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.949] CloseHandle (hObject=0xe4) returned 1 [0116.949] CloseHandle (hObject=0xe0) returned 1 [0116.949] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[1].jpg.dvodltmf")) returned 0 [0116.949] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[1].jpg.dvodltmf")) returned 0x2020 [0116.950] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde8add0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde8add0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdeb0f30, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5a45, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEgIl2[1].jpg", cAlternateFileName="BBEGIL~1.JPG")) returned 0x2e8598 [0116.950] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde8add0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde8add0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdeb0f30, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5a45, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEgIl2[1].jpg", cAlternateFileName="BBEGIL~1.JPG")) returned 0 [0116.950] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0116.950] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[1].jpg")) returned 1 [0116.951] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[1].jpg")) returned 0xffffffff [0116.951] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b2a450, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b2a450, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b2a450, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x388f, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEgIl2[2].jpg", cAlternateFileName="BBEGIL~2.JPG")) returned 1 [0116.951] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0116.951] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[2].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0116.952] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x388f [0116.952] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0116.952] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0117.036] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x388f, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x388f, lpOverlapped=0x0) returned 1 [0117.038] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3890, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x3890, lpOverlapped=0x0) returned 1 [0117.039] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0117.059] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.070] CloseHandle (hObject=0xe0) returned 1 [0117.070] CloseHandle (hObject=0xe4) returned 1 [0117.070] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[2].jpg.dvodltmf")) returned 0 [0117.071] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[2].jpg.dvodltmf")) returned 0x2020 [0117.071] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b2a450, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b2a450, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b2a450, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x388f, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEgIl2[2].jpg", cAlternateFileName="BBEGIL~2.JPG")) returned 0x2e8598 [0117.071] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b2a450, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b2a450, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b2a450, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x388f, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEgIl2[2].jpg", cAlternateFileName="BBEGIL~2.JPG")) returned 0 [0117.071] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0117.071] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[2].jpg")) returned 1 [0117.073] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[2].jpg")) returned 0xffffffff [0117.073] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1e97, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEgIyL[1].jpg", cAlternateFileName="BBEGIY~1.JPG")) returned 1 [0117.073] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegiyl[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0117.073] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegiyl[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0117.074] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1e97 [0117.074] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0117.074] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0117.167] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1e97, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1e97, lpOverlapped=0x0) returned 1 [0117.168] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1ea0, lpOverlapped=0x0) returned 1 [0117.169] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0117.189] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.199] CloseHandle (hObject=0xe4) returned 1 [0117.199] CloseHandle (hObject=0xe0) returned 1 [0117.199] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegiyl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegiyl[1].jpg.dvodltmf")) returned 0 [0117.200] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegiyl[1].jpg.dvodltmf")) returned 0x2020 [0117.200] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1e97, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEgIyL[1].jpg", cAlternateFileName="BBEGIY~1.JPG")) returned 0x2e8598 [0117.200] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1e97, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEgIyL[1].jpg", cAlternateFileName="BBEGIY~1.JPG")) returned 0 [0117.200] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0117.200] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegiyl[1].jpg")) returned 1 [0117.201] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegiyl[1].jpg")) returned 0xffffffff [0117.201] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23bf, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEgkY6[1].jpg", cAlternateFileName="BBEGKY~1.JPG")) returned 1 [0117.201] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegky6[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0117.201] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegky6[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0117.202] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x23bf [0117.202] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0117.202] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0117.288] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x23bf, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x23bf, lpOverlapped=0x0) returned 1 [0117.290] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x23c0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x23c0, lpOverlapped=0x0) returned 1 [0117.301] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0117.321] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.331] CloseHandle (hObject=0xe0) returned 1 [0117.331] CloseHandle (hObject=0xe4) returned 1 [0117.331] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegky6[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegky6[1].jpg.dvodltmf")) returned 0 [0117.332] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegky6[1].jpg.dvodltmf")) returned 0x2020 [0117.332] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23bf, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEgkY6[1].jpg", cAlternateFileName="BBEGKY~1.JPG")) returned 0x2e8598 [0117.332] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23bf, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEgkY6[1].jpg", cAlternateFileName="BBEGKY~1.JPG")) returned 0 [0117.332] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0117.332] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegky6[1].jpg")) returned 1 [0117.333] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegky6[1].jpg")) returned 0xffffffff [0117.333] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4574c090, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8df, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEgLzV[1].jpg", cAlternateFileName="BBEGLZ~1.JPG")) returned 1 [0117.333] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeglzv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0117.333] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeglzv[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0117.334] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8df [0117.334] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0117.334] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0117.415] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x8df, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x8df, lpOverlapped=0x0) returned 1 [0117.417] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x8e0, lpOverlapped=0x0) returned 1 [0117.418] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0117.437] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.447] CloseHandle (hObject=0xe4) returned 1 [0117.447] CloseHandle (hObject=0xe0) returned 1 [0117.447] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeglzv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeglzv[1].jpg.dvodltmf")) returned 0 [0117.448] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeglzv[1].jpg.dvodltmf")) returned 0x2020 [0117.448] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4574c090, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8df, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEgLzV[1].jpg", cAlternateFileName="BBEGLZ~1.JPG")) returned 0x2e8598 [0117.448] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4574c090, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8df, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEgLzV[1].jpg", cAlternateFileName="BBEGLZ~1.JPG")) returned 0 [0117.448] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0117.448] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeglzv[1].jpg")) returned 1 [0117.449] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeglzv[1].jpg")) returned 0xffffffff [0117.449] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b8d, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEgUri[1].jpg", cAlternateFileName="BBEGUR~1.JPG")) returned 1 [0117.449] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeguri[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0117.450] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeguri[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0117.450] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b8d [0117.450] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0117.451] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0117.536] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2b8d, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2b8d, lpOverlapped=0x0) returned 1 [0117.538] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2b90, lpOverlapped=0x0) returned 1 [0117.539] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0117.558] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.568] CloseHandle (hObject=0xe0) returned 1 [0117.568] CloseHandle (hObject=0xe4) returned 1 [0117.568] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeguri[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeguri[1].jpg.dvodltmf")) returned 0 [0117.569] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeguri[1].jpg.dvodltmf")) returned 0x2020 [0117.569] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b8d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEgUri[1].jpg", cAlternateFileName="BBEGUR~1.JPG")) returned 0x2e8598 [0117.569] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b8d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEgUri[1].jpg", cAlternateFileName="BBEGUR~1.JPG")) returned 0 [0117.569] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0117.569] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeguri[1].jpg")) returned 1 [0117.570] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeguri[1].jpg")) returned 0xffffffff [0117.570] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457721f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457721f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457721f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x201f, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEgXBv[1].jpg", cAlternateFileName="BBEGXB~1.JPG")) returned 1 [0117.570] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegxbv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0117.570] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegxbv[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0117.571] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x201f [0117.571] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0117.572] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0117.673] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x201f, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x201f, lpOverlapped=0x0) returned 1 [0117.674] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2020, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2020, lpOverlapped=0x0) returned 1 [0117.675] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0117.695] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.705] CloseHandle (hObject=0xe4) returned 1 [0117.705] CloseHandle (hObject=0xe0) returned 1 [0117.705] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegxbv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegxbv[1].jpg.dvodltmf")) returned 0 [0117.706] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegxbv[1].jpg.dvodltmf")) returned 0x2020 [0117.706] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457721f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457721f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457721f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x201f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEgXBv[1].jpg", cAlternateFileName="BBEGXB~1.JPG")) returned 0x2e8598 [0117.706] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457721f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457721f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457721f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x201f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEgXBv[1].jpg", cAlternateFileName="BBEGXB~1.JPG")) returned 0 [0117.706] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0117.706] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegxbv[1].jpg")) returned 1 [0117.707] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegxbv[1].jpg")) returned 0xffffffff [0117.707] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe327870, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe327870, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe34d9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6e9, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEgZME[1].jpg", cAlternateFileName="BBEGZM~1.JPG")) returned 1 [0117.707] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegzme[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0117.708] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegzme[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0117.708] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6e9 [0117.708] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0117.709] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0117.798] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x6e9, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x6e9, lpOverlapped=0x0) returned 1 [0117.799] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x6f0, lpOverlapped=0x0) returned 1 [0117.800] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0117.819] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.829] CloseHandle (hObject=0xe0) returned 1 [0117.829] CloseHandle (hObject=0xe4) returned 1 [0117.829] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegzme[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegzme[1].jpg.dvodltmf")) returned 0 [0117.830] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegzme[1].jpg.dvodltmf")) returned 0x2020 [0117.830] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe327870, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe327870, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe34d9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6e9, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEgZME[1].jpg", cAlternateFileName="BBEGZM~1.JPG")) returned 0x2e8598 [0117.830] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe327870, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe327870, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe34d9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6e9, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEgZME[1].jpg", cAlternateFileName="BBEGZM~1.JPG")) returned 0 [0117.830] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0117.830] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegzme[1].jpg")) returned 1 [0117.831] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegzme[1].jpg")) returned 0xffffffff [0117.831] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBghfVy[1].png", cAlternateFileName="BBGHFV~1.PNG")) returned 1 [0117.831] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbghfvy[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0117.831] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbghfvy[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0117.832] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1dc [0117.832] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0117.832] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0117.942] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1dc, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1dc, lpOverlapped=0x0) returned 1 [0117.946] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1e0, lpOverlapped=0x0) returned 1 [0117.947] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0117.966] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.976] CloseHandle (hObject=0xe4) returned 1 [0117.976] CloseHandle (hObject=0xe0) returned 1 [0117.976] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbghfvy[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbghfvy[1].png.dvodltmf")) returned 0 [0117.977] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbghfvy[1].png.dvodltmf")) returned 0x2020 [0117.977] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBghfVy[1].png", cAlternateFileName="BBGHFV~1.PNG")) returned 0x2e8598 [0117.977] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBghfVy[1].png", cAlternateFileName="BBGHFV~1.PNG")) returned 0 [0117.977] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0117.977] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbghfvy[1].png")) returned 1 [0117.978] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbghfvy[1].png")) returned 0xffffffff [0117.978] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1af, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBkwUr[1].png", cAlternateFileName="BBKWUR~1.PNG")) returned 1 [0117.978] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbkwur[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0117.978] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbkwur[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0117.979] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1af [0117.979] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0117.979] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0118.063] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1af, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1af, lpOverlapped=0x0) returned 1 [0118.065] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1b0, lpOverlapped=0x0) returned 1 [0118.066] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0118.085] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.095] CloseHandle (hObject=0xe0) returned 1 [0118.095] CloseHandle (hObject=0xe4) returned 1 [0118.095] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbkwur[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbkwur[1].png.dvodltmf")) returned 0 [0118.096] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbkwur[1].png.dvodltmf")) returned 0x2020 [0118.096] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1af, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBkwUr[1].png", cAlternateFileName="BBKWUR~1.PNG")) returned 0x2e8598 [0118.096] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1af, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBkwUr[1].png", cAlternateFileName="BBKWUR~1.PNG")) returned 0 [0118.096] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0118.096] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbkwur[1].png")) returned 1 [0118.097] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbkwur[1].png")) returned 0xffffffff [0118.097] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23b, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBlBV0U[1].png", cAlternateFileName="BBLBV0~1.PNG")) returned 1 [0118.097] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bblbv0u[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0118.097] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bblbv0u[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0118.098] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x23b [0118.098] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0118.098] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0118.188] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x23b, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x23b, lpOverlapped=0x0) returned 1 [0118.190] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x240, lpOverlapped=0x0) returned 1 [0118.191] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0118.210] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.220] CloseHandle (hObject=0xe4) returned 1 [0118.220] CloseHandle (hObject=0xe0) returned 1 [0118.220] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bblbv0u[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bblbv0u[1].png.dvodltmf")) returned 0 [0118.221] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bblbv0u[1].png.dvodltmf")) returned 0x2020 [0118.221] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBlBV0U[1].png", cAlternateFileName="BBLBV0~1.PNG")) returned 0x2e8598 [0118.221] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBlBV0U[1].png", cAlternateFileName="BBLBV0~1.PNG")) returned 0 [0118.221] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0118.221] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bblbv0u[1].png")) returned 1 [0118.222] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bblbv0u[1].png")) returned 0xffffffff [0118.222] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5159c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5159c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5159c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3376, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBzhWWE[1].jpg", cAlternateFileName="BBZHWW~1.JPG")) returned 1 [0118.222] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbzhwwe[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0118.222] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbzhwwe[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0118.223] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3376 [0118.223] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0118.223] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0118.309] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3376, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x3376, lpOverlapped=0x0) returned 1 [0118.311] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3380, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x3380, lpOverlapped=0x0) returned 1 [0118.312] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0118.332] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.341] CloseHandle (hObject=0xe0) returned 1 [0118.341] CloseHandle (hObject=0xe4) returned 1 [0118.341] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbzhwwe[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbzhwwe[1].jpg.dvodltmf")) returned 0 [0118.342] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbzhwwe[1].jpg.dvodltmf")) returned 0x2020 [0118.342] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5159c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5159c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5159c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3376, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBzhWWE[1].jpg", cAlternateFileName="BBZHWW~1.JPG")) returned 0x2e8598 [0118.342] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5159c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5159c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5159c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3376, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBzhWWE[1].jpg", cAlternateFileName="BBZHWW~1.JPG")) returned 0 [0118.342] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0118.343] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbzhwwe[1].jpg")) returned 1 [0118.344] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbzhwwe[1].jpg")) returned 0xffffffff [0118.344] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60baae40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60baae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60c433c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13c06, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="benefits-2[1].jpg", cAlternateFileName="BENEFI~2.JPG")) returned 1 [0118.344] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-2[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0118.344] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-2[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0118.345] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13c06 [0118.345] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0118.345] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0118.429] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x13c06, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x13c06, lpOverlapped=0x0) returned 1 [0118.432] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x13c10, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x13c10, lpOverlapped=0x0) returned 1 [0118.435] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0118.454] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.464] CloseHandle (hObject=0xe4) returned 1 [0118.464] CloseHandle (hObject=0xe0) returned 1 [0118.464] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-2[1].jpg.dvodltmf")) returned 0 [0118.465] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-2[1].jpg.dvodltmf")) returned 0x2020 [0118.465] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60baae40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60baae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60c433c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13c06, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="benefits-2[1].jpg", cAlternateFileName="BENEFI~2.JPG")) returned 0x2e8598 [0118.465] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60baae40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60baae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60c433c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13c06, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="benefits-2[1].jpg", cAlternateFileName="BENEFI~2.JPG")) returned 0 [0118.465] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0118.465] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-2[1].jpg")) returned 1 [0118.467] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-2[1].jpg")) returned 0xffffffff [0118.467] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60b84ce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60b84ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60c1d260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x144cd, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="benefits-4[1].jpg", cAlternateFileName="BENEFI~1.JPG")) returned 1 [0118.467] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-4[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0118.467] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-4[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0118.468] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x144cd [0118.468] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0118.468] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0118.554] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x144cd, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x144cd, lpOverlapped=0x0) returned 1 [0118.557] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x144d0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x144d0, lpOverlapped=0x0) returned 1 [0118.559] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0118.579] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.588] CloseHandle (hObject=0xe0) returned 1 [0118.589] CloseHandle (hObject=0xe4) returned 1 [0118.589] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-4[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-4[1].jpg.dvodltmf")) returned 0 [0118.589] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-4[1].jpg.dvodltmf")) returned 0x2020 [0118.589] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60b84ce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60b84ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60c1d260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x144cd, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="benefits-4[1].jpg", cAlternateFileName="BENEFI~1.JPG")) returned 0x2e8598 [0118.590] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60b84ce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60b84ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60c1d260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x144cd, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="benefits-4[1].jpg", cAlternateFileName="BENEFI~1.JPG")) returned 0 [0118.590] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0118.590] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-4[1].jpg")) returned 1 [0118.591] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-4[1].jpg")) returned 0xffffffff [0118.591] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf4dbc10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf4dbc10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf4dbc10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6f15, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="bootstrap[1].js", cAlternateFileName="BOOTST~1.JS")) returned 1 [0118.591] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bootstrap[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0118.591] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bootstrap[1].js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0118.592] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6f15 [0118.592] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0118.592] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0118.678] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x6f15, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x6f15, lpOverlapped=0x0) returned 1 [0118.680] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x6f20, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x6f20, lpOverlapped=0x0) returned 1 [0118.681] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0118.700] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.709] CloseHandle (hObject=0xe4) returned 1 [0118.710] CloseHandle (hObject=0xe0) returned 1 [0118.720] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bootstrap[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bootstrap[1].js.dvodltmf")) returned 0 [0118.721] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bootstrap[1].js.dvodltmf")) returned 0x2020 [0118.721] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf4dbc10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf4dbc10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf4dbc10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6f15, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="bootstrap[1].js", cAlternateFileName="BOOTST~1.JS")) returned 0x2e8598 [0118.721] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf4dbc10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf4dbc10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf4dbc10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6f15, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="bootstrap[1].js", cAlternateFileName="BOOTST~1.JS")) returned 0 [0118.721] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0118.721] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bootstrap[1].js")) returned 1 [0118.722] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bootstrap[1].js")) returned 0xffffffff [0118.722] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x583e0320, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x583e0320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x583e0320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf6, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="browser[1].htm", cAlternateFileName="BROWSE~1.HTM")) returned 1 [0118.722] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\browser[1].htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0118.723] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\browser[1].htm.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0118.724] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaf6 [0118.724] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0118.724] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0118.808] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xaf6, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0xaf6, lpOverlapped=0x0) returned 1 [0118.814] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb00, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0xb00, lpOverlapped=0x0) returned 1 [0118.815] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0118.834] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.844] CloseHandle (hObject=0xe0) returned 1 [0118.844] CloseHandle (hObject=0xe4) returned 1 [0118.844] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\browser[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\browser[1].htm.dvodltmf")) returned 0 [0118.845] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\browser[1].htm.dvodltmf")) returned 0x2020 [0118.845] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x583e0320, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x583e0320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x583e0320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf6, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="browser[1].htm", cAlternateFileName="BROWSE~1.HTM")) returned 0x2e8598 [0118.845] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x583e0320, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x583e0320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x583e0320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf6, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="browser[1].htm", cAlternateFileName="BROWSE~1.HTM")) returned 0 [0118.845] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0118.845] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\browser[1].htm")) returned 1 [0118.846] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\browser[1].htm")) returned 0xffffffff [0118.846] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b2b1b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b2b1b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b2b1b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4dd8, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="bs-jsdep[1].css", cAlternateFileName="BS-JSD~1.CSS")) returned 1 [0118.847] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bs-jsdep[1].css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0118.848] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bs-jsdep[1].css.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0118.848] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4dd8 [0118.848] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0118.849] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0118.930] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4dd8, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x4dd8, lpOverlapped=0x0) returned 1 [0119.064] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x4de0, lpOverlapped=0x0) returned 1 [0119.066] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0119.087] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.096] CloseHandle (hObject=0xe4) returned 1 [0119.096] CloseHandle (hObject=0xe0) returned 1 [0119.097] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bs-jsdep[1].css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bs-jsdep[1].css.dvodltmf")) returned 0 [0119.097] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bs-jsdep[1].css.dvodltmf")) returned 0x2020 [0119.097] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b2b1b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b2b1b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b2b1b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4dd8, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="bs-jsdep[1].css", cAlternateFileName="BS-JSD~1.CSS")) returned 0x2e8598 [0119.098] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b2b1b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b2b1b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b2b1b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4dd8, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="bs-jsdep[1].css", cAlternateFileName="BS-JSD~1.CSS")) returned 0 [0119.098] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0119.098] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bs-jsdep[1].css")) returned 1 [0119.099] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bs-jsdep[1].css")) returned 0xffffffff [0119.099] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61341460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61341460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x613675c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c9f6, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="cb=gapi[1].loaded_0", cAlternateFileName="CB_GAP~1.LOA")) returned 1 [0119.099] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\cb=gapi[1].loaded_0"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0119.100] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\cb=gapi[1].loaded_0.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0119.100] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c9f6 [0119.100] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0119.101] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0119.204] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1c9f6, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1c9f6, lpOverlapped=0x0) returned 1 [0119.208] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1ca00, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1ca00, lpOverlapped=0x0) returned 1 [0119.210] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0119.230] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.240] CloseHandle (hObject=0xe0) returned 1 [0119.240] CloseHandle (hObject=0xe4) returned 1 [0119.240] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\cb=gapi[1].loaded_0"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\cb=gapi[1].loaded_0.dvodltmf")) returned 0 [0119.241] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\cb=gapi[1].loaded_0.dvodltmf")) returned 0x2020 [0119.241] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61341460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61341460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x613675c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c9f6, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="cb=gapi[1].loaded_0", cAlternateFileName="CB_GAP~1.LOA")) returned 0x2e8598 [0119.241] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61341460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61341460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x613675c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c9f6, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="cb=gapi[1].loaded_0", cAlternateFileName="CB_GAP~1.LOA")) returned 0 [0119.241] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0119.241] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\cb=gapi[1].loaded_0")) returned 1 [0119.243] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\cb=gapi[1].loaded_0")) returned 0xffffffff [0119.243] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="collect[1].gif", cAlternateFileName="COLLEC~1.GIF")) returned 1 [0119.243] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\collect[1].gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0119.243] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\collect[1].gif.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0119.244] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b [0119.244] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0119.244] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0119.329] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2b, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2b, lpOverlapped=0x0) returned 1 [0119.330] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x30, lpOverlapped=0x0) returned 1 [0119.331] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0119.351] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.360] CloseHandle (hObject=0xe4) returned 1 [0119.360] CloseHandle (hObject=0xe0) returned 1 [0119.361] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\collect[1].gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\collect[1].gif.dvodltmf")) returned 0 [0119.361] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\collect[1].gif.dvodltmf")) returned 0x2020 [0119.361] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="collect[1].gif", cAlternateFileName="COLLEC~1.GIF")) returned 0x2e8598 [0119.362] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="collect[1].gif", cAlternateFileName="COLLEC~1.GIF")) returned 0 [0119.362] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0119.362] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\collect[1].gif")) returned 1 [0119.363] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\collect[1].gif")) returned 0xffffffff [0119.363] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b51310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b51310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b51310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29349, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="core[1].css", cAlternateFileName="CORE_1~1.CSS")) returned 1 [0119.363] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\core[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\core[1].css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0119.363] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\core[1].css.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\core[1].css.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0119.364] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29349 [0119.364] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0119.364] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0119.454] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x29349, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x29349, lpOverlapped=0x0) returned 1 [0119.459] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x29350, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x29350, lpOverlapped=0x0) returned 1 [0119.462] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0119.482] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.492] CloseHandle (hObject=0xe0) returned 1 [0119.492] CloseHandle (hObject=0xe4) returned 1 [0119.492] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\core[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\core[1].css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\core[1].css.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\core[1].css.dvodltmf")) returned 0 [0119.493] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\core[1].css.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\core[1].css.dvodltmf")) returned 0x2020 [0119.493] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\core[1].css", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b51310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b51310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b51310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29349, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="core[1].css", cAlternateFileName="CORE_1~1.CSS")) returned 0x2e8598 [0119.493] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b51310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b51310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b51310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29349, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="core[1].css", cAlternateFileName="CORE_1~1.CSS")) returned 0 [0119.493] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0119.493] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\core[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\core[1].css")) returned 1 [0119.495] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\core[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\core[1].css")) returned 0xffffffff [0119.495] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0119.495] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0119.495] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0119.496] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0119.496] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0119.496] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0119.582] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x43, lpOverlapped=0x0) returned 1 [0119.583] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x50, lpOverlapped=0x0) returned 1 [0119.584] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0119.604] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.613] CloseHandle (hObject=0xe4) returned 1 [0119.613] CloseHandle (hObject=0xe0) returned 1 [0119.613] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\desktop.ini.dvodltmf")) returned 0 [0119.614] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\desktop.ini.dvodltmf")) returned 0x2020 [0119.614] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\desktop.ini", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8598 [0119.614] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0119.614] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0119.614] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\desktop.ini")) returned 1 [0119.616] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\desktop.ini")) returned 0xffffffff [0119.616] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54ca7f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54ca7f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54ca7f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a3c, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="DevCMDL2.2.18[1].eot", cAlternateFileName="DEVCMD~1.EOT")) returned 1 [0119.616] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\DevCMDL2.2.18[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\devcmdl2.2.18[1].eot"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0119.616] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\DevCMDL2.2.18[1].eot.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\devcmdl2.2.18[1].eot.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0119.617] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2a3c [0119.617] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0119.617] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0119.703] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2a3c, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2a3c, lpOverlapped=0x0) returned 1 [0119.705] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2a40, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2a40, lpOverlapped=0x0) returned 1 [0119.706] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0119.726] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.735] CloseHandle (hObject=0xe0) returned 1 [0119.736] CloseHandle (hObject=0xe4) returned 1 [0119.736] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\DevCMDL2.2.18[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\devcmdl2.2.18[1].eot"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\DevCMDL2.2.18[1].eot.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\devcmdl2.2.18[1].eot.dvodltmf")) returned 0 [0119.736] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\DevCMDL2.2.18[1].eot.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\devcmdl2.2.18[1].eot.dvodltmf")) returned 0x2020 [0119.737] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\DevCMDL2.2.18[1].eot", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54ca7f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54ca7f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54ca7f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a3c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="DevCMDL2.2.18[1].eot", cAlternateFileName="DEVCMD~1.EOT")) returned 0x2e8598 [0119.737] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54ca7f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54ca7f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54ca7f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a3c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="DevCMDL2.2.18[1].eot", cAlternateFileName="DEVCMD~1.EOT")) returned 0 [0119.737] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0119.737] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\DevCMDL2.2.18[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\devcmdl2.2.18[1].eot")) returned 1 [0119.738] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\DevCMDL2.2.18[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\devcmdl2.2.18[1].eot")) returned 0xffffffff [0119.738] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5120a1b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5120a1b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5120a1b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="e151e5[1].gif", cAlternateFileName="E151E5~1.GIF")) returned 1 [0119.738] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e151e5[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e151e5[1].gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0119.738] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e151e5[1].gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e151e5[1].gif.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0119.739] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b [0119.739] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0119.739] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0119.858] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2b, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2b, lpOverlapped=0x0) returned 1 [0119.859] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x30, lpOverlapped=0x0) returned 1 [0119.860] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0119.879] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.889] CloseHandle (hObject=0xe4) returned 1 [0119.889] CloseHandle (hObject=0xe0) returned 1 [0119.889] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e151e5[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e151e5[1].gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e151e5[1].gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e151e5[1].gif.dvodltmf")) returned 0 [0119.890] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e151e5[1].gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e151e5[1].gif.dvodltmf")) returned 0x2020 [0119.890] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e151e5[1].gif", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5120a1b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5120a1b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5120a1b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="e151e5[1].gif", cAlternateFileName="E151E5~1.GIF")) returned 0x2e8598 [0119.890] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5120a1b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5120a1b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5120a1b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="e151e5[1].gif", cAlternateFileName="E151E5~1.GIF")) returned 0 [0119.890] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0119.890] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e151e5[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e151e5[1].gif")) returned 1 [0119.891] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e151e5[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e151e5[1].gif")) returned 0xffffffff [0119.891] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5101afd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5101afd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5101afd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24e29, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="e4-190963-91cdfbc1[1].txt", cAlternateFileName="E4-190~1.TXT")) returned 1 [0119.891] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e4-190963-91cdfbc1[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0119.892] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e4-190963-91cdfbc1[1].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0119.892] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x24e29 [0119.892] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0119.893] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0119.983] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x24e29, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x24e29, lpOverlapped=0x0) returned 1 [0119.987] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x24e30, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x24e30, lpOverlapped=0x0) returned 1 [0119.990] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0120.010] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.019] CloseHandle (hObject=0xe0) returned 1 [0120.020] CloseHandle (hObject=0xe4) returned 1 [0120.020] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e4-190963-91cdfbc1[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e4-190963-91cdfbc1[1].txt.dvodltmf")) returned 0 [0120.021] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e4-190963-91cdfbc1[1].txt.dvodltmf")) returned 0x2020 [0120.021] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5101afd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5101afd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5101afd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24e29, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="e4-190963-91cdfbc1[1].txt", cAlternateFileName="E4-190~1.TXT")) returned 0x2e8598 [0120.021] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5101afd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5101afd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5101afd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24e29, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="e4-190963-91cdfbc1[1].txt", cAlternateFileName="E4-190~1.TXT")) returned 0 [0120.021] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0120.021] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e4-190963-91cdfbc1[1].txt")) returned 1 [0120.023] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e4-190963-91cdfbc1[1].txt")) returned 0xffffffff [0120.023] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60b5eb80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60b5eb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60f89200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf8f5, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="eula_text[1].htm", cAlternateFileName="EULA_T~1.HTM")) returned 1 [0120.023] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\eula_text[1].htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0120.023] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\eula_text[1].htm.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0120.024] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf8f5 [0120.024] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0120.024] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0120.108] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xf8f5, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0xf8f5, lpOverlapped=0x0) returned 1 [0120.111] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf900, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0xf900, lpOverlapped=0x0) returned 1 [0120.112] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0120.134] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.143] CloseHandle (hObject=0xe4) returned 1 [0120.143] CloseHandle (hObject=0xe0) returned 1 [0120.143] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\eula_text[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\eula_text[1].htm.dvodltmf")) returned 0 [0120.144] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\eula_text[1].htm.dvodltmf")) returned 0x2020 [0120.144] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60b5eb80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60b5eb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60f89200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf8f5, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="eula_text[1].htm", cAlternateFileName="EULA_T~1.HTM")) returned 0x2e8598 [0120.144] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60b5eb80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60b5eb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60f89200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf8f5, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="eula_text[1].htm", cAlternateFileName="EULA_T~1.HTM")) returned 0 [0120.144] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0120.144] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\eula_text[1].htm")) returned 1 [0120.146] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\eula_text[1].htm")) returned 0xffffffff [0120.146] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62410fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62410fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62410fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x34ce, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="f[1].txt", cAlternateFileName="F_1_~1.TXT")) returned 1 [0120.146] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\f[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0120.155] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\f[1].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0120.155] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x34ce [0120.155] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0120.156] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0120.241] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x34ce, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x34ce, lpOverlapped=0x0) returned 1 [0120.243] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x34d0, lpOverlapped=0x0) returned 1 [0120.244] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0120.264] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.273] CloseHandle (hObject=0xe0) returned 1 [0120.273] CloseHandle (hObject=0xe4) returned 1 [0120.273] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\f[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\f[1].txt.dvodltmf")) returned 0 [0120.274] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\f[1].txt.dvodltmf")) returned 0x2020 [0120.274] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62410fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62410fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62410fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x34ce, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="f[1].txt", cAlternateFileName="F_1_~1.TXT")) returned 0x2e8598 [0120.274] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62410fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62410fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62410fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x34ce, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="f[1].txt", cAlternateFileName="F_1_~1.TXT")) returned 0 [0120.274] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0120.275] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\f[1].txt")) returned 1 [0120.275] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\f[1].txt")) returned 0xffffffff [0120.276] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53089b90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53089b90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1254, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", cAlternateFileName="GETYPE~1")) returned 1 [0120.276] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60ef0c80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60ef0c80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60f16de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6a6, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="google_plus_16dp[1].png", cAlternateFileName="GOOGLE~1.PNG")) returned 1 [0120.276] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\google_plus_16dp[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0120.276] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\google_plus_16dp[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0120.276] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6a6 [0120.276] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0120.277] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0120.363] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x6a6, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x6a6, lpOverlapped=0x0) returned 1 [0120.374] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x6b0, lpOverlapped=0x0) returned 1 [0120.375] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0120.395] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.404] CloseHandle (hObject=0xe4) returned 1 [0120.404] CloseHandle (hObject=0xe0) returned 1 [0120.405] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\google_plus_16dp[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\google_plus_16dp[1].png.dvodltmf")) returned 0 [0120.405] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\google_plus_16dp[1].png.dvodltmf")) returned 0x2020 [0120.405] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60ef0c80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60ef0c80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60f16de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6a6, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="google_plus_16dp[1].png", cAlternateFileName="GOOGLE~1.PNG")) returned 0x2e8598 [0120.406] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60ef0c80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60ef0c80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60f16de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6a6, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="google_plus_16dp[1].png", cAlternateFileName="GOOGLE~1.PNG")) returned 0 [0120.406] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0120.406] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\google_plus_16dp[1].png")) returned 1 [0120.407] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\google_plus_16dp[1].png")) returned 0xffffffff [0120.407] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5de2e5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5de2e5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5de54720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb6c8, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="index[1].htm", cAlternateFileName="INDEX_~1.HTM")) returned 1 [0120.407] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\index[1].htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0120.407] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\index[1].htm.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0120.407] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb6c8 [0120.408] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0120.408] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0120.498] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb6c8, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0xb6c8, lpOverlapped=0x0) returned 1 [0120.500] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb6d0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0xb6d0, lpOverlapped=0x0) returned 1 [0120.502] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0120.521] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.530] CloseHandle (hObject=0xe0) returned 1 [0120.530] CloseHandle (hObject=0xe4) returned 1 [0120.533] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\index[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\index[1].htm.dvodltmf")) returned 0 [0120.534] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\index[1].htm.dvodltmf")) returned 0x2020 [0120.534] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5de2e5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5de2e5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5de54720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb6c8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="index[1].htm", cAlternateFileName="INDEX_~1.HTM")) returned 0x2e8598 [0120.534] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5de2e5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5de2e5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5de54720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb6c8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="index[1].htm", cAlternateFileName="INDEX_~1.HTM")) returned 0 [0120.535] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0120.535] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\index[1].htm")) returned 1 [0120.536] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\index[1].htm")) returned 0xffffffff [0120.536] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54fa1af0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54fa1af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54fa1af0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="print[1].txt", cAlternateFileName="PRINT_~1.TXT")) returned 1 [0120.536] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\print[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0120.536] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\print[1].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0120.537] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa2 [0120.537] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0120.537] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0120.622] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa2, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0xa2, lpOverlapped=0x0) returned 1 [0120.623] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0xb0, lpOverlapped=0x0) returned 1 [0120.624] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0120.644] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.654] CloseHandle (hObject=0xe4) returned 1 [0120.654] CloseHandle (hObject=0xe0) returned 1 [0120.654] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\print[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\print[1].txt.dvodltmf")) returned 0 [0120.655] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\print[1].txt.dvodltmf")) returned 0x2020 [0120.655] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54fa1af0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54fa1af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54fa1af0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="print[1].txt", cAlternateFileName="PRINT_~1.TXT")) returned 0x2e8598 [0120.655] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54fa1af0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54fa1af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54fa1af0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="print[1].txt", cAlternateFileName="PRINT_~1.TXT")) returned 0 [0120.655] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0120.655] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\print[1].txt")) returned 1 [0120.656] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\print[1].txt")) returned 0xffffffff [0120.656] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44f697b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44f697b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44f8f910, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x15429, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="Standard[1]", cAlternateFileName="STANDA~1")) returned 1 [0120.656] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfbb3b50, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfbb3b50, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfbb3b50, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x67, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="tecjslog[1].png", cAlternateFileName="TECJSL~1.PNG")) returned 1 [0120.656] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\tecjslog[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0120.656] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\tecjslog[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0120.657] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x67 [0120.657] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0120.657] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0120.743] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x67, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x67, lpOverlapped=0x0) returned 1 [0120.745] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x70, lpOverlapped=0x0) returned 1 [0120.746] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0120.769] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.779] CloseHandle (hObject=0xe0) returned 1 [0120.779] CloseHandle (hObject=0xe4) returned 1 [0120.779] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\tecjslog[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\tecjslog[1].png.dvodltmf")) returned 0 [0120.780] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\tecjslog[1].png.dvodltmf")) returned 0x2020 [0120.780] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfbb3b50, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfbb3b50, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfbb3b50, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x67, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="tecjslog[1].png", cAlternateFileName="TECJSL~1.PNG")) returned 0x2e8598 [0120.780] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfbb3b50, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfbb3b50, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfbb3b50, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x67, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="tecjslog[1].png", cAlternateFileName="TECJSL~1.PNG")) returned 0 [0120.780] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0120.780] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\tecjslog[1].png")) returned 1 [0120.781] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\tecjslog[1].png")) returned 0xffffffff [0120.781] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x548efd10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x548efd10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x548efd10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102ea, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="uhf-main.var.min[1].js", cAlternateFileName="UHF-MA~1.JS")) returned 1 [0120.781] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\uhf-main.var.min[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0120.781] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\uhf-main.var.min[1].js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0120.782] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x102ea [0120.782] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0120.782] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0120.865] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x102ea, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x102ea, lpOverlapped=0x0) returned 1 [0120.868] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x102f0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x102f0, lpOverlapped=0x0) returned 1 [0120.870] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0120.890] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.899] CloseHandle (hObject=0xe4) returned 1 [0120.899] CloseHandle (hObject=0xe0) returned 1 [0120.899] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\uhf-main.var.min[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\uhf-main.var.min[1].js.dvodltmf")) returned 0 [0120.900] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\uhf-main.var.min[1].js.dvodltmf")) returned 0x2020 [0120.900] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x548efd10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x548efd10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x548efd10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102ea, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="uhf-main.var.min[1].js", cAlternateFileName="UHF-MA~1.JS")) returned 0x2e8598 [0120.900] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x548efd10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x548efd10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x548efd10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102ea, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="uhf-main.var.min[1].js", cAlternateFileName="UHF-MA~1.JS")) returned 0 [0120.900] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0120.900] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\uhf-main.var.min[1].js")) returned 1 [0120.902] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\uhf-main.var.min[1].js")) returned 0xffffffff [0120.902] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5386c470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5386c470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5386c470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2dd5, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="v2[1]", cAlternateFileName="V2_1_~1")) returned 1 [0120.902] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5386c470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5386c470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5386c470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d29, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="v2[2]", cAlternateFileName="V2_2_~1")) returned 1 [0120.902] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe751ef0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe751ef0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe751ef0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2fa8, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="v2[3]", cAlternateFileName="V2_3_~1")) returned 1 [0120.902] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe8829f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe8829f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe8829f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2da9, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="v2[4]", cAlternateFileName="V2_4_~1")) returned 1 [0120.902] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe8829f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe8829f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe8829f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2da9, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="v2[4]", cAlternateFileName="V2_4_~1")) returned 0 [0120.902] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0120.902] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x696d2e72, dwReserved1=0x5d315b6e, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0120.902] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0120.902] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0120.905] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0120.905] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0120.905] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0120.991] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x43, lpOverlapped=0x0) returned 1 [0120.992] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x50, lpOverlapped=0x0) returned 1 [0120.993] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0121.012] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.022] CloseHandle (hObject=0xf4) returned 1 [0121.022] CloseHandle (hObject=0xe0) returned 1 [0121.022] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\desktop.ini.dvodltmf")) returned 0 [0121.023] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\desktop.ini.dvodltmf")) returned 0x2020 [0121.023] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\desktop.ini", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8558 [0121.023] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0121.023] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0121.023] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\desktop.ini")) returned 1 [0121.024] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\desktop.ini")) returned 0xffffffff [0121.024] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x527ba6f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x527ba6f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IKQEEPZR", cAlternateFileName="")) returned 1 [0121.024] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x527ba6f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x527ba6f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0121.026] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x527ba6f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x527ba6f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.028] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45027e90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45027e90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45027e90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xa756, dwReserved0=0xe4, dwReserved1=0x0, cFileName="19619569[1].gif", cAlternateFileName="196195~1.GIF")) returned 1 [0121.028] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\19619569[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\19619569[1].gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0121.028] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\19619569[1].gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\19619569[1].gif.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0121.029] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa756 [0121.029] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0121.029] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0121.138] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa756, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0xa756, lpOverlapped=0x0) returned 1 [0121.140] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa760, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0xa760, lpOverlapped=0x0) returned 1 [0121.142] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0121.161] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.179] CloseHandle (hObject=0xf4) returned 1 [0121.179] CloseHandle (hObject=0xe4) returned 1 [0121.179] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\19619569[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\19619569[1].gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\19619569[1].gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\19619569[1].gif.dvodltmf")) returned 0 [0121.180] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\19619569[1].gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\19619569[1].gif.dvodltmf")) returned 0x2020 [0121.180] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\19619569[1].gif", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45027e90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45027e90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45027e90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xa756, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="19619569[1].gif", cAlternateFileName="196195~1.GIF")) returned 0x2e8598 [0121.180] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45027e90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45027e90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45027e90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xa756, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="19619569[1].gif", cAlternateFileName="196195~1.GIF")) returned 0 [0121.180] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0121.180] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\19619569[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\19619569[1].gif")) returned 1 [0121.182] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\19619569[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\19619569[1].gif")) returned 0xffffffff [0121.182] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54962130, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54962130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x549ae3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x461fe, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="7962161087[1].js", cAlternateFileName="796216~1.JS")) returned 1 [0121.182] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\7962161087[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\7962161087[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0121.182] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\7962161087[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\7962161087[1].js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0121.182] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x461fe [0121.182] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0121.183] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0121.283] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x461fe, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x461fe, lpOverlapped=0x0) returned 1 [0121.290] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x46200, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x46200, lpOverlapped=0x0) returned 1 [0121.297] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0121.318] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.327] CloseHandle (hObject=0xe4) returned 1 [0121.327] CloseHandle (hObject=0xf4) returned 1 [0121.327] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\7962161087[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\7962161087[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\7962161087[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\7962161087[1].js.dvodltmf")) returned 0 [0121.328] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\7962161087[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\7962161087[1].js.dvodltmf")) returned 0x2020 [0121.328] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\7962161087[1].js", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54962130, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54962130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x549ae3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x461fe, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="7962161087[1].js", cAlternateFileName="796216~1.JS")) returned 0x2e8598 [0121.329] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54962130, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54962130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x549ae3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x461fe, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="7962161087[1].js", cAlternateFileName="796216~1.JS")) returned 0 [0121.329] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0121.329] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\7962161087[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\7962161087[1].js")) returned 1 [0121.332] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\7962161087[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\7962161087[1].js")) returned 0xffffffff [0121.332] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53017770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53017770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53017770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AA3DGHW[1].png", cAlternateFileName="AA3DGH~1.PNG")) returned 1 [0121.332] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3dghw[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0121.332] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3dghw[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0121.333] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14d [0121.333] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0121.333] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0121.423] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x14d, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x14d, lpOverlapped=0x0) returned 1 [0121.428] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x150, lpOverlapped=0x0) returned 1 [0121.432] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0121.451] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.461] CloseHandle (hObject=0xf4) returned 1 [0121.461] CloseHandle (hObject=0xe4) returned 1 [0121.461] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3dghw[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3dghw[1].png.dvodltmf")) returned 0 [0121.462] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3dghw[1].png.dvodltmf")) returned 0x2020 [0121.462] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53017770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53017770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53017770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AA3DGHW[1].png", cAlternateFileName="AA3DGH~1.PNG")) returned 0x2e8598 [0121.462] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53017770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53017770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53017770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AA3DGHW[1].png", cAlternateFileName="AA3DGH~1.PNG")) returned 0 [0121.462] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0121.462] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3dghw[1].png")) returned 1 [0121.463] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3dghw[1].png")) returned 0xffffffff [0121.463] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AA3e1pt[2].png", cAlternateFileName="AA3E1P~2.PNG")) returned 1 [0121.463] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3e1pt[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0121.464] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3e1pt[2].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0121.464] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x197 [0121.465] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0121.465] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0121.556] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x197, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x197, lpOverlapped=0x0) returned 1 [0121.591] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1a0, lpOverlapped=0x0) returned 1 [0121.592] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0121.612] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.621] CloseHandle (hObject=0xe4) returned 1 [0121.621] CloseHandle (hObject=0xf4) returned 1 [0121.622] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3e1pt[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3e1pt[2].png.dvodltmf")) returned 0 [0121.622] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3e1pt[2].png.dvodltmf")) returned 0x2020 [0121.622] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AA3e1pt[2].png", cAlternateFileName="AA3E1P~2.PNG")) returned 0x2e8598 [0121.623] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AA3e1pt[2].png", cAlternateFileName="AA3E1P~2.PNG")) returned 0 [0121.623] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0121.623] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3e1pt[2].png")) returned 1 [0121.624] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3e1pt[2].png")) returned 0xffffffff [0121.624] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AA42ckd[1].png", cAlternateFileName="AA42CK~1.PNG")) returned 1 [0121.624] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42ckd[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0121.624] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42ckd[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0121.625] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c2 [0121.626] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0121.627] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0121.715] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2c2, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2c2, lpOverlapped=0x0) returned 1 [0121.716] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2d0, lpOverlapped=0x0) returned 1 [0121.717] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0121.737] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.746] CloseHandle (hObject=0xf4) returned 1 [0121.746] CloseHandle (hObject=0xe4) returned 1 [0121.746] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42ckd[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42ckd[1].png.dvodltmf")) returned 0 [0121.747] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42ckd[1].png.dvodltmf")) returned 0x2020 [0121.747] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AA42ckd[1].png", cAlternateFileName="AA42CK~1.PNG")) returned 0x2e8598 [0121.747] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AA42ckd[1].png", cAlternateFileName="AA42CK~1.PNG")) returned 0 [0121.747] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0121.747] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42ckd[1].png")) returned 1 [0121.748] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42ckd[1].png")) returned 0xffffffff [0121.748] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AA42eYr[1].png", cAlternateFileName="AA42EY~1.PNG")) returned 1 [0121.748] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42eyr[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0121.749] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42eyr[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0121.749] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c2 [0121.749] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0121.749] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0121.860] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2c2, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2c2, lpOverlapped=0x0) returned 1 [0121.862] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2d0, lpOverlapped=0x0) returned 1 [0121.863] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0121.883] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.893] CloseHandle (hObject=0xe4) returned 1 [0121.893] CloseHandle (hObject=0xf4) returned 1 [0121.893] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42eyr[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42eyr[1].png.dvodltmf")) returned 0 [0121.894] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42eyr[1].png.dvodltmf")) returned 0x2020 [0121.894] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AA42eYr[1].png", cAlternateFileName="AA42EY~1.PNG")) returned 0x2e8598 [0121.894] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AA42eYr[1].png", cAlternateFileName="AA42EY~1.PNG")) returned 0 [0121.894] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0121.894] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42eyr[1].png")) returned 1 [0121.895] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42eyr[1].png")) returned 0xffffffff [0121.895] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AA61ILp[2].png", cAlternateFileName="AA61IL~2.PNG")) returned 1 [0121.895] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa61ilp[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0121.896] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa61ilp[2].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0121.897] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x204 [0121.897] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0121.897] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0121.985] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x204, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x204, lpOverlapped=0x0) returned 1 [0121.987] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x210, lpOverlapped=0x0) returned 1 [0121.988] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0122.008] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.017] CloseHandle (hObject=0xf4) returned 1 [0122.017] CloseHandle (hObject=0xe4) returned 1 [0122.017] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa61ilp[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa61ilp[2].png.dvodltmf")) returned 0 [0122.018] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa61ilp[2].png.dvodltmf")) returned 0x2020 [0122.018] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AA61ILp[2].png", cAlternateFileName="AA61IL~2.PNG")) returned 0x2e8598 [0122.018] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AA61ILp[2].png", cAlternateFileName="AA61IL~2.PNG")) returned 0 [0122.018] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0122.018] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa61ilp[2].png")) returned 1 [0122.019] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa61ilp[2].png")) returned 0xffffffff [0122.019] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50ebbff0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50ebbff0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50ebbff0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AA6SNZ6[1].png", cAlternateFileName="AA6SNZ~1.PNG")) returned 1 [0122.019] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa6snz6[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0122.020] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa6snz6[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0122.020] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ed [0122.020] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0122.021] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0122.104] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2ed, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2ed, lpOverlapped=0x0) returned 1 [0122.106] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2f0, lpOverlapped=0x0) returned 1 [0122.107] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0122.126] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.136] CloseHandle (hObject=0xe4) returned 1 [0122.136] CloseHandle (hObject=0xf4) returned 1 [0122.136] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa6snz6[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa6snz6[1].png.dvodltmf")) returned 0 [0122.137] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa6snz6[1].png.dvodltmf")) returned 0x2020 [0122.137] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50ebbff0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50ebbff0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50ebbff0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AA6SNZ6[1].png", cAlternateFileName="AA6SNZ~1.PNG")) returned 0x2e8598 [0122.137] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50ebbff0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50ebbff0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50ebbff0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AA6SNZ6[1].png", cAlternateFileName="AA6SNZ~1.PNG")) returned 0 [0122.137] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0122.137] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa6snz6[1].png")) returned 1 [0122.138] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa6snz6[1].png")) returned 0xffffffff [0122.138] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454eaa90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454eaa90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454eaa90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AAbyinC[1].png", cAlternateFileName="AABYIN~1.PNG")) returned 1 [0122.138] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aabyinc[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0122.139] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aabyinc[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0122.139] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2fc [0122.139] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0122.140] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0122.234] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2fc, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2fc, lpOverlapped=0x0) returned 1 [0122.235] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x300, lpOverlapped=0x0) returned 1 [0122.236] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0122.256] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.265] CloseHandle (hObject=0xf4) returned 1 [0122.265] CloseHandle (hObject=0xe4) returned 1 [0122.265] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aabyinc[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aabyinc[1].png.dvodltmf")) returned 0 [0122.266] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aabyinc[1].png.dvodltmf")) returned 0x2020 [0122.266] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454eaa90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454eaa90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454eaa90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AAbyinC[1].png", cAlternateFileName="AABYIN~1.PNG")) returned 0x2e8598 [0122.266] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454eaa90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454eaa90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454eaa90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AAbyinC[1].png", cAlternateFileName="AABYIN~1.PNG")) returned 0 [0122.266] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0122.266] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aabyinc[1].png")) returned 1 [0122.268] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aabyinc[1].png")) returned 0xffffffff [0122.268] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x340b, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AAicW5W[1].jpg", cAlternateFileName="AAICW5~1.JPG")) returned 1 [0122.268] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaicw5w[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0122.268] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaicw5w[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0122.268] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x340b [0122.268] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0122.269] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0122.353] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x340b, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x340b, lpOverlapped=0x0) returned 1 [0122.357] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3410, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x3410, lpOverlapped=0x0) returned 1 [0122.358] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0122.382] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.391] CloseHandle (hObject=0xe4) returned 1 [0122.391] CloseHandle (hObject=0xf4) returned 1 [0122.392] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaicw5w[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaicw5w[1].jpg.dvodltmf")) returned 0 [0122.392] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaicw5w[1].jpg.dvodltmf")) returned 0x2020 [0122.392] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x340b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AAicW5W[1].jpg", cAlternateFileName="AAICW5~1.JPG")) returned 0x2e8598 [0122.393] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x340b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AAicW5W[1].jpg", cAlternateFileName="AAICW5~1.JPG")) returned 0 [0122.393] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0122.393] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaicw5w[1].jpg")) returned 1 [0122.394] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaicw5w[1].jpg")) returned 0xffffffff [0122.394] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538925d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538925d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19a4, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AAj0doQ[1].jpg", cAlternateFileName="AAJ0DO~1.JPG")) returned 1 [0122.394] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaj0doq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0122.394] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaj0doq[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0122.394] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19a4 [0122.394] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0122.395] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0122.484] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x19a4, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x19a4, lpOverlapped=0x0) returned 1 [0122.486] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x19b0, lpOverlapped=0x0) returned 1 [0122.487] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0122.506] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.515] CloseHandle (hObject=0xf4) returned 1 [0122.515] CloseHandle (hObject=0xe4) returned 1 [0122.515] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaj0doq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaj0doq[1].jpg.dvodltmf")) returned 0 [0122.516] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaj0doq[1].jpg.dvodltmf")) returned 0x2020 [0122.516] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538925d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538925d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19a4, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AAj0doQ[1].jpg", cAlternateFileName="AAJ0DO~1.JPG")) returned 0x2e8598 [0122.516] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538925d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538925d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19a4, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AAj0doQ[1].jpg", cAlternateFileName="AAJ0DO~1.JPG")) returned 0 [0122.516] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0122.517] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaj0doq[1].jpg")) returned 1 [0122.517] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaj0doq[1].jpg")) returned 0xffffffff [0122.518] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5159c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5159c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5159c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x35c, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AAkqhIf[1].png", cAlternateFileName="AAKQHI~1.PNG")) returned 1 [0122.518] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aakqhif[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0122.518] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aakqhif[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0122.518] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x35c [0122.518] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0122.519] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0122.601] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x35c, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x35c, lpOverlapped=0x0) returned 1 [0122.602] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x360, lpOverlapped=0x0) returned 1 [0122.603] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0122.623] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.636] CloseHandle (hObject=0xe4) returned 1 [0122.636] CloseHandle (hObject=0xf4) returned 1 [0122.637] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aakqhif[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aakqhif[1].png.dvodltmf")) returned 0 [0122.638] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aakqhif[1].png.dvodltmf")) returned 0x2020 [0122.638] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5159c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5159c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5159c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x35c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AAkqhIf[1].png", cAlternateFileName="AAKQHI~1.PNG")) returned 0x2e8598 [0122.638] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5159c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5159c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5159c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x35c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AAkqhIf[1].png", cAlternateFileName="AAKQHI~1.PNG")) returned 0 [0122.638] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0122.638] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aakqhif[1].png")) returned 1 [0122.639] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aakqhif[1].png")) returned 0xffffffff [0122.639] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x278e, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AAmo09p[1].jpg", cAlternateFileName="AAMO09~1.JPG")) returned 1 [0122.639] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamo09p[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0122.640] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamo09p[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0122.640] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x278e [0122.640] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0122.641] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0122.727] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x278e, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x278e, lpOverlapped=0x0) returned 1 [0122.728] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2790, lpOverlapped=0x0) returned 1 [0122.729] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0122.748] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.758] CloseHandle (hObject=0xf4) returned 1 [0122.758] CloseHandle (hObject=0xe4) returned 1 [0122.758] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamo09p[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamo09p[1].jpg.dvodltmf")) returned 0 [0122.759] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamo09p[1].jpg.dvodltmf")) returned 0x2020 [0122.759] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x278e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AAmo09p[1].jpg", cAlternateFileName="AAMO09~1.JPG")) returned 0x2e8598 [0122.759] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x278e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AAmo09p[1].jpg", cAlternateFileName="AAMO09~1.JPG")) returned 0 [0122.759] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0122.759] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamo09p[1].jpg")) returned 1 [0122.760] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamo09p[1].jpg")) returned 0xffffffff [0122.760] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AAmUyV2[1].png", cAlternateFileName="AAMUYV~1.PNG")) returned 1 [0122.760] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamuyv2[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0122.761] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamuyv2[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0122.761] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19a [0122.761] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0122.761] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0122.845] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x19a, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x19a, lpOverlapped=0x0) returned 1 [0122.847] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1a0, lpOverlapped=0x0) returned 1 [0122.848] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0122.867] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.877] CloseHandle (hObject=0xe4) returned 1 [0122.877] CloseHandle (hObject=0xf4) returned 1 [0122.877] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamuyv2[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamuyv2[1].png.dvodltmf")) returned 0 [0122.878] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamuyv2[1].png.dvodltmf")) returned 0x2020 [0122.878] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AAmUyV2[1].png", cAlternateFileName="AAMUYV~1.PNG")) returned 0x2e8598 [0122.878] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AAmUyV2[1].png", cAlternateFileName="AAMUYV~1.PNG")) returned 0 [0122.878] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0122.878] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamuyv2[1].png")) returned 1 [0122.879] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamuyv2[1].png")) returned 0xffffffff [0122.879] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AAn7gKR[1].png", cAlternateFileName="AAN7GK~1.PNG")) returned 1 [0122.879] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aan7gkr[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0122.879] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aan7gkr[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0122.880] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfe [0122.880] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0122.880] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0122.966] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xfe, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0xfe, lpOverlapped=0x0) returned 1 [0122.969] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x100, lpOverlapped=0x0) returned 1 [0122.970] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0122.990] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.999] CloseHandle (hObject=0xf4) returned 1 [0122.999] CloseHandle (hObject=0xe4) returned 1 [0122.999] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aan7gkr[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aan7gkr[1].png.dvodltmf")) returned 0 [0123.000] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aan7gkr[1].png.dvodltmf")) returned 0x2020 [0123.000] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AAn7gKR[1].png", cAlternateFileName="AAN7GK~1.PNG")) returned 0x2e8598 [0123.000] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AAn7gKR[1].png", cAlternateFileName="AAN7GK~1.PNG")) returned 0 [0123.000] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0123.000] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aan7gkr[1].png")) returned 1 [0123.001] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aan7gkr[1].png")) returned 0xffffffff [0123.001] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61be2420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61be2420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61be2420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x650, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", cAlternateFileName="ACTIVI~1.HTM")) returned 1 [0123.001] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0123.002] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0123.002] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x650 [0123.002] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0123.002] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0123.084] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x650, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x650, lpOverlapped=0x0) returned 1 [0123.086] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x660, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x660, lpOverlapped=0x0) returned 1 [0123.087] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0123.106] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.116] CloseHandle (hObject=0xe4) returned 1 [0123.116] CloseHandle (hObject=0xf4) returned 1 [0123.116] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm.dvodltmf")) returned 0 [0123.117] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm.dvodltmf")) returned 0x2020 [0123.117] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61be2420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61be2420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61be2420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x650, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", cAlternateFileName="ACTIVI~1.HTM")) returned 0x2e8598 [0123.117] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61be2420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61be2420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61be2420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x650, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", cAlternateFileName="ACTIVI~1.HTM")) returned 0 [0123.117] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0123.117] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\activityi")) returned 0 [0123.117] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm")) returned 0x2020 [0123.117] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2a0770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf2a0770, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf2a0770, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2870, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="adfscript[1]", cAlternateFileName="ADFSCR~1")) returned 1 [0123.117] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf54e030, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf54e030, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf54e030, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xf1f, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="adfserve[1]", cAlternateFileName="ADFSER~1")) returned 1 [0123.118] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533a9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533a9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11835, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="ast[2].js", cAlternateFileName="AST_2_~1.JS")) returned 1 [0123.118] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\ast[2].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0123.118] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\ast[2].js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0123.119] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11835 [0123.119] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0123.120] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0123.215] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x11835, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x11835, lpOverlapped=0x0) returned 1 [0123.218] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x11840, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x11840, lpOverlapped=0x0) returned 1 [0123.220] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0123.241] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.250] CloseHandle (hObject=0xf4) returned 1 [0123.251] CloseHandle (hObject=0xe4) returned 1 [0123.251] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\ast[2].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\ast[2].js.dvodltmf")) returned 0 [0123.251] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\ast[2].js.dvodltmf")) returned 0x2020 [0123.252] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533a9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533a9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11835, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ast[2].js", cAlternateFileName="AST_2_~1.JS")) returned 0x2e8598 [0123.252] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533a9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533a9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11835, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ast[2].js", cAlternateFileName="AST_2_~1.JS")) returned 0 [0123.252] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0123.252] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\ast[2].js")) returned 1 [0123.253] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\ast[2].js")) returned 0xffffffff [0123.253] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53d7b330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53d7b330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53d7b330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="async_usersync[1]", cAlternateFileName="ASYNC_~1")) returned 1 [0123.253] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5108d3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5108d3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x86e6, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="b2fd15[1].eot", cAlternateFileName="B2FD15~1.EOT")) returned 1 [0123.253] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\b2fd15[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\b2fd15[1].eot"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0123.254] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\b2fd15[1].eot.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\b2fd15[1].eot.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0123.255] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x86e6 [0123.255] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0123.255] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0123.340] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x86e6, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x86e6, lpOverlapped=0x0) returned 1 [0123.342] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x86f0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x86f0, lpOverlapped=0x0) returned 1 [0123.344] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0123.373] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.383] CloseHandle (hObject=0xe4) returned 1 [0123.383] CloseHandle (hObject=0xf4) returned 1 [0123.383] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\b2fd15[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\b2fd15[1].eot"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\b2fd15[1].eot.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\b2fd15[1].eot.dvodltmf")) returned 0 [0123.384] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\b2fd15[1].eot.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\b2fd15[1].eot.dvodltmf")) returned 0x2020 [0123.384] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\b2fd15[1].eot", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5108d3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5108d3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x86e6, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="b2fd15[1].eot", cAlternateFileName="B2FD15~1.EOT")) returned 0x2e8598 [0123.384] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5108d3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5108d3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x86e6, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="b2fd15[1].eot", cAlternateFileName="B2FD15~1.EOT")) returned 0 [0123.384] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0123.384] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\b2fd15[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\b2fd15[1].eot")) returned 1 [0123.385] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\b2fd15[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\b2fd15[1].eot")) returned 0xffffffff [0123.385] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BB5zDwX[1].png", cAlternateFileName="BB5ZDW~1.PNG")) returned 1 [0123.385] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bb5zdwx[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0123.386] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bb5zdwx[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0123.386] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c0 [0123.386] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0123.386] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0123.477] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2c0, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2c0, lpOverlapped=0x0) returned 1 [0123.478] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2d0, lpOverlapped=0x0) returned 1 [0123.479] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0123.499] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.508] CloseHandle (hObject=0xf4) returned 1 [0123.508] CloseHandle (hObject=0xe4) returned 1 [0123.509] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bb5zdwx[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bb5zdwx[1].png.dvodltmf")) returned 0 [0123.509] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bb5zdwx[1].png.dvodltmf")) returned 0x2020 [0123.509] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BB5zDwX[1].png", cAlternateFileName="BB5ZDW~1.PNG")) returned 0x2e8598 [0123.510] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BB5zDwX[1].png", cAlternateFileName="BB5ZDW~1.PNG")) returned 0 [0123.510] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0123.510] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bb5zdwx[1].png")) returned 1 [0123.511] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bb5zdwx[1].png")) returned 0xffffffff [0123.511] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBaK3Nm[1].png", cAlternateFileName="BBAK3N~1.PNG")) returned 1 [0123.511] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbak3nm[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0123.511] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbak3nm[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0123.512] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x227 [0123.512] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0123.512] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0123.596] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x227, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x227, lpOverlapped=0x0) returned 1 [0123.598] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x230, lpOverlapped=0x0) returned 1 [0123.598] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0123.618] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.629] CloseHandle (hObject=0xe4) returned 1 [0123.629] CloseHandle (hObject=0xf4) returned 1 [0123.629] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbak3nm[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbak3nm[1].png.dvodltmf")) returned 0 [0123.630] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbak3nm[1].png.dvodltmf")) returned 0x2020 [0123.630] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBaK3Nm[1].png", cAlternateFileName="BBAK3N~1.PNG")) returned 0x2e8598 [0123.630] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBaK3Nm[1].png", cAlternateFileName="BBAK3N~1.PNG")) returned 0 [0123.630] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0123.630] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbak3nm[1].png")) returned 1 [0123.631] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbak3nm[1].png")) returned 0xffffffff [0123.631] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53337450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2143, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBLcCz[1].jpg", cAlternateFileName="BBBLCC~1.JPG")) returned 1 [0123.631] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbblccz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0123.631] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbblccz[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0123.632] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2143 [0123.632] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0123.632] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0123.720] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2143, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2143, lpOverlapped=0x0) returned 1 [0123.722] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2150, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2150, lpOverlapped=0x0) returned 1 [0123.723] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0123.743] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.752] CloseHandle (hObject=0xf4) returned 1 [0123.752] CloseHandle (hObject=0xe4) returned 1 [0123.752] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbblccz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbblccz[1].jpg.dvodltmf")) returned 0 [0123.753] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbblccz[1].jpg.dvodltmf")) returned 0x2020 [0123.753] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53337450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2143, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBLcCz[1].jpg", cAlternateFileName="BBBLCC~1.JPG")) returned 0x2e8598 [0123.753] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53337450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2143, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBLcCz[1].jpg", cAlternateFileName="BBBLCC~1.JPG")) returned 0 [0123.753] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0123.753] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbblccz[1].jpg")) returned 1 [0123.754] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbblccz[1].jpg")) returned 0xffffffff [0123.754] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5348e0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5348e0b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5348e0b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x912, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBLdzQ[1].jpg", cAlternateFileName="BBBLDZ~1.JPG")) returned 1 [0123.754] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbldzq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0123.755] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbldzq[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0123.755] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x912 [0123.755] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0123.756] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0123.847] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x912, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x912, lpOverlapped=0x0) returned 1 [0123.849] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x920, lpOverlapped=0x0) returned 1 [0123.850] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0123.870] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.879] CloseHandle (hObject=0xe4) returned 1 [0123.879] CloseHandle (hObject=0xf4) returned 1 [0123.880] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbldzq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbldzq[1].jpg.dvodltmf")) returned 0 [0123.880] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbldzq[1].jpg.dvodltmf")) returned 0x2020 [0123.880] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5348e0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5348e0b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5348e0b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x912, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBLdzQ[1].jpg", cAlternateFileName="BBBLDZ~1.JPG")) returned 0x2e8598 [0123.881] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5348e0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5348e0b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5348e0b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x912, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBLdzQ[1].jpg", cAlternateFileName="BBBLDZ~1.JPG")) returned 0 [0123.881] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0123.881] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbldzq[1].jpg")) returned 1 [0123.882] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbldzq[1].jpg")) returned 0xffffffff [0123.882] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6e8, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBO1mQ[1].jpg", cAlternateFileName="BBBO1M~1.JPG")) returned 1 [0123.882] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1mq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0123.882] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1mq[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0123.882] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6e8 [0123.882] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0123.883] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0123.966] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x6e8, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x6e8, lpOverlapped=0x0) returned 1 [0123.967] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x6f0, lpOverlapped=0x0) returned 1 [0123.968] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0123.987] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.997] CloseHandle (hObject=0xf4) returned 1 [0123.997] CloseHandle (hObject=0xe4) returned 1 [0123.997] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1mq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1mq[1].jpg.dvodltmf")) returned 0 [0123.998] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1mq[1].jpg.dvodltmf")) returned 0x2020 [0123.998] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6e8, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBO1mQ[1].jpg", cAlternateFileName="BBBO1M~1.JPG")) returned 0x2e8598 [0123.998] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6e8, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBO1mQ[1].jpg", cAlternateFileName="BBBO1M~1.JPG")) returned 0 [0123.998] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0123.998] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1mq[1].jpg")) returned 1 [0123.999] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1mq[1].jpg")) returned 0xffffffff [0123.999] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x537add90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x537add90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x537add90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36d2, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBO1qB[1].jpg", cAlternateFileName="BBBO1Q~1.JPG")) returned 1 [0123.999] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1qb[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0123.999] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1qb[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0124.000] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x36d2 [0124.000] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0124.000] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0124.083] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x36d2, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x36d2, lpOverlapped=0x0) returned 1 [0124.085] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x36e0, lpOverlapped=0x0) returned 1 [0124.086] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0124.106] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.115] CloseHandle (hObject=0xe4) returned 1 [0124.115] CloseHandle (hObject=0xf4) returned 1 [0124.115] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1qb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1qb[1].jpg.dvodltmf")) returned 0 [0124.116] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1qb[1].jpg.dvodltmf")) returned 0x2020 [0124.116] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x537add90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x537add90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x537add90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36d2, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBO1qB[1].jpg", cAlternateFileName="BBBO1Q~1.JPG")) returned 0x2e8598 [0124.116] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x537add90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x537add90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x537add90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36d2, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBO1qB[1].jpg", cAlternateFileName="BBBO1Q~1.JPG")) returned 0 [0124.116] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0124.116] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1qb[1].jpg")) returned 1 [0124.117] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1qb[1].jpg")) returned 0xffffffff [0124.117] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBOIAt[1].jpg", cAlternateFileName="BBBOIA~1.JPG")) returned 1 [0124.117] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbboiat[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0124.118] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbboiat[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0124.118] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x75e [0124.118] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0124.118] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0124.204] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x75e, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x75e, lpOverlapped=0x0) returned 1 [0124.214] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x760, lpOverlapped=0x0) returned 1 [0124.215] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0124.236] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.246] CloseHandle (hObject=0xf4) returned 1 [0124.246] CloseHandle (hObject=0xe4) returned 1 [0124.246] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbboiat[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbboiat[1].jpg.dvodltmf")) returned 0 [0124.247] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbboiat[1].jpg.dvodltmf")) returned 0x2020 [0124.247] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBOIAt[1].jpg", cAlternateFileName="BBBOIA~1.JPG")) returned 0x2e8598 [0124.247] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBOIAt[1].jpg", cAlternateFileName="BBBOIA~1.JPG")) returned 0 [0124.247] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0124.247] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbboiat[1].jpg")) returned 1 [0124.248] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbboiat[1].jpg")) returned 0xffffffff [0124.248] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6dc, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBOmuh[1].jpg", cAlternateFileName="BBBOMU~1.JPG")) returned 1 [0124.248] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbomuh[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0124.248] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbomuh[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0124.249] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6dc [0124.249] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0124.249] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0124.332] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x6dc, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x6dc, lpOverlapped=0x0) returned 1 [0124.334] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x6e0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x6e0, lpOverlapped=0x0) returned 1 [0124.335] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0124.354] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.413] CloseHandle (hObject=0xe4) returned 1 [0124.413] CloseHandle (hObject=0xf4) returned 1 [0124.413] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbomuh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbomuh[1].jpg.dvodltmf")) returned 0 [0124.414] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbomuh[1].jpg.dvodltmf")) returned 0x2020 [0124.414] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6dc, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBOmuh[1].jpg", cAlternateFileName="BBBOMU~1.JPG")) returned 0x2e8598 [0124.414] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6dc, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBOmuh[1].jpg", cAlternateFileName="BBBOMU~1.JPG")) returned 0 [0124.414] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0124.414] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbomuh[1].jpg")) returned 1 [0124.415] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbomuh[1].jpg")) returned 0xffffffff [0124.415] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53467f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53467f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5348e0b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9be, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBPK5J[1].jpg", cAlternateFileName="BBBPK5~1.JPG")) returned 1 [0124.416] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpk5j[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0124.416] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpk5j[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0124.416] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9be [0124.417] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0124.417] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0124.505] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x9be, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x9be, lpOverlapped=0x0) returned 1 [0124.507] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x9c0, lpOverlapped=0x0) returned 1 [0124.508] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0124.527] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.537] CloseHandle (hObject=0xf4) returned 1 [0124.537] CloseHandle (hObject=0xe4) returned 1 [0124.537] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpk5j[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpk5j[1].jpg.dvodltmf")) returned 0 [0124.538] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpk5j[1].jpg.dvodltmf")) returned 0x2020 [0124.538] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53467f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53467f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5348e0b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9be, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBPK5J[1].jpg", cAlternateFileName="BBBPK5~1.JPG")) returned 0x2e8598 [0124.538] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53467f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53467f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5348e0b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9be, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBPK5J[1].jpg", cAlternateFileName="BBBPK5~1.JPG")) returned 0 [0124.538] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0124.538] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpk5j[1].jpg")) returned 1 [0124.539] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpk5j[1].jpg")) returned 0xffffffff [0124.539] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1694, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBPMvJ[1].jpg", cAlternateFileName="BBBPMV~1.JPG")) returned 1 [0124.540] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpmvj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0124.541] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpmvj[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0124.542] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1694 [0124.542] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0124.542] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0124.627] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1694, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1694, lpOverlapped=0x0) returned 1 [0124.629] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x16a0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x16a0, lpOverlapped=0x0) returned 1 [0124.630] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0124.649] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.659] CloseHandle (hObject=0xe4) returned 1 [0124.659] CloseHandle (hObject=0xf4) returned 1 [0124.659] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpmvj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpmvj[1].jpg.dvodltmf")) returned 0 [0124.660] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpmvj[1].jpg.dvodltmf")) returned 0x2020 [0124.660] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1694, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBPMvJ[1].jpg", cAlternateFileName="BBBPMV~1.JPG")) returned 0x2e8598 [0124.660] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1694, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBPMvJ[1].jpg", cAlternateFileName="BBBPMV~1.JPG")) returned 0 [0124.660] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0124.660] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpmvj[1].jpg")) returned 1 [0124.661] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpmvj[1].jpg")) returned 0xffffffff [0124.661] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539e9230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539e9230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53a0f390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x85d, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBUL3E[1].jpg", cAlternateFileName="BBBUL3~1.JPG")) returned 1 [0124.661] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbul3e[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0124.662] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbul3e[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0124.662] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85d [0124.662] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0124.662] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0124.752] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x85d, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x85d, lpOverlapped=0x0) returned 1 [0124.754] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x860, lpOverlapped=0x0) returned 1 [0124.754] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0124.774] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.784] CloseHandle (hObject=0xf4) returned 1 [0124.784] CloseHandle (hObject=0xe4) returned 1 [0124.784] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbul3e[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbul3e[1].jpg.dvodltmf")) returned 0 [0124.785] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbul3e[1].jpg.dvodltmf")) returned 0x2020 [0124.785] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539e9230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539e9230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53a0f390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x85d, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBUL3E[1].jpg", cAlternateFileName="BBBUL3~1.JPG")) returned 0x2e8598 [0124.785] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539e9230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539e9230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53a0f390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x85d, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBUL3E[1].jpg", cAlternateFileName="BBBUL3~1.JPG")) returned 0 [0124.785] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0124.785] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbul3e[1].jpg")) returned 1 [0124.786] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbul3e[1].jpg")) returned 0xffffffff [0124.786] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBUqkT[1].jpg", cAlternateFileName="BBBUQK~1.JPG")) returned 1 [0124.786] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0124.786] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0124.787] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x878 [0124.787] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0124.787] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0124.870] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x878, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x878, lpOverlapped=0x0) returned 1 [0124.874] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x880, lpOverlapped=0x0) returned 1 [0124.875] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0124.894] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.903] CloseHandle (hObject=0xe4) returned 1 [0124.903] CloseHandle (hObject=0xf4) returned 1 [0124.903] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[1].jpg.dvodltmf")) returned 0 [0124.904] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[1].jpg.dvodltmf")) returned 0x2020 [0124.904] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBUqkT[1].jpg", cAlternateFileName="BBBUQK~1.JPG")) returned 0x2e8598 [0124.904] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBUqkT[1].jpg", cAlternateFileName="BBBUQK~1.JPG")) returned 0 [0124.904] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0124.904] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[1].jpg")) returned 1 [0124.905] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[1].jpg")) returned 0xffffffff [0124.905] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f59090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f59090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f59090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBUqkT[2].jpg", cAlternateFileName="BBBUQK~2.JPG")) returned 1 [0124.905] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0124.906] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[2].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0124.915] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x878 [0124.915] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0124.915] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0124.998] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x878, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x878, lpOverlapped=0x0) returned 1 [0125.000] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x880, lpOverlapped=0x0) returned 1 [0125.001] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0125.020] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.029] CloseHandle (hObject=0xf4) returned 1 [0125.029] CloseHandle (hObject=0xe4) returned 1 [0125.030] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[2].jpg.dvodltmf")) returned 0 [0125.030] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[2].jpg.dvodltmf")) returned 0x2020 [0125.030] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f59090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f59090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f59090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBUqkT[2].jpg", cAlternateFileName="BBBUQK~2.JPG")) returned 0x2e8598 [0125.031] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f59090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f59090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f59090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBUqkT[2].jpg", cAlternateFileName="BBBUQK~2.JPG")) returned 0 [0125.031] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0125.031] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[2].jpg")) returned 1 [0125.032] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[2].jpg")) returned 0xffffffff [0125.032] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x77f, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBX3z0[1].jpg", cAlternateFileName="BBBX3Z~1.JPG")) returned 1 [0125.032] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbx3z0[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0125.033] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbx3z0[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0125.033] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x77f [0125.033] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0125.033] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0125.116] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x77f, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x77f, lpOverlapped=0x0) returned 1 [0125.118] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x780, lpOverlapped=0x0) returned 1 [0125.119] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0125.138] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.147] CloseHandle (hObject=0xe4) returned 1 [0125.148] CloseHandle (hObject=0xf4) returned 1 [0125.148] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbx3z0[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbx3z0[1].jpg.dvodltmf")) returned 0 [0125.148] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbx3z0[1].jpg.dvodltmf")) returned 0x2020 [0125.148] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x77f, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBX3z0[1].jpg", cAlternateFileName="BBBX3Z~1.JPG")) returned 0x2e8598 [0125.149] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x77f, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBX3z0[1].jpg", cAlternateFileName="BBBX3Z~1.JPG")) returned 0 [0125.149] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0125.149] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbx3z0[1].jpg")) returned 1 [0125.150] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbx3z0[1].jpg")) returned 0xffffffff [0125.150] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x22b3, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBYEW1[1].jpg", cAlternateFileName="BBBYEW~1.JPG")) returned 1 [0125.150] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyew1[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0125.150] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyew1[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0125.150] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x22b3 [0125.151] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0125.151] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0125.243] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x22b3, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x22b3, lpOverlapped=0x0) returned 1 [0125.245] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x22c0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x22c0, lpOverlapped=0x0) returned 1 [0125.246] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0125.268] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.277] CloseHandle (hObject=0xf4) returned 1 [0125.277] CloseHandle (hObject=0xe4) returned 1 [0125.277] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyew1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyew1[1].jpg.dvodltmf")) returned 0 [0125.278] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyew1[1].jpg.dvodltmf")) returned 0x2020 [0125.278] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x22b3, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBYEW1[1].jpg", cAlternateFileName="BBBYEW~1.JPG")) returned 0x2e8598 [0125.278] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x22b3, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBYEW1[1].jpg", cAlternateFileName="BBBYEW~1.JPG")) returned 0 [0125.278] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0125.278] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyew1[1].jpg")) returned 1 [0125.279] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyew1[1].jpg")) returned 0xffffffff [0125.279] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ec0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ec0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ec0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19cf, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBYfEH[1].jpg", cAlternateFileName="BBBYFE~1.JPG")) returned 1 [0125.279] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyfeh[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0125.280] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyfeh[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0125.280] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19cf [0125.280] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0125.281] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0125.368] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x19cf, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x19cf, lpOverlapped=0x0) returned 1 [0125.369] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x19d0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x19d0, lpOverlapped=0x0) returned 1 [0125.370] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0125.389] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.399] CloseHandle (hObject=0xe4) returned 1 [0125.399] CloseHandle (hObject=0xf4) returned 1 [0125.399] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyfeh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyfeh[1].jpg.dvodltmf")) returned 0 [0125.400] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyfeh[1].jpg.dvodltmf")) returned 0x2020 [0125.400] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ec0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ec0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ec0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19cf, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBYfEH[1].jpg", cAlternateFileName="BBBYFE~1.JPG")) returned 0x2e8598 [0125.400] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ec0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ec0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ec0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19cf, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBYfEH[1].jpg", cAlternateFileName="BBBYFE~1.JPG")) returned 0 [0125.400] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0125.400] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyfeh[1].jpg")) returned 1 [0125.401] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyfeh[1].jpg")) returned 0xffffffff [0125.401] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b2bd440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5b2bd440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5b2bd440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ca1, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBZ20W[1].jpg", cAlternateFileName="BBBZ20~1.JPG")) returned 1 [0125.401] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbz20w[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0125.402] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbz20w[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0125.403] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ca1 [0125.403] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0125.403] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0125.494] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2ca1, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2ca1, lpOverlapped=0x0) returned 1 [0125.496] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2cb0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2cb0, lpOverlapped=0x0) returned 1 [0125.497] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0125.516] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.525] CloseHandle (hObject=0xf4) returned 1 [0125.525] CloseHandle (hObject=0xe4) returned 1 [0125.526] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbz20w[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbz20w[1].jpg.dvodltmf")) returned 0 [0125.526] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbz20w[1].jpg.dvodltmf")) returned 0x2020 [0125.526] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b2bd440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5b2bd440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5b2bd440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ca1, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBZ20W[1].jpg", cAlternateFileName="BBBZ20~1.JPG")) returned 0x2e8598 [0125.527] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b2bd440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5b2bd440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5b2bd440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ca1, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBZ20W[1].jpg", cAlternateFileName="BBBZ20~1.JPG")) returned 0 [0125.527] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0125.527] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbz20w[1].jpg")) returned 1 [0125.528] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbz20w[1].jpg")) returned 0xffffffff [0125.528] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53950cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53950cb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539c30d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1f37, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBzaxY[1].jpg", cAlternateFileName="BBBZAX~1.JPG")) returned 1 [0125.528] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzaxy[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0125.528] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzaxy[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0125.529] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f37 [0125.529] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0125.529] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0125.612] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1f37, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1f37, lpOverlapped=0x0) returned 1 [0125.614] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1f40, lpOverlapped=0x0) returned 1 [0125.615] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0125.636] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.645] CloseHandle (hObject=0xe4) returned 1 [0125.645] CloseHandle (hObject=0xf4) returned 1 [0125.645] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzaxy[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzaxy[1].jpg.dvodltmf")) returned 0 [0125.646] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzaxy[1].jpg.dvodltmf")) returned 0x2020 [0125.646] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53950cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53950cb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539c30d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1f37, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBzaxY[1].jpg", cAlternateFileName="BBBZAX~1.JPG")) returned 0x2e8598 [0125.646] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53950cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53950cb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539c30d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1f37, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBzaxY[1].jpg", cAlternateFileName="BBBZAX~1.JPG")) returned 0 [0125.646] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0125.646] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzaxy[1].jpg")) returned 1 [0125.647] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzaxy[1].jpg")) returned 0xffffffff [0125.647] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2131, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBZzuz[1].jpg", cAlternateFileName="BBBZZU~1.JPG")) returned 1 [0125.647] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzzuz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0125.648] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzzuz[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0125.648] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2131 [0125.648] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0125.648] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0125.733] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2131, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2131, lpOverlapped=0x0) returned 1 [0125.735] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2140, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2140, lpOverlapped=0x0) returned 1 [0125.736] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0125.761] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.771] CloseHandle (hObject=0xf4) returned 1 [0125.771] CloseHandle (hObject=0xe4) returned 1 [0125.772] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzzuz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzzuz[1].jpg.dvodltmf")) returned 0 [0125.772] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzzuz[1].jpg.dvodltmf")) returned 0x2020 [0125.772] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2131, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBZzuz[1].jpg", cAlternateFileName="BBBZZU~1.JPG")) returned 0x2e8598 [0125.773] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2131, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBZzuz[1].jpg", cAlternateFileName="BBBZZU~1.JPG")) returned 0 [0125.773] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0125.773] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzzuz[1].jpg")) returned 1 [0125.774] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzzuz[1].jpg")) returned 0xffffffff [0125.774] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5530da90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5530da90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5530da90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x370a, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBC03B1[1].jpg", cAlternateFileName="BBC03B~1.JPG")) returned 1 [0125.774] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc03b1[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0125.774] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc03b1[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0125.775] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x370a [0125.775] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0125.775] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0125.870] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x370a, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x370a, lpOverlapped=0x0) returned 1 [0125.872] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3710, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x3710, lpOverlapped=0x0) returned 1 [0125.873] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0125.893] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.902] CloseHandle (hObject=0xe4) returned 1 [0125.902] CloseHandle (hObject=0xf4) returned 1 [0125.902] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc03b1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc03b1[1].jpg.dvodltmf")) returned 0 [0125.903] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc03b1[1].jpg.dvodltmf")) returned 0x2020 [0125.903] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5530da90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5530da90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5530da90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x370a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBC03B1[1].jpg", cAlternateFileName="BBC03B~1.JPG")) returned 0x2e8598 [0125.903] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5530da90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5530da90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5530da90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x370a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBC03B1[1].jpg", cAlternateFileName="BBC03B~1.JPG")) returned 0 [0125.904] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0125.904] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc03b1[1].jpg")) returned 1 [0125.905] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc03b1[1].jpg")) returned 0xffffffff [0125.905] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51256470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51256470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51256470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x22a0, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBC04o2[1].jpg", cAlternateFileName="BBC04O~1.JPG")) returned 1 [0125.905] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc04o2[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0125.905] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc04o2[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0125.905] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x22a0 [0125.905] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0125.906] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0125.991] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x22a0, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x22a0, lpOverlapped=0x0) returned 1 [0125.993] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x22b0, lpOverlapped=0x0) returned 1 [0125.994] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0126.013] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.022] CloseHandle (hObject=0xf4) returned 1 [0126.023] CloseHandle (hObject=0xe4) returned 1 [0126.023] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc04o2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc04o2[1].jpg.dvodltmf")) returned 0 [0126.023] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc04o2[1].jpg.dvodltmf")) returned 0x2020 [0126.023] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51256470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51256470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51256470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x22a0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBC04o2[1].jpg", cAlternateFileName="BBC04O~1.JPG")) returned 0x2e8598 [0126.024] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51256470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51256470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51256470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x22a0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBC04o2[1].jpg", cAlternateFileName="BBC04O~1.JPG")) returned 0 [0126.024] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0126.024] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc04o2[1].jpg")) returned 1 [0126.025] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc04o2[1].jpg")) returned 0xffffffff [0126.025] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53657130, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53657130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53657130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2036, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBC06ZQ[1].jpg", cAlternateFileName="BBC06Z~1.JPG")) returned 1 [0126.025] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc06zq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0126.025] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc06zq[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0126.026] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2036 [0126.026] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0126.026] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0126.109] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2036, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2036, lpOverlapped=0x0) returned 1 [0126.110] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2040, lpOverlapped=0x0) returned 1 [0126.111] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0126.130] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.140] CloseHandle (hObject=0xe4) returned 1 [0126.140] CloseHandle (hObject=0xf4) returned 1 [0126.140] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc06zq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc06zq[1].jpg.dvodltmf")) returned 0 [0126.141] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc06zq[1].jpg.dvodltmf")) returned 0x2020 [0126.141] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53657130, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53657130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53657130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2036, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBC06ZQ[1].jpg", cAlternateFileName="BBC06Z~1.JPG")) returned 0x2e8598 [0126.141] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53657130, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53657130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53657130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2036, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBC06ZQ[1].jpg", cAlternateFileName="BBC06Z~1.JPG")) returned 0 [0126.141] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0126.141] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc06zq[1].jpg")) returned 1 [0126.142] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc06zq[1].jpg")) returned 0xffffffff [0126.142] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b2bd440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5b2bd440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5b2bd440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13fd, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBC0ALC[1].jpg", cAlternateFileName="BBC0AL~1.JPG")) returned 1 [0126.142] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0alc[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0126.142] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0alc[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0126.143] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13fd [0126.143] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0126.143] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0126.226] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x13fd, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x13fd, lpOverlapped=0x0) returned 1 [0126.228] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1400, lpOverlapped=0x0) returned 1 [0126.229] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0126.256] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.265] CloseHandle (hObject=0xf4) returned 1 [0126.265] CloseHandle (hObject=0xe4) returned 1 [0126.266] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0alc[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0alc[1].jpg.dvodltmf")) returned 0 [0126.266] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0alc[1].jpg.dvodltmf")) returned 0x2020 [0126.267] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b2bd440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5b2bd440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5b2bd440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13fd, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBC0ALC[1].jpg", cAlternateFileName="BBC0AL~1.JPG")) returned 0x2e8598 [0126.267] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b2bd440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5b2bd440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5b2bd440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13fd, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBC0ALC[1].jpg", cAlternateFileName="BBC0AL~1.JPG")) returned 0 [0126.267] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0126.267] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0alc[1].jpg")) returned 1 [0126.268] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0alc[1].jpg")) returned 0xffffffff [0126.268] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x884, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBC0BiZ[1].jpg", cAlternateFileName="BBC0BI~1.JPG")) returned 1 [0126.268] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0biz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0126.268] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0biz[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0126.269] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x884 [0126.269] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0126.269] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0126.354] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x884, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x884, lpOverlapped=0x0) returned 1 [0126.426] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x890, lpOverlapped=0x0) returned 1 [0126.430] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0126.450] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.459] CloseHandle (hObject=0xe4) returned 1 [0126.459] CloseHandle (hObject=0xf4) returned 1 [0126.460] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0biz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0biz[1].jpg.dvodltmf")) returned 0 [0126.460] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0biz[1].jpg.dvodltmf")) returned 0x2020 [0126.460] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x884, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBC0BiZ[1].jpg", cAlternateFileName="BBC0BI~1.JPG")) returned 0x2e8598 [0126.461] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x884, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBC0BiZ[1].jpg", cAlternateFileName="BBC0BI~1.JPG")) returned 0 [0126.461] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0126.461] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0biz[1].jpg")) returned 1 [0126.462] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0biz[1].jpg")) returned 0xffffffff [0126.462] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f0cdd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f0cdd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f0cdd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x34d8, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBC0FXU[1].jpg", cAlternateFileName="BBC0FX~1.JPG")) returned 1 [0126.462] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0126.462] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0126.462] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x34d8 [0126.462] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0126.463] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0126.627] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x34d8, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x34d8, lpOverlapped=0x0) returned 1 [0126.629] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x34e0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x34e0, lpOverlapped=0x0) returned 1 [0126.630] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0126.652] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.663] CloseHandle (hObject=0xf4) returned 1 [0126.663] CloseHandle (hObject=0xe4) returned 1 [0126.663] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[1].jpg.dvodltmf")) returned 0 [0126.664] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[1].jpg.dvodltmf")) returned 0x2020 [0126.664] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f0cdd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f0cdd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f0cdd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x34d8, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBC0FXU[1].jpg", cAlternateFileName="BBC0FX~1.JPG")) returned 0x2e8598 [0126.664] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f0cdd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f0cdd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f0cdd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x34d8, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBC0FXU[1].jpg", cAlternateFileName="BBC0FX~1.JPG")) returned 0 [0126.664] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0126.664] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[1].jpg")) returned 1 [0126.665] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[1].jpg")) returned 0xffffffff [0126.665] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61282d80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61282d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2fd1, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBC0FXU[2].jpg", cAlternateFileName="BBC0FX~2.JPG")) returned 1 [0126.665] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0126.665] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[2].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0126.667] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2fd1 [0126.667] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0126.667] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0126.751] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2fd1, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2fd1, lpOverlapped=0x0) returned 1 [0126.758] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2fe0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2fe0, lpOverlapped=0x0) returned 1 [0126.759] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0126.782] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.795] CloseHandle (hObject=0xe4) returned 1 [0126.795] CloseHandle (hObject=0xf4) returned 1 [0126.795] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[2].jpg.dvodltmf")) returned 0 [0126.796] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[2].jpg.dvodltmf")) returned 0x2020 [0126.796] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61282d80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61282d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2fd1, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBC0FXU[2].jpg", cAlternateFileName="BBC0FX~2.JPG")) returned 0x2e8598 [0126.796] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61282d80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61282d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2fd1, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBC0FXU[2].jpg", cAlternateFileName="BBC0FX~2.JPG")) returned 0 [0126.796] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0126.796] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[2].jpg")) returned 1 [0126.797] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[2].jpg")) returned 0xffffffff [0126.797] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29c3, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBC0mkg[1].jpg", cAlternateFileName="BBC0MK~1.JPG")) returned 1 [0126.797] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0126.797] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0126.798] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29c3 [0126.798] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0126.798] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0126.936] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x29c3, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x29c3, lpOverlapped=0x0) returned 1 [0126.938] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x29d0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x29d0, lpOverlapped=0x0) returned 1 [0126.939] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0126.959] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.969] CloseHandle (hObject=0xf4) returned 1 [0126.969] CloseHandle (hObject=0xe4) returned 1 [0126.969] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[1].jpg.dvodltmf")) returned 0 [0126.970] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[1].jpg.dvodltmf")) returned 0x2020 [0126.970] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29c3, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBC0mkg[1].jpg", cAlternateFileName="BBC0MK~1.JPG")) returned 0x2e8598 [0126.970] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29c3, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBC0mkg[1].jpg", cAlternateFileName="BBC0MK~1.JPG")) returned 0 [0126.970] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0126.970] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[1].jpg")) returned 1 [0126.971] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[1].jpg")) returned 0xffffffff [0126.971] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e9a9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e9a9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e9a9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa7b, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBC0mkg[2].jpg", cAlternateFileName="BBC0MK~2.JPG")) returned 1 [0126.971] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0126.971] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[2].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0126.972] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa7b [0126.972] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0126.972] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0127.058] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa7b, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0xa7b, lpOverlapped=0x0) returned 1 [0127.059] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0xa80, lpOverlapped=0x0) returned 1 [0127.060] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0127.080] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.089] CloseHandle (hObject=0xe4) returned 1 [0127.089] CloseHandle (hObject=0xf4) returned 1 [0127.089] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[2].jpg.dvodltmf")) returned 0 [0127.090] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[2].jpg.dvodltmf")) returned 0x2020 [0127.090] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e9a9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e9a9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e9a9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa7b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBC0mkg[2].jpg", cAlternateFileName="BBC0MK~2.JPG")) returned 0x2e8598 [0127.091] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e9a9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e9a9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e9a9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa7b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBC0mkg[2].jpg", cAlternateFileName="BBC0MK~2.JPG")) returned 0 [0127.091] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0127.091] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[2].jpg")) returned 1 [0127.092] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[2].jpg")) returned 0xffffffff [0127.092] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5127c5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5127c5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5127c5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x17af, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBC0oQi[1].jpg", cAlternateFileName="BBC0OQ~1.JPG")) returned 1 [0127.092] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0oqi[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0127.092] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0oqi[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0127.092] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17af [0127.093] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0127.093] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0127.177] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x17af, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x17af, lpOverlapped=0x0) returned 1 [0127.179] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x17b0, lpOverlapped=0x0) returned 1 [0127.180] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0127.199] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.209] CloseHandle (hObject=0xf4) returned 1 [0127.209] CloseHandle (hObject=0xe4) returned 1 [0127.209] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0oqi[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0oqi[1].jpg.dvodltmf")) returned 0 [0127.210] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0oqi[1].jpg.dvodltmf")) returned 0x2020 [0127.210] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5127c5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5127c5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5127c5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x17af, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBC0oQi[1].jpg", cAlternateFileName="BBC0OQ~1.JPG")) returned 0x2e8598 [0127.210] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5127c5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5127c5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5127c5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x17af, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBC0oQi[1].jpg", cAlternateFileName="BBC0OQ~1.JPG")) returned 0 [0127.210] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0127.210] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0oqi[1].jpg")) returned 1 [0127.211] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0oqi[1].jpg")) returned 0xffffffff [0127.211] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fa5350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fa5350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fa5350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf3, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBC0tCi[1].jpg", cAlternateFileName="BBC0TC~1.JPG")) returned 1 [0127.211] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0tci[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0127.211] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0tci[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0127.212] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaf3 [0127.212] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0127.212] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0127.305] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xaf3, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0xaf3, lpOverlapped=0x0) returned 1 [0127.307] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb00, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0xb00, lpOverlapped=0x0) returned 1 [0127.308] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0127.327] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.337] CloseHandle (hObject=0xe4) returned 1 [0127.337] CloseHandle (hObject=0xf4) returned 1 [0127.337] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0tci[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0tci[1].jpg.dvodltmf")) returned 0 [0127.338] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0tci[1].jpg.dvodltmf")) returned 0x2020 [0127.338] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fa5350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fa5350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fa5350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf3, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBC0tCi[1].jpg", cAlternateFileName="BBC0TC~1.JPG")) returned 0x2e8598 [0127.338] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fa5350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fa5350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fa5350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf3, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBC0tCi[1].jpg", cAlternateFileName="BBC0TC~1.JPG")) returned 0 [0127.338] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0127.338] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0tci[1].jpg")) returned 1 [0127.339] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0tci[1].jpg")) returned 0xffffffff [0127.339] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459f9950, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459f9950, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459f9950, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x350a, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBCM2U2[1].jpg", cAlternateFileName="BBCM2U~1.JPG")) returned 1 [0127.339] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbcm2u2[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0127.340] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbcm2u2[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0127.340] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x350a [0127.340] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0127.340] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0127.437] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x350a, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x350a, lpOverlapped=0x0) returned 1 [0127.465] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3510, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x3510, lpOverlapped=0x0) returned 1 [0127.466] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0127.486] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.495] CloseHandle (hObject=0xf4) returned 1 [0127.495] CloseHandle (hObject=0xe4) returned 1 [0127.495] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbcm2u2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbcm2u2[1].jpg.dvodltmf")) returned 0 [0127.496] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbcm2u2[1].jpg.dvodltmf")) returned 0x2020 [0127.496] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459f9950, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459f9950, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459f9950, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x350a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBCM2U2[1].jpg", cAlternateFileName="BBCM2U~1.JPG")) returned 0x2e8598 [0127.496] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459f9950, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459f9950, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459f9950, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x350a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBCM2U2[1].jpg", cAlternateFileName="BBCM2U~1.JPG")) returned 0 [0127.496] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0127.496] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbcm2u2[1].jpg")) returned 1 [0127.497] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbcm2u2[1].jpg")) returned 0xffffffff [0127.497] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4593b270, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4593b270, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4593b270, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x68c, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBDGTbx[1].jpg", cAlternateFileName="BBDGTB~1.JPG")) returned 1 [0127.497] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdgtbx[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0127.497] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdgtbx[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0127.498] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x68c [0127.498] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0127.498] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0127.583] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x68c, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x68c, lpOverlapped=0x0) returned 1 [0127.584] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x690, lpOverlapped=0x0) returned 1 [0127.585] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0127.605] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.614] CloseHandle (hObject=0xe4) returned 1 [0127.614] CloseHandle (hObject=0xf4) returned 1 [0127.614] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdgtbx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdgtbx[1].jpg.dvodltmf")) returned 0 [0127.615] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdgtbx[1].jpg.dvodltmf")) returned 0x2020 [0127.615] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4593b270, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4593b270, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4593b270, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x68c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBDGTbx[1].jpg", cAlternateFileName="BBDGTB~1.JPG")) returned 0x2e8598 [0127.615] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4593b270, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4593b270, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4593b270, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x68c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBDGTbx[1].jpg", cAlternateFileName="BBDGTB~1.JPG")) returned 0 [0127.615] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0127.615] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdgtbx[1].jpg")) returned 1 [0127.616] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdgtbx[1].jpg")) returned 0xffffffff [0127.616] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBDk44m[1].png", cAlternateFileName="BBDK44~1.PNG")) returned 1 [0127.616] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdk44m[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0127.617] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdk44m[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0127.617] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x284 [0127.617] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0127.618] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0127.702] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x284, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x284, lpOverlapped=0x0) returned 1 [0127.704] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x290, lpOverlapped=0x0) returned 1 [0127.705] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0127.724] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.734] CloseHandle (hObject=0xf4) returned 1 [0127.734] CloseHandle (hObject=0xe4) returned 1 [0127.734] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdk44m[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdk44m[1].png.dvodltmf")) returned 0 [0127.735] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdk44m[1].png.dvodltmf")) returned 0x2020 [0127.735] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBDk44m[1].png", cAlternateFileName="BBDK44~1.PNG")) returned 0x2e8598 [0127.735] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBDk44m[1].png", cAlternateFileName="BBDK44~1.PNG")) returned 0 [0127.735] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0127.735] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdk44m[1].png")) returned 1 [0127.736] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdk44m[1].png")) returned 0xffffffff [0127.736] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a6bd70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a6bd70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a6bd70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2d04, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBDWXoC[1].jpg", cAlternateFileName="BBDWXO~1.JPG")) returned 1 [0127.736] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdwxoc[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0127.736] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdwxoc[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0127.737] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d04 [0127.737] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0127.737] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0127.834] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2d04, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2d04, lpOverlapped=0x0) returned 1 [0127.836] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2d10, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2d10, lpOverlapped=0x0) returned 1 [0127.837] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0127.857] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.866] CloseHandle (hObject=0xe4) returned 1 [0127.866] CloseHandle (hObject=0xf4) returned 1 [0127.866] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdwxoc[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdwxoc[1].jpg.dvodltmf")) returned 0 [0127.868] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdwxoc[1].jpg.dvodltmf")) returned 0x2020 [0127.868] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a6bd70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a6bd70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a6bd70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2d04, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBDWXoC[1].jpg", cAlternateFileName="BBDWXO~1.JPG")) returned 0x2e8598 [0127.868] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a6bd70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a6bd70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a6bd70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2d04, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBDWXoC[1].jpg", cAlternateFileName="BBDWXO~1.JPG")) returned 0 [0127.868] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0127.868] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdwxoc[1].jpg")) returned 1 [0127.869] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdwxoc[1].jpg")) returned 0xffffffff [0127.869] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x863, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBE3NcH[1].jpg", cAlternateFileName="BBE3NC~1.JPG")) returned 1 [0127.869] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe3nch[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0127.869] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe3nch[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0127.870] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x863 [0127.870] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0127.870] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0127.954] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x863, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x863, lpOverlapped=0x0) returned 1 [0127.955] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x870, lpOverlapped=0x0) returned 1 [0127.956] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0127.976] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.985] CloseHandle (hObject=0xf4) returned 1 [0127.985] CloseHandle (hObject=0xe4) returned 1 [0127.986] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe3nch[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe3nch[1].jpg.dvodltmf")) returned 0 [0127.986] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe3nch[1].jpg.dvodltmf")) returned 0x2020 [0127.986] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x863, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBE3NcH[1].jpg", cAlternateFileName="BBE3NC~1.JPG")) returned 0x2e8598 [0127.987] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x863, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBE3NcH[1].jpg", cAlternateFileName="BBE3NC~1.JPG")) returned 0 [0127.987] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0127.987] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe3nch[1].jpg")) returned 1 [0127.988] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe3nch[1].jpg")) returned 0xffffffff [0127.988] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBE7GLE[1].png", cAlternateFileName="BBE7GL~1.PNG")) returned 1 [0127.988] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe7gle[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0127.988] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe7gle[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0127.988] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b5 [0127.988] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0127.989] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0128.073] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2b5, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2b5, lpOverlapped=0x0) returned 1 [0128.074] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2c0, lpOverlapped=0x0) returned 1 [0128.075] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0128.095] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.105] CloseHandle (hObject=0xe4) returned 1 [0128.105] CloseHandle (hObject=0xf4) returned 1 [0128.105] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe7gle[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe7gle[1].png.dvodltmf")) returned 0 [0128.106] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe7gle[1].png.dvodltmf")) returned 0x2020 [0128.106] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBE7GLE[1].png", cAlternateFileName="BBE7GL~1.PNG")) returned 0x2e8598 [0128.106] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBE7GLE[1].png", cAlternateFileName="BBE7GL~1.PNG")) returned 0 [0128.106] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0128.106] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe7gle[1].png")) returned 1 [0128.107] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe7gle[1].png")) returned 0xffffffff [0128.107] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ade190, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ade190, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c9b, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBE8aLO[1].jpg", cAlternateFileName="BBE8AL~1.JPG")) returned 1 [0128.107] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe8alo[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0128.108] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe8alo[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0128.108] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c9b [0128.108] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0128.108] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0128.193] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1c9b, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1c9b, lpOverlapped=0x0) returned 1 [0128.195] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1ca0, lpOverlapped=0x0) returned 1 [0128.196] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0128.216] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.227] CloseHandle (hObject=0xf4) returned 1 [0128.227] CloseHandle (hObject=0xe4) returned 1 [0128.227] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe8alo[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe8alo[1].jpg.dvodltmf")) returned 0 [0128.228] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe8alo[1].jpg.dvodltmf")) returned 0x2020 [0128.228] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ade190, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ade190, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c9b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBE8aLO[1].jpg", cAlternateFileName="BBE8AL~1.JPG")) returned 0x2e8598 [0128.228] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ade190, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ade190, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c9b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBE8aLO[1].jpg", cAlternateFileName="BBE8AL~1.JPG")) returned 0 [0128.228] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0128.228] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe8alo[1].jpg")) returned 1 [0128.229] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe8alo[1].jpg")) returned 0xffffffff [0128.229] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEd5bF[1].jpg", cAlternateFileName="BBED5B~1.JPG")) returned 1 [0128.229] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbed5bf[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0128.229] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbed5bf[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0128.230] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x702 [0128.230] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0128.230] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0128.325] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x702, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x702, lpOverlapped=0x0) returned 1 [0128.327] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x710, lpOverlapped=0x0) returned 1 [0128.328] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0128.350] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.359] CloseHandle (hObject=0xe4) returned 1 [0128.359] CloseHandle (hObject=0xf4) returned 1 [0128.359] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbed5bf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbed5bf[1].jpg.dvodltmf")) returned 0 [0128.360] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbed5bf[1].jpg.dvodltmf")) returned 0x2020 [0128.360] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEd5bF[1].jpg", cAlternateFileName="BBED5B~1.JPG")) returned 0x2e8598 [0128.360] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEd5bF[1].jpg", cAlternateFileName="BBED5B~1.JPG")) returned 0 [0128.360] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0128.360] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbed5bf[1].jpg")) returned 1 [0128.361] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbed5bf[1].jpg")) returned 0xffffffff [0128.361] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50ebbff0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50ebbff0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50ebbff0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xaca8, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEdDNm[1].jpg", cAlternateFileName="BBEDDN~1.JPG")) returned 1 [0128.361] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeddnm[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0128.362] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeddnm[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0128.363] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaca8 [0128.363] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0128.363] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0128.456] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xaca8, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0xaca8, lpOverlapped=0x0) returned 1 [0128.458] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xacb0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0xacb0, lpOverlapped=0x0) returned 1 [0128.459] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0128.479] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.489] CloseHandle (hObject=0xf4) returned 1 [0128.489] CloseHandle (hObject=0xe4) returned 1 [0128.489] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeddnm[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeddnm[1].jpg.dvodltmf")) returned 0 [0128.490] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeddnm[1].jpg.dvodltmf")) returned 0x2020 [0128.490] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50ebbff0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50ebbff0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50ebbff0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xaca8, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEdDNm[1].jpg", cAlternateFileName="BBEDDN~1.JPG")) returned 0x2e8598 [0128.490] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50ebbff0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50ebbff0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50ebbff0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xaca8, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEdDNm[1].jpg", cAlternateFileName="BBEDDN~1.JPG")) returned 0 [0128.490] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0128.490] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeddnm[1].jpg")) returned 1 [0128.491] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeddnm[1].jpg")) returned 0xffffffff [0128.491] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x755, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEdpyr[1].jpg", cAlternateFileName="BBEDPY~1.JPG")) returned 1 [0128.491] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedpyr[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0128.492] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedpyr[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0128.492] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x755 [0128.492] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0128.492] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0128.577] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x755, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x755, lpOverlapped=0x0) returned 1 [0128.578] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x760, lpOverlapped=0x0) returned 1 [0128.579] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0128.599] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.608] CloseHandle (hObject=0xe4) returned 1 [0128.609] CloseHandle (hObject=0xf4) returned 1 [0128.609] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedpyr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedpyr[1].jpg.dvodltmf")) returned 0 [0128.609] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedpyr[1].jpg.dvodltmf")) returned 0x2020 [0128.609] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x755, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEdpyr[1].jpg", cAlternateFileName="BBEDPY~1.JPG")) returned 0x2e8598 [0128.610] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x755, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEdpyr[1].jpg", cAlternateFileName="BBEDPY~1.JPG")) returned 0 [0128.610] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0128.610] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedpyr[1].jpg")) returned 1 [0128.611] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedpyr[1].jpg")) returned 0xffffffff [0128.611] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c72, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEdQdv[1].jpg", cAlternateFileName="BBEDQD~1.JPG")) returned 1 [0128.611] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedqdv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0128.611] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedqdv[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0128.611] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c72 [0128.611] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0128.612] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0128.698] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1c72, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1c72, lpOverlapped=0x0) returned 1 [0128.699] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1c80, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1c80, lpOverlapped=0x0) returned 1 [0128.700] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0128.720] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.729] CloseHandle (hObject=0xf4) returned 1 [0128.729] CloseHandle (hObject=0xe4) returned 1 [0128.729] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedqdv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedqdv[1].jpg.dvodltmf")) returned 0 [0128.730] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedqdv[1].jpg.dvodltmf")) returned 0x2020 [0128.730] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c72, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEdQdv[1].jpg", cAlternateFileName="BBEDQD~1.JPG")) returned 0x2e8598 [0128.730] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c72, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEdQdv[1].jpg", cAlternateFileName="BBEDQD~1.JPG")) returned 0 [0128.730] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0128.730] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedqdv[1].jpg")) returned 1 [0128.731] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedqdv[1].jpg")) returned 0xffffffff [0128.731] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xa23, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEe62t[1].jpg", cAlternateFileName="BBEE62~1.JPG")) returned 1 [0128.733] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbee62t[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0128.733] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbee62t[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0128.733] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa23 [0128.733] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0128.734] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0128.819] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa23, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0xa23, lpOverlapped=0x0) returned 1 [0128.820] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0xa30, lpOverlapped=0x0) returned 1 [0128.821] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0128.841] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.851] CloseHandle (hObject=0xe4) returned 1 [0128.851] CloseHandle (hObject=0xf4) returned 1 [0128.851] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbee62t[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbee62t[1].jpg.dvodltmf")) returned 0 [0128.852] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbee62t[1].jpg.dvodltmf")) returned 0x2020 [0128.852] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xa23, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEe62t[1].jpg", cAlternateFileName="BBEE62~1.JPG")) returned 0x2e8598 [0128.852] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xa23, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEe62t[1].jpg", cAlternateFileName="BBEE62~1.JPG")) returned 0 [0128.852] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0128.853] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbee62t[1].jpg")) returned 1 [0128.854] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbee62t[1].jpg")) returned 0xffffffff [0128.854] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1ca7, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEedPR[1].jpg", cAlternateFileName="BBEEDP~1.JPG")) returned 1 [0128.854] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeedpr[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0128.854] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeedpr[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0128.855] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ca7 [0128.855] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0128.855] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0128.940] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1ca7, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1ca7, lpOverlapped=0x0) returned 1 [0128.941] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1cb0, lpOverlapped=0x0) returned 1 [0128.942] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0128.962] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.971] CloseHandle (hObject=0xf4) returned 1 [0128.971] CloseHandle (hObject=0xe4) returned 1 [0128.971] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeedpr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeedpr[1].jpg.dvodltmf")) returned 0 [0128.972] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeedpr[1].jpg.dvodltmf")) returned 0x2020 [0128.972] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1ca7, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEedPR[1].jpg", cAlternateFileName="BBEEDP~1.JPG")) returned 0x2e8598 [0128.972] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1ca7, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEedPR[1].jpg", cAlternateFileName="BBEEDP~1.JPG")) returned 0 [0128.972] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0128.972] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeedpr[1].jpg")) returned 1 [0128.973] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeedpr[1].jpg")) returned 0xffffffff [0128.973] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe34d9d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe34d9d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe34d9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x9ef, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEeTpB[1].jpg", cAlternateFileName="BBEETP~1.JPG")) returned 1 [0128.973] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetpb[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0128.974] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetpb[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0128.974] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9ef [0128.974] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0128.974] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0129.059] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x9ef, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x9ef, lpOverlapped=0x0) returned 1 [0129.060] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x9f0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x9f0, lpOverlapped=0x0) returned 1 [0129.061] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0129.080] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.091] CloseHandle (hObject=0xe4) returned 1 [0129.091] CloseHandle (hObject=0xf4) returned 1 [0129.091] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetpb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetpb[1].jpg.dvodltmf")) returned 0 [0129.091] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetpb[1].jpg.dvodltmf")) returned 0x2020 [0129.092] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe34d9d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe34d9d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe34d9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x9ef, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEeTpB[1].jpg", cAlternateFileName="BBEETP~1.JPG")) returned 0x2e8598 [0129.092] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe34d9d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe34d9d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe34d9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x9ef, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEeTpB[1].jpg", cAlternateFileName="BBEETP~1.JPG")) returned 0 [0129.092] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0129.092] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetpb[1].jpg")) returned 1 [0129.093] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetpb[1].jpg")) returned 0xffffffff [0129.093] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x952, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEeTuf[1].jpg", cAlternateFileName="BBEETU~1.JPG")) returned 1 [0129.093] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetuf[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0129.094] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetuf[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0129.095] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x952 [0129.095] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0129.095] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0129.177] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x952, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x952, lpOverlapped=0x0) returned 1 [0129.376] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x960, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x960, lpOverlapped=0x0) returned 1 [0129.377] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0129.397] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.406] CloseHandle (hObject=0xf4) returned 1 [0129.406] CloseHandle (hObject=0xe4) returned 1 [0129.406] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetuf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetuf[1].jpg.dvodltmf")) returned 0 [0129.407] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetuf[1].jpg.dvodltmf")) returned 0x2020 [0129.407] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x952, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEeTuf[1].jpg", cAlternateFileName="BBEETU~1.JPG")) returned 0x2e8598 [0129.407] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x952, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEeTuf[1].jpg", cAlternateFileName="BBEETU~1.JPG")) returned 0 [0129.407] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0129.408] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetuf[1].jpg")) returned 1 [0129.408] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetuf[1].jpg")) returned 0xffffffff [0129.408] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b76710, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b76710, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b76710, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7a9, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEeU5U[1].jpg", cAlternateFileName="BBEEU5~1.JPG")) returned 1 [0129.409] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeeu5u[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0129.409] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeeu5u[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0129.409] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7a9 [0129.409] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0129.410] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0129.495] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x7a9, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x7a9, lpOverlapped=0x0) returned 1 [0129.498] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x7b0, lpOverlapped=0x0) returned 1 [0129.499] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0129.519] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.528] CloseHandle (hObject=0xe4) returned 1 [0129.528] CloseHandle (hObject=0xf4) returned 1 [0129.528] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeeu5u[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeeu5u[1].jpg.dvodltmf")) returned 0 [0129.529] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeeu5u[1].jpg.dvodltmf")) returned 0x2020 [0129.529] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b76710, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b76710, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b76710, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7a9, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEeU5U[1].jpg", cAlternateFileName="BBEEU5~1.JPG")) returned 0x2e8598 [0129.529] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b76710, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b76710, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b76710, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7a9, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEeU5U[1].jpg", cAlternateFileName="BBEEU5~1.JPG")) returned 0 [0129.529] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0129.529] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeeu5u[1].jpg")) returned 1 [0129.533] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeeu5u[1].jpg")) returned 0xffffffff [0129.533] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x86f, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEf306[1].jpg", cAlternateFileName="BBEF30~1.JPG")) returned 1 [0129.533] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef306[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0129.534] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef306[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0129.534] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x86f [0129.534] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0129.534] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0129.619] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x86f, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x86f, lpOverlapped=0x0) returned 1 [0129.635] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x870, lpOverlapped=0x0) returned 1 [0129.636] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0129.655] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.665] CloseHandle (hObject=0xf4) returned 1 [0129.665] CloseHandle (hObject=0xe4) returned 1 [0129.665] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef306[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef306[1].jpg.dvodltmf")) returned 0 [0129.666] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef306[1].jpg.dvodltmf")) returned 0x2020 [0129.666] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x86f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEf306[1].jpg", cAlternateFileName="BBEF30~1.JPG")) returned 0x2e8598 [0129.666] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x86f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEf306[1].jpg", cAlternateFileName="BBEF30~1.JPG")) returned 0 [0129.666] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0129.666] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef306[1].jpg")) returned 1 [0129.667] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef306[1].jpg")) returned 0xffffffff [0129.667] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459613d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEf54R[1].jpg", cAlternateFileName="BBEF54~1.JPG")) returned 1 [0129.667] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef54r[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0129.668] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef54r[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0129.668] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x828 [0129.668] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0129.668] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0129.756] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x828, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x828, lpOverlapped=0x0) returned 1 [0129.777] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x830, lpOverlapped=0x0) returned 1 [0129.778] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0129.797] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.808] CloseHandle (hObject=0xe4) returned 1 [0129.808] CloseHandle (hObject=0xf4) returned 1 [0129.808] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef54r[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef54r[1].jpg.dvodltmf")) returned 0 [0129.809] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef54r[1].jpg.dvodltmf")) returned 0x2020 [0129.809] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459613d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEf54R[1].jpg", cAlternateFileName="BBEF54~1.JPG")) returned 0x2e8598 [0129.809] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459613d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEf54R[1].jpg", cAlternateFileName="BBEF54~1.JPG")) returned 0 [0129.810] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0129.810] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef54r[1].jpg")) returned 1 [0129.810] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef54r[1].jpg")) returned 0xffffffff [0129.811] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4587cb90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4587cb90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4587cb90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3860, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEfBbH[1].jpg", cAlternateFileName="BBEFBB~1.JPG")) returned 1 [0129.811] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbbh[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0129.811] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbbh[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0129.811] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3860 [0129.811] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0129.812] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0129.903] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3860, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x3860, lpOverlapped=0x0) returned 1 [0129.906] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x3870, lpOverlapped=0x0) returned 1 [0129.907] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0129.927] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.936] CloseHandle (hObject=0xf4) returned 1 [0129.936] CloseHandle (hObject=0xe4) returned 1 [0129.936] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbbh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbbh[1].jpg.dvodltmf")) returned 0 [0129.937] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbbh[1].jpg.dvodltmf")) returned 0x2020 [0129.937] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4587cb90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4587cb90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4587cb90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3860, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEfBbH[1].jpg", cAlternateFileName="BBEFBB~1.JPG")) returned 0x2e8598 [0129.937] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4587cb90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4587cb90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4587cb90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3860, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEfBbH[1].jpg", cAlternateFileName="BBEFBB~1.JPG")) returned 0 [0129.937] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0129.937] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbbh[1].jpg")) returned 1 [0129.938] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbbh[1].jpg")) returned 0xffffffff [0129.938] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457be4b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457be4b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457be4b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19a5, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEfBq0[1].jpg", cAlternateFileName="BBEFBQ~1.JPG")) returned 1 [0129.938] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbq0[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0129.939] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbq0[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0129.939] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19a5 [0129.939] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0129.940] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0130.023] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x19a5, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x19a5, lpOverlapped=0x0) returned 1 [0130.025] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x19b0, lpOverlapped=0x0) returned 1 [0130.026] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0130.046] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.055] CloseHandle (hObject=0xe4) returned 1 [0130.056] CloseHandle (hObject=0xf4) returned 1 [0130.056] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbq0[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbq0[1].jpg.dvodltmf")) returned 0 [0130.056] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbq0[1].jpg.dvodltmf")) returned 0x2020 [0130.056] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457be4b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457be4b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457be4b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19a5, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEfBq0[1].jpg", cAlternateFileName="BBEFBQ~1.JPG")) returned 0x2e8598 [0130.057] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457be4b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457be4b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457be4b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19a5, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEfBq0[1].jpg", cAlternateFileName="BBEFBQ~1.JPG")) returned 0 [0130.057] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0130.057] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbq0[1].jpg")) returned 1 [0130.058] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbq0[1].jpg")) returned 0xffffffff [0130.058] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2619, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEfBrz[1].jpg", cAlternateFileName="BBEFBR~1.JPG")) returned 1 [0130.058] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbrz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0130.058] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbrz[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0130.058] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2619 [0130.058] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0130.059] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0130.142] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2619, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2619, lpOverlapped=0x0) returned 1 [0130.143] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2620, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2620, lpOverlapped=0x0) returned 1 [0130.144] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0130.164] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.173] CloseHandle (hObject=0xf4) returned 1 [0130.173] CloseHandle (hObject=0xe4) returned 1 [0130.173] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbrz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbrz[1].jpg.dvodltmf")) returned 0 [0130.174] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbrz[1].jpg.dvodltmf")) returned 0x2020 [0130.174] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2619, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEfBrz[1].jpg", cAlternateFileName="BBEFBR~1.JPG")) returned 0x2e8598 [0130.174] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2619, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEfBrz[1].jpg", cAlternateFileName="BBEFBR~1.JPG")) returned 0 [0130.174] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0130.174] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbrz[1].jpg")) returned 1 [0130.175] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbrz[1].jpg")) returned 0xffffffff [0130.175] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b76710, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b76710, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b76710, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1f84, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEfXl6[1].jpg", cAlternateFileName="BBEFXL~1.JPG")) returned 1 [0130.175] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefxl6[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0130.176] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefxl6[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0130.176] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f84 [0130.176] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0130.177] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0130.260] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1f84, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1f84, lpOverlapped=0x0) returned 1 [0130.282] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1f90, lpOverlapped=0x0) returned 1 [0130.283] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0130.312] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.321] CloseHandle (hObject=0xe4) returned 1 [0130.322] CloseHandle (hObject=0xf4) returned 1 [0130.322] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefxl6[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefxl6[1].jpg.dvodltmf")) returned 0 [0130.322] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefxl6[1].jpg.dvodltmf")) returned 0x2020 [0130.323] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b76710, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b76710, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b76710, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1f84, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEfXl6[1].jpg", cAlternateFileName="BBEFXL~1.JPG")) returned 0x2e8598 [0130.323] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b76710, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b76710, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b76710, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1f84, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEfXl6[1].jpg", cAlternateFileName="BBEFXL~1.JPG")) returned 0 [0130.323] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0130.323] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefxl6[1].jpg")) returned 1 [0130.324] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefxl6[1].jpg")) returned 0xffffffff [0130.324] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbded7090, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbded7090, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbded7090, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1c7e, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEgEH3[1].jpg", cAlternateFileName="BBEGEH~1.JPG")) returned 1 [0130.324] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegeh3[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0130.324] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegeh3[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0130.325] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c7e [0130.325] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0130.325] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0130.413] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1c7e, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1c7e, lpOverlapped=0x0) returned 1 [0130.417] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1c80, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1c80, lpOverlapped=0x0) returned 1 [0130.418] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0130.438] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.447] CloseHandle (hObject=0xf4) returned 1 [0130.447] CloseHandle (hObject=0xe4) returned 1 [0130.448] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegeh3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegeh3[1].jpg.dvodltmf")) returned 0 [0130.448] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegeh3[1].jpg.dvodltmf")) returned 0x2020 [0130.448] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbded7090, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbded7090, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbded7090, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1c7e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEgEH3[1].jpg", cAlternateFileName="BBEGEH~1.JPG")) returned 0x2e8598 [0130.449] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbded7090, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbded7090, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbded7090, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1c7e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEgEH3[1].jpg", cAlternateFileName="BBEGEH~1.JPG")) returned 0 [0130.449] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0130.449] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegeh3[1].jpg")) returned 1 [0130.450] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegeh3[1].jpg")) returned 0xffffffff [0130.450] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8f9, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEgsz3[1].jpg", cAlternateFileName="BBEGSZ~1.JPG")) returned 1 [0130.450] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegsz3[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0130.450] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegsz3[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0130.451] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8f9 [0130.451] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0130.451] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0130.536] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x8f9, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x8f9, lpOverlapped=0x0) returned 1 [0130.537] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x900, lpOverlapped=0x0) returned 1 [0130.538] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0130.558] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.568] CloseHandle (hObject=0xe4) returned 1 [0130.568] CloseHandle (hObject=0xf4) returned 1 [0130.568] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegsz3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegsz3[1].jpg.dvodltmf")) returned 0 [0130.568] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegsz3[1].jpg.dvodltmf")) returned 0x2020 [0130.569] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8f9, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEgsz3[1].jpg", cAlternateFileName="BBEGSZ~1.JPG")) returned 0x2e8598 [0130.569] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8f9, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEgsz3[1].jpg", cAlternateFileName="BBEGSZ~1.JPG")) returned 0 [0130.569] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0130.569] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegsz3[1].jpg")) returned 1 [0130.570] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegsz3[1].jpg")) returned 0xffffffff [0130.570] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4574c090, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x9b7, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEgTxB[1].jpg", cAlternateFileName="BBEGTX~1.JPG")) returned 1 [0130.570] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegtxb[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0130.570] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegtxb[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0130.571] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9b7 [0130.571] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0130.571] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0130.656] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x9b7, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x9b7, lpOverlapped=0x0) returned 1 [0130.659] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x9c0, lpOverlapped=0x0) returned 1 [0130.660] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0130.680] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.689] CloseHandle (hObject=0xf4) returned 1 [0130.689] CloseHandle (hObject=0xe4) returned 1 [0130.689] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegtxb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegtxb[1].jpg.dvodltmf")) returned 0 [0130.690] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegtxb[1].jpg.dvodltmf")) returned 0x2020 [0130.690] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4574c090, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x9b7, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEgTxB[1].jpg", cAlternateFileName="BBEGTX~1.JPG")) returned 0x2e8598 [0130.690] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4574c090, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x9b7, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEgTxB[1].jpg", cAlternateFileName="BBEGTX~1.JPG")) returned 0 [0130.691] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0130.691] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegtxb[1].jpg")) returned 1 [0130.691] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegtxb[1].jpg")) returned 0xffffffff [0130.692] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x36e, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBo1lFJ[2].png", cAlternateFileName="BBO1LF~2.PNG")) returned 1 [0130.692] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbo1lfj[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0130.692] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbo1lfj[2].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0130.692] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x36e [0130.692] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0130.693] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0130.781] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x36e, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x36e, lpOverlapped=0x0) returned 1 [0130.782] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x370, lpOverlapped=0x0) returned 1 [0130.783] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0130.803] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.812] CloseHandle (hObject=0xe4) returned 1 [0130.812] CloseHandle (hObject=0xf4) returned 1 [0130.812] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbo1lfj[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbo1lfj[2].png.dvodltmf")) returned 0 [0130.813] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbo1lfj[2].png.dvodltmf")) returned 0x2020 [0130.813] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x36e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBo1lFJ[2].png", cAlternateFileName="BBO1LF~2.PNG")) returned 0x2e8598 [0130.813] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x36e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBo1lFJ[2].png", cAlternateFileName="BBO1LF~2.PNG")) returned 0 [0130.813] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0130.813] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbo1lfj[2].png")) returned 1 [0130.814] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbo1lfj[2].png")) returned 0xffffffff [0130.814] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x455f5430, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x455f5430, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x455f5430, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBs47TE[1].png", cAlternateFileName="BBS47T~1.PNG")) returned 1 [0130.814] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbs47te[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0130.815] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbs47te[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0130.815] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x23f [0130.815] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0130.816] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0130.899] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x23f, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x23f, lpOverlapped=0x0) returned 1 [0130.901] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x240, lpOverlapped=0x0) returned 1 [0130.902] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0130.921] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.933] CloseHandle (hObject=0xf4) returned 1 [0130.933] CloseHandle (hObject=0xe4) returned 1 [0130.933] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbs47te[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbs47te[1].png.dvodltmf")) returned 0 [0130.934] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbs47te[1].png.dvodltmf")) returned 0x2020 [0130.934] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x455f5430, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x455f5430, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x455f5430, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBs47TE[1].png", cAlternateFileName="BBS47T~1.PNG")) returned 0x2e8598 [0130.934] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x455f5430, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x455f5430, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x455f5430, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBs47TE[1].png", cAlternateFileName="BBS47T~1.PNG")) returned 0 [0130.934] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0130.934] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbs47te[1].png")) returned 1 [0130.935] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbs47te[1].png")) returned 0xffffffff [0130.935] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2cb0, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBu9sWQ[1].jpg", cAlternateFileName="BBU9SW~1.JPG")) returned 1 [0130.935] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbu9swq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0130.935] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbu9swq[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0130.936] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2cb0 [0130.936] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0130.936] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0131.022] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2cb0, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2cb0, lpOverlapped=0x0) returned 1 [0131.023] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2cc0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2cc0, lpOverlapped=0x0) returned 1 [0131.025] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0131.044] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.053] CloseHandle (hObject=0xe4) returned 1 [0131.053] CloseHandle (hObject=0xf4) returned 1 [0131.054] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbu9swq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbu9swq[1].jpg.dvodltmf")) returned 0 [0131.054] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbu9swq[1].jpg.dvodltmf")) returned 0x2020 [0131.054] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2cb0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBu9sWQ[1].jpg", cAlternateFileName="BBU9SW~1.JPG")) returned 0x2e8598 [0131.055] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2cb0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBu9sWQ[1].jpg", cAlternateFileName="BBU9SW~1.JPG")) returned 0 [0131.055] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0131.055] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbu9swq[1].jpg")) returned 1 [0131.056] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbu9swq[1].jpg")) returned 0xffffffff [0131.056] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x228c, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BByazif[2].jpg", cAlternateFileName="BBYAZI~2.JPG")) returned 1 [0131.056] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbyazif[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0131.056] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbyazif[2].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0131.057] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x228c [0131.057] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0131.057] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0131.141] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x228c, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x228c, lpOverlapped=0x0) returned 1 [0131.142] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2290, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2290, lpOverlapped=0x0) returned 1 [0131.144] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0131.163] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.173] CloseHandle (hObject=0xf4) returned 1 [0131.173] CloseHandle (hObject=0xe4) returned 1 [0131.173] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbyazif[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbyazif[2].jpg.dvodltmf")) returned 0 [0131.174] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbyazif[2].jpg.dvodltmf")) returned 0x2020 [0131.174] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x228c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BByazif[2].jpg", cAlternateFileName="BBYAZI~2.JPG")) returned 0x2e8598 [0131.174] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x228c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BByazif[2].jpg", cAlternateFileName="BBYAZI~2.JPG")) returned 0 [0131.174] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0131.174] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbyazif[2].jpg")) returned 1 [0131.175] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbyazif[2].jpg")) returned 0xffffffff [0131.175] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b51310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b51310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b51310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf13, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="bs-components[1].css", cAlternateFileName="BS-COM~1.CSS")) returned 1 [0131.175] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-components[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bs-components[1].css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0131.176] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-components[1].css.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bs-components[1].css.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0131.176] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaf13 [0131.176] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0131.177] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0131.270] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xaf13, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0xaf13, lpOverlapped=0x0) returned 1 [0131.273] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xaf20, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0xaf20, lpOverlapped=0x0) returned 1 [0131.274] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0131.294] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.303] CloseHandle (hObject=0xe4) returned 1 [0131.303] CloseHandle (hObject=0xf4) returned 1 [0131.304] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-components[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bs-components[1].css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-components[1].css.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bs-components[1].css.dvodltmf")) returned 0 [0131.304] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-components[1].css.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bs-components[1].css.dvodltmf")) returned 0x2020 [0131.304] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-components[1].css", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b51310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b51310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b51310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf13, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="bs-components[1].css", cAlternateFileName="BS-COM~1.CSS")) returned 0x2e8598 [0131.305] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b51310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b51310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b51310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf13, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="bs-components[1].css", cAlternateFileName="BS-COM~1.CSS")) returned 0 [0131.305] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0131.305] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-components[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bs-components[1].css")) returned 1 [0131.306] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-components[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bs-components[1].css")) returned 0xffffffff [0131.306] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30be, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="bs-util[1].css", cAlternateFileName="BS-UTI~1.CSS")) returned 1 [0131.306] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-util[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bs-util[1].css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0131.306] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-util[1].css.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bs-util[1].css.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0131.307] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x30be [0131.307] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0131.307] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0131.403] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x30be, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x30be, lpOverlapped=0x0) returned 1 [0131.404] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x30c0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x30c0, lpOverlapped=0x0) returned 1 [0131.405] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0131.425] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.434] CloseHandle (hObject=0xf4) returned 1 [0131.434] CloseHandle (hObject=0xe4) returned 1 [0131.434] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-util[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bs-util[1].css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-util[1].css.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bs-util[1].css.dvodltmf")) returned 0 [0131.435] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-util[1].css.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bs-util[1].css.dvodltmf")) returned 0x2020 [0131.435] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-util[1].css", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30be, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="bs-util[1].css", cAlternateFileName="BS-UTI~1.CSS")) returned 0x2e8598 [0131.435] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30be, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="bs-util[1].css", cAlternateFileName="BS-UTI~1.CSS")) returned 0 [0131.435] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0131.435] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-util[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bs-util[1].css")) returned 1 [0131.436] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-util[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bs-util[1].css")) returned 0xffffffff [0131.436] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd97bf10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbd97bf10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbd9a2070, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x254f1, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="c7-bdbd0d-91cdfbc1[1].txt", cAlternateFileName="C7-BDB~1.TXT")) returned 1 [0131.436] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\c7-bdbd0d-91cdfbc1[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0131.437] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\c7-bdbd0d-91cdfbc1[1].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0131.437] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x254f1 [0131.437] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0131.437] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0131.524] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x254f1, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x254f1, lpOverlapped=0x0) returned 1 [0131.528] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x25500, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x25500, lpOverlapped=0x0) returned 1 [0131.531] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0131.551] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.560] CloseHandle (hObject=0xe4) returned 1 [0131.561] CloseHandle (hObject=0xf4) returned 1 [0131.561] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\c7-bdbd0d-91cdfbc1[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\c7-bdbd0d-91cdfbc1[1].txt.dvodltmf")) returned 0 [0131.561] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\c7-bdbd0d-91cdfbc1[1].txt.dvodltmf")) returned 0x2020 [0131.562] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd97bf10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbd97bf10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbd9a2070, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x254f1, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="c7-bdbd0d-91cdfbc1[1].txt", cAlternateFileName="C7-BDB~1.TXT")) returned 0x2e8598 [0131.562] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd97bf10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbd97bf10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbd9a2070, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x254f1, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="c7-bdbd0d-91cdfbc1[1].txt", cAlternateFileName="C7-BDB~1.TXT")) returned 0 [0131.562] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0131.562] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\c7-bdbd0d-91cdfbc1[1].txt")) returned 1 [0131.564] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\c7-bdbd0d-91cdfbc1[1].txt")) returned 0xffffffff [0131.564] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x614e4380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x614e4380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x614e4380, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x211dd, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="cb=gapi[1].loaded_0", cAlternateFileName="CB_GAP~1.LOA")) returned 1 [0131.564] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[1].loaded_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\cb=gapi[1].loaded_0"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0131.564] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[1].loaded_0.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\cb=gapi[1].loaded_0.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0131.565] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x211dd [0131.565] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0131.565] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0131.653] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x211dd, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x211dd, lpOverlapped=0x0) returned 1 [0131.657] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x211e0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x211e0, lpOverlapped=0x0) returned 1 [0131.660] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0131.680] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.690] CloseHandle (hObject=0xf4) returned 1 [0131.690] CloseHandle (hObject=0xe4) returned 1 [0131.690] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[1].loaded_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\cb=gapi[1].loaded_0"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[1].loaded_0.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\cb=gapi[1].loaded_0.dvodltmf")) returned 0 [0131.691] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[1].loaded_0.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\cb=gapi[1].loaded_0.dvodltmf")) returned 0x2020 [0131.691] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[1].loaded_0", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x614e4380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x614e4380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x614e4380, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x211dd, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="cb=gapi[1].loaded_0", cAlternateFileName="CB_GAP~1.LOA")) returned 0x2e8598 [0131.691] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x614e4380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x614e4380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x614e4380, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x211dd, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="cb=gapi[1].loaded_0", cAlternateFileName="CB_GAP~1.LOA")) returned 0 [0131.691] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0131.692] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[1].loaded_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\cb=gapi[1].loaded_0")) returned 1 [0131.693] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[1].loaded_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\cb=gapi[1].loaded_0")) returned 0xffffffff [0131.693] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x63c04d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63c04d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63c04d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x653e, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="cb=gapi[2].loaded_0", cAlternateFileName="CB_GAP~2.LOA")) returned 1 [0131.693] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[2].loaded_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\cb=gapi[2].loaded_0"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0131.694] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[2].loaded_0.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\cb=gapi[2].loaded_0.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0131.695] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x653e [0131.695] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0131.695] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0131.781] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x653e, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x653e, lpOverlapped=0x0) returned 1 [0131.814] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x6540, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x6540, lpOverlapped=0x0) returned 1 [0131.815] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0131.834] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.844] CloseHandle (hObject=0xe4) returned 1 [0131.844] CloseHandle (hObject=0xf4) returned 1 [0131.844] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[2].loaded_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\cb=gapi[2].loaded_0"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[2].loaded_0.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\cb=gapi[2].loaded_0.dvodltmf")) returned 0 [0131.845] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[2].loaded_0.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\cb=gapi[2].loaded_0.dvodltmf")) returned 0x2020 [0131.845] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[2].loaded_0", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x63c04d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63c04d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63c04d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x653e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="cb=gapi[2].loaded_0", cAlternateFileName="CB_GAP~2.LOA")) returned 0x2e8598 [0131.845] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x63c04d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63c04d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63c04d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x653e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="cb=gapi[2].loaded_0", cAlternateFileName="CB_GAP~2.LOA")) returned 0 [0131.845] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0131.845] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[2].loaded_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\cb=gapi[2].loaded_0")) returned 1 [0131.846] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[2].loaded_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\cb=gapi[2].loaded_0")) returned 0xffffffff [0131.847] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x584c4b60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x584c4b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x58510e20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a03f, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="chrome.min[1].css", cAlternateFileName="CHROME~1.CSS")) returned 1 [0131.847] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\chrome.min[1].css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0131.847] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome.min[1].css.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\chrome.min[1].css.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0131.847] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2a03f [0131.847] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0131.848] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0131.930] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2a03f, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2a03f, lpOverlapped=0x0) returned 1 [0131.934] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2a040, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2a040, lpOverlapped=0x0) returned 1 [0131.938] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0131.958] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.967] CloseHandle (hObject=0xf4) returned 1 [0131.967] CloseHandle (hObject=0xe4) returned 1 [0131.968] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\chrome.min[1].css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome.min[1].css.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\chrome.min[1].css.dvodltmf")) returned 0 [0131.968] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome.min[1].css.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\chrome.min[1].css.dvodltmf")) returned 0x2020 [0131.968] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome.min[1].css", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x584c4b60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x584c4b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x58510e20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a03f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="chrome.min[1].css", cAlternateFileName="CHROME~1.CSS")) returned 0x2e8598 [0131.969] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x584c4b60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x584c4b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x58510e20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a03f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="chrome.min[1].css", cAlternateFileName="CHROME~1.CSS")) returned 0 [0131.969] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0131.969] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\chrome.min[1].css")) returned 1 [0131.971] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\chrome.min[1].css")) returned 0xffffffff [0131.971] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60c69520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60c69520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60c69520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x60c, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="chrome_throbber_fast_16[1].gif", cAlternateFileName="CHROME~1.GIF")) returned 1 [0131.971] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome_throbber_fast_16[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\chrome_throbber_fast_16[1].gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0131.971] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome_throbber_fast_16[1].gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\chrome_throbber_fast_16[1].gif.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0131.972] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x60c [0131.972] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0131.972] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0132.056] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x60c, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x60c, lpOverlapped=0x0) returned 1 [0132.058] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x610, lpOverlapped=0x0) returned 1 [0132.059] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0132.078] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.088] CloseHandle (hObject=0xe4) returned 1 [0132.088] CloseHandle (hObject=0xf4) returned 1 [0132.088] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome_throbber_fast_16[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\chrome_throbber_fast_16[1].gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome_throbber_fast_16[1].gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\chrome_throbber_fast_16[1].gif.dvodltmf")) returned 0 [0132.089] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome_throbber_fast_16[1].gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\chrome_throbber_fast_16[1].gif.dvodltmf")) returned 0x2020 [0132.089] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome_throbber_fast_16[1].gif", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60c69520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60c69520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60c69520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x60c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="chrome_throbber_fast_16[1].gif", cAlternateFileName="CHROME~1.GIF")) returned 0x2e8598 [0132.089] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60c69520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60c69520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60c69520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x60c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="chrome_throbber_fast_16[1].gif", cAlternateFileName="CHROME~1.GIF")) returned 0 [0132.089] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0132.089] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome_throbber_fast_16[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\chrome_throbber_fast_16[1].gif")) returned 1 [0132.090] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome_throbber_fast_16[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\chrome_throbber_fast_16[1].gif")) returned 0xffffffff [0132.090] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55333bf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x55333bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55333bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="collect[1].gif", cAlternateFileName="COLLEC~1.GIF")) returned 1 [0132.090] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\collect[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\collect[1].gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0132.091] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\collect[1].gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\collect[1].gif.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0132.091] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b [0132.091] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0132.091] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0132.176] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2b, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2b, lpOverlapped=0x0) returned 1 [0132.180] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x30, lpOverlapped=0x0) returned 1 [0132.180] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0132.200] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.210] CloseHandle (hObject=0xf4) returned 1 [0132.210] CloseHandle (hObject=0xe4) returned 1 [0132.210] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\collect[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\collect[1].gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\collect[1].gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\collect[1].gif.dvodltmf")) returned 0 [0132.211] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\collect[1].gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\collect[1].gif.dvodltmf")) returned 0x2020 [0132.211] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\collect[1].gif", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55333bf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x55333bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55333bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="collect[1].gif", cAlternateFileName="COLLEC~1.GIF")) returned 0x2e8598 [0132.211] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55333bf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x55333bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55333bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="collect[1].gif", cAlternateFileName="COLLEC~1.GIF")) returned 0 [0132.211] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0132.211] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\collect[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\collect[1].gif")) returned 1 [0132.212] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\collect[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\collect[1].gif")) returned 0xffffffff [0132.212] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe8f4e10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe8f4e10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe8f4e10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7b1, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="ContainerTag[1].js", cAlternateFileName="CONTAI~1.JS")) returned 1 [0132.212] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ContainerTag[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\containertag[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0132.214] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ContainerTag[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\containertag[1].js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0132.214] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7b1 [0132.215] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0132.215] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0132.310] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x7b1, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x7b1, lpOverlapped=0x0) returned 1 [0132.311] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x7c0, lpOverlapped=0x0) returned 1 [0132.312] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0132.341] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.351] CloseHandle (hObject=0xe4) returned 1 [0132.351] CloseHandle (hObject=0xf4) returned 1 [0132.351] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ContainerTag[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\containertag[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ContainerTag[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\containertag[1].js.dvodltmf")) returned 0 [0132.352] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ContainerTag[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\containertag[1].js.dvodltmf")) returned 0x2020 [0132.352] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ContainerTag[1].js", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe8f4e10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe8f4e10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe8f4e10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7b1, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="ContainerTag[1].js", cAlternateFileName="CONTAI~1.JS")) returned 0x2e8598 [0132.352] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe8f4e10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe8f4e10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe8f4e10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7b1, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="ContainerTag[1].js", cAlternateFileName="CONTAI~1.JS")) returned 0 [0132.352] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0132.352] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ContainerTag[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\containertag[1].js")) returned 1 [0132.353] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ContainerTag[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\containertag[1].js")) returned 0xffffffff [0132.353] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0132.353] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0132.353] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0132.354] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0132.354] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0132.354] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0132.442] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x43, lpOverlapped=0x0) returned 1 [0132.443] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x50, lpOverlapped=0x0) returned 1 [0132.444] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0132.464] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.473] CloseHandle (hObject=0xf4) returned 1 [0132.473] CloseHandle (hObject=0xe4) returned 1 [0132.473] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\desktop.ini.dvodltmf")) returned 0 [0132.474] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\desktop.ini.dvodltmf")) returned 0x2020 [0132.474] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\desktop.ini", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8598 [0132.474] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0132.474] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0132.474] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\desktop.ini")) returned 1 [0132.475] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\desktop.ini")) returned 0xffffffff [0132.475] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60d9a020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60d9a020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60de62e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48ba, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="eula-mac[1].jpg", cAlternateFileName="EULA-M~1.JPG")) returned 1 [0132.475] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\eula-mac[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0132.475] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\eula-mac[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0132.476] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x48ba [0132.476] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0132.476] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0132.560] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x48ba, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x48ba, lpOverlapped=0x0) returned 1 [0132.562] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x48c0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x48c0, lpOverlapped=0x0) returned 1 [0132.563] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0132.583] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.592] CloseHandle (hObject=0xe4) returned 1 [0132.592] CloseHandle (hObject=0xf4) returned 1 [0132.592] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\eula-mac[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\eula-mac[1].jpg.dvodltmf")) returned 0 [0132.593] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\eula-mac[1].jpg.dvodltmf")) returned 0x2020 [0132.593] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60d9a020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60d9a020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60de62e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48ba, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="eula-mac[1].jpg", cAlternateFileName="EULA-M~1.JPG")) returned 0x2e8598 [0132.593] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60d9a020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60d9a020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60de62e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48ba, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="eula-mac[1].jpg", cAlternateFileName="EULA-M~1.JPG")) returned 0 [0132.593] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0132.593] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\eula-mac[1].jpg")) returned 1 [0132.594] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\eula-mac[1].jpg")) returned 0xffffffff [0132.594] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61093ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61093ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61093ba0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa84a, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="ga[1].js", cAlternateFileName="GA_1_~1.JS")) returned 1 [0132.594] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ga[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\ga[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0132.595] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ga[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\ga[1].js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0132.596] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa84a [0132.596] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0132.596] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0132.680] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa84a, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0xa84a, lpOverlapped=0x0) returned 1 [0132.683] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa850, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0xa850, lpOverlapped=0x0) returned 1 [0132.684] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0132.704] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.713] CloseHandle (hObject=0xf4) returned 1 [0132.713] CloseHandle (hObject=0xe4) returned 1 [0132.713] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ga[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\ga[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ga[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\ga[1].js.dvodltmf")) returned 0 [0132.714] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ga[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\ga[1].js.dvodltmf")) returned 0x2020 [0132.714] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ga[1].js", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61093ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61093ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61093ba0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa84a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ga[1].js", cAlternateFileName="GA_1_~1.JS")) returned 0x2e8598 [0132.714] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61093ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61093ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61093ba0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa84a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ga[1].js", cAlternateFileName="GA_1_~1.JS")) returned 0 [0132.714] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0132.714] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ga[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\ga[1].js")) returned 1 [0132.715] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ga[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\ga[1].js")) returned 0xffffffff [0132.715] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe15e7f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe15e7f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe1f6d70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1305, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1D;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1]", cAlternateFileName="GETYPE~1")) returned 1 [0132.718] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x659c6020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x659c6020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65c99a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6c, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="GoogleInstaller_de[1].application", cAlternateFileName="GOOGLE~1.APP")) returned 1 [0132.718] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\GoogleInstaller_de[1].application" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\googleinstaller_de[1].application"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0132.718] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\GoogleInstaller_de[1].application.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\googleinstaller_de[1].application.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0132.719] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe6c [0132.719] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0132.719] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0132.804] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe6c, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0xe6c, lpOverlapped=0x0) returned 1 [0132.805] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0xe70, lpOverlapped=0x0) returned 1 [0132.806] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0132.825] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.835] CloseHandle (hObject=0xe4) returned 1 [0132.835] CloseHandle (hObject=0xf4) returned 1 [0132.835] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\GoogleInstaller_de[1].application" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\googleinstaller_de[1].application"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\GoogleInstaller_de[1].application.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\googleinstaller_de[1].application.dvodltmf")) returned 0 [0132.836] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\GoogleInstaller_de[1].application.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\googleinstaller_de[1].application.dvodltmf")) returned 0x2020 [0132.836] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\GoogleInstaller_de[1].application", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x659c6020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x659c6020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65c99a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="GoogleInstaller_de[1].application", cAlternateFileName="GOOGLE~1.APP")) returned 0x2e8598 [0132.836] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x659c6020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x659c6020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65c99a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="GoogleInstaller_de[1].application", cAlternateFileName="GOOGLE~1.APP")) returned 0 [0132.836] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0132.836] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\GoogleInstaller_de[1].application" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\googleinstaller_de[1].application")) returned 1 [0132.837] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\GoogleInstaller_de[1].application" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\googleinstaller_de[1].application")) returned 0xffffffff [0132.837] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf03f170, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf03f170, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf0652d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x4c9, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="js[1]", cAlternateFileName="JS_1_~1")) returned 1 [0132.837] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2544b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf2544b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf2544b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x562, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="js[2]", cAlternateFileName="JS_2_~1")) returned 1 [0132.837] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54feddb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54feddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x550601d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7a43, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="latest[1].eot", cAlternateFileName="LATEST~1.EOT")) returned 1 [0132.837] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\latest[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\latest[1].eot"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0132.838] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\latest[1].eot.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\latest[1].eot.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0132.838] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7a43 [0132.838] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0132.838] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0132.922] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x7a43, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x7a43, lpOverlapped=0x0) returned 1 [0132.924] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x7a50, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x7a50, lpOverlapped=0x0) returned 1 [0132.925] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0132.945] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.954] CloseHandle (hObject=0xf4) returned 1 [0132.954] CloseHandle (hObject=0xe4) returned 1 [0132.954] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\latest[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\latest[1].eot"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\latest[1].eot.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\latest[1].eot.dvodltmf")) returned 0 [0132.955] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\latest[1].eot.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\latest[1].eot.dvodltmf")) returned 0x2020 [0132.955] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\latest[1].eot", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54feddb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54feddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x550601d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7a43, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="latest[1].eot", cAlternateFileName="LATEST~1.EOT")) returned 0x2e8598 [0132.955] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54feddb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54feddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x550601d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7a43, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="latest[1].eot", cAlternateFileName="LATEST~1.EOT")) returned 0 [0132.955] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0132.956] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\latest[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\latest[1].eot")) returned 1 [0132.957] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\latest[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\latest[1].eot")) returned 0xffffffff [0132.957] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54cce0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54cce0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54d1a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a114, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="MemMDL2.2.17[1].eot", cAlternateFileName="MEMMDL~1.EOT")) returned 1 [0132.957] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MemMDL2.2.17[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\memmdl2.2.17[1].eot"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0132.957] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MemMDL2.2.17[1].eot.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\memmdl2.2.17[1].eot.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0132.957] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a114 [0132.957] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0132.958] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0133.043] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1a114, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1a114, lpOverlapped=0x0) returned 1 [0133.046] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1a120, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1a120, lpOverlapped=0x0) returned 1 [0133.048] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0133.068] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.077] CloseHandle (hObject=0xe4) returned 1 [0133.077] CloseHandle (hObject=0xf4) returned 1 [0133.077] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MemMDL2.2.17[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\memmdl2.2.17[1].eot"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MemMDL2.2.17[1].eot.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\memmdl2.2.17[1].eot.dvodltmf")) returned 0 [0133.079] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MemMDL2.2.17[1].eot.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\memmdl2.2.17[1].eot.dvodltmf")) returned 0x2020 [0133.079] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MemMDL2.2.17[1].eot", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54cce0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54cce0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54d1a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a114, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="MemMDL2.2.17[1].eot", cAlternateFileName="MEMMDL~1.EOT")) returned 0x2e8598 [0133.079] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54cce0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54cce0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54d1a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a114, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="MemMDL2.2.17[1].eot", cAlternateFileName="MEMMDL~1.EOT")) returned 0 [0133.079] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0133.079] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MemMDL2.2.17[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\memmdl2.2.17[1].eot")) returned 1 [0133.080] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MemMDL2.2.17[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\memmdl2.2.17[1].eot")) returned 0xffffffff [0133.080] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605b7740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605b7740, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605b7740, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x46c9, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="modernizr[1].js", cAlternateFileName="MODERN~1.JS")) returned 1 [0133.080] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\modernizr[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\modernizr[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0133.081] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\modernizr[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\modernizr[1].js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0133.082] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46c9 [0133.082] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0133.082] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0133.164] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x46c9, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x46c9, lpOverlapped=0x0) returned 1 [0133.166] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x46d0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x46d0, lpOverlapped=0x0) returned 1 [0133.167] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0133.187] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.196] CloseHandle (hObject=0xf4) returned 1 [0133.196] CloseHandle (hObject=0xe4) returned 1 [0133.197] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\modernizr[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\modernizr[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\modernizr[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\modernizr[1].js.dvodltmf")) returned 0 [0133.197] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\modernizr[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\modernizr[1].js.dvodltmf")) returned 0x2020 [0133.197] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\modernizr[1].js", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605b7740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605b7740, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605b7740, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x46c9, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="modernizr[1].js", cAlternateFileName="MODERN~1.JS")) returned 0x2e8598 [0133.198] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605b7740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605b7740, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605b7740, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x46c9, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="modernizr[1].js", cAlternateFileName="MODERN~1.JS")) returned 0 [0133.198] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0133.198] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\modernizr[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\modernizr[1].js")) returned 1 [0133.199] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\modernizr[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\modernizr[1].js")) returned 0xffffffff [0133.199] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xec5, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="MSNIdSync[1].js", cAlternateFileName="MSNIDS~1.JS")) returned 1 [0133.199] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MSNIdSync[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\msnidsync[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0133.199] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MSNIdSync[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\msnidsync[1].js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0133.199] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xec5 [0133.199] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0133.200] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0133.300] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xec5, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0xec5, lpOverlapped=0x0) returned 1 [0133.304] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0xed0, lpOverlapped=0x0) returned 1 [0133.306] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0133.329] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.338] CloseHandle (hObject=0xe4) returned 1 [0133.339] CloseHandle (hObject=0xf4) returned 1 [0133.339] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MSNIdSync[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\msnidsync[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MSNIdSync[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\msnidsync[1].js.dvodltmf")) returned 0 [0133.341] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MSNIdSync[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\msnidsync[1].js.dvodltmf")) returned 0x2020 [0133.341] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MSNIdSync[1].js", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xec5, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="MSNIdSync[1].js", cAlternateFileName="MSNIDS~1.JS")) returned 0x2e8598 [0133.341] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xec5, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="MSNIdSync[1].js", cAlternateFileName="MSNIDS~1.JS")) returned 0 [0133.341] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0133.341] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MSNIdSync[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\msnidsync[1].js")) returned 1 [0133.342] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MSNIdSync[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\msnidsync[1].js")) returned 0xffffffff [0133.343] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfbb3b50, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfbb3b50, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfbb3b50, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="only[1].htm", cAlternateFileName="ONLY_1~1.HTM")) returned 1 [0133.343] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\only[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\only[1].htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0133.353] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\only[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\only[1].htm.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0133.354] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0133.354] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0133.355] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0133.456] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x10, lpOverlapped=0x0) returned 1 [0133.458] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0133.477] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.487] CloseHandle (hObject=0xf4) returned 1 [0133.487] CloseHandle (hObject=0xe4) returned 1 [0133.487] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\only[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\only[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\only[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\only[1].htm.dvodltmf")) returned 0 [0133.488] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\only[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\only[1].htm.dvodltmf")) returned 0x2020 [0133.488] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\only[1].htm", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfbb3b50, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfbb3b50, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfbb3b50, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="only[1].htm", cAlternateFileName="ONLY_1~1.HTM")) returned 0x2e8598 [0133.488] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfbb3b50, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfbb3b50, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfbb3b50, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="only[1].htm", cAlternateFileName="ONLY_1~1.HTM")) returned 0 [0133.488] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0133.488] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\only[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\only[1].htm")) returned 1 [0133.489] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\only[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\only[1].htm")) returned 0xffffffff [0133.489] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x6b6d, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="player[1].js", cAlternateFileName="PLAYER~1.JS")) returned 1 [0133.489] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\player[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0133.489] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\player[1].js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0133.490] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6b6d [0133.490] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0133.490] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0133.574] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x6b6d, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x6b6d, lpOverlapped=0x0) returned 1 [0133.576] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x6b70, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x6b70, lpOverlapped=0x0) returned 1 [0133.578] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0133.597] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.606] CloseHandle (hObject=0xe4) returned 1 [0133.606] CloseHandle (hObject=0xf4) returned 1 [0133.607] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\player[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\player[1].js.dvodltmf")) returned 0 [0133.607] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\player[1].js.dvodltmf")) returned 0x2020 [0133.607] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[1].js", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x6b6d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="player[1].js", cAlternateFileName="PLAYER~1.JS")) returned 0x2e8598 [0133.608] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x6b6d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="player[1].js", cAlternateFileName="PLAYER~1.JS")) returned 0 [0133.608] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0133.608] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\player[1].js")) returned 1 [0133.609] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\player[1].js")) returned 0xffffffff [0133.609] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x5f44, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="player[2].js", cAlternateFileName="PLAYER~2.JS")) returned 1 [0133.609] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[2].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\player[2].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0133.609] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[2].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\player[2].js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0133.610] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5f44 [0133.610] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0133.610] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0133.696] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x5f44, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x5f44, lpOverlapped=0x0) returned 1 [0133.698] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x5f50, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x5f50, lpOverlapped=0x0) returned 1 [0133.699] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0133.719] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.728] CloseHandle (hObject=0xf4) returned 1 [0133.728] CloseHandle (hObject=0xe4) returned 1 [0133.728] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[2].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\player[2].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[2].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\player[2].js.dvodltmf")) returned 0 [0133.729] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[2].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\player[2].js.dvodltmf")) returned 0x2020 [0133.729] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[2].js", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x5f44, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="player[2].js", cAlternateFileName="PLAYER~2.JS")) returned 0x2e8598 [0133.730] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x5f44, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="player[2].js", cAlternateFileName="PLAYER~2.JS")) returned 0 [0133.730] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0133.730] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[2].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\player[2].js")) returned 1 [0133.731] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[2].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\player[2].js")) returned 0xffffffff [0133.731] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfb41730, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfb41730, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfb41730, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x67, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="tecjslog[1].png", cAlternateFileName="TECJSL~1.PNG")) returned 1 [0133.731] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\tecjslog[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0133.731] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\tecjslog[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0133.731] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x67 [0133.731] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0133.732] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0133.847] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x67, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x67, lpOverlapped=0x0) returned 1 [0133.854] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x70, lpOverlapped=0x0) returned 1 [0133.860] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0133.879] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.888] CloseHandle (hObject=0xe4) returned 1 [0133.888] CloseHandle (hObject=0xf4) returned 1 [0133.888] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\tecjslog[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\tecjslog[1].png.dvodltmf")) returned 0 [0133.891] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\tecjslog[1].png.dvodltmf")) returned 0x2020 [0133.891] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfb41730, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfb41730, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfb41730, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x67, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="tecjslog[1].png", cAlternateFileName="TECJSL~1.PNG")) returned 0x2e8598 [0133.891] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfb41730, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfb41730, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfb41730, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x67, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="tecjslog[1].png", cAlternateFileName="TECJSL~1.PNG")) returned 0 [0133.891] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0133.891] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\tecjslog[1].png")) returned 1 [0133.892] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\tecjslog[1].png")) returned 0xffffffff [0133.892] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x692027e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x692027e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69232580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x805a, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="thankyou[1].htm", cAlternateFileName="THANKY~1.HTM")) returned 1 [0133.892] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\thankyou[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\thankyou[1].htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0133.893] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\thankyou[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\thankyou[1].htm.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0133.894] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x805a [0133.894] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0133.894] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0133.981] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x805a, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x805a, lpOverlapped=0x0) returned 1 [0133.983] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x8060, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x8060, lpOverlapped=0x0) returned 1 [0133.985] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0134.004] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0134.013] CloseHandle (hObject=0xf4) returned 1 [0134.013] CloseHandle (hObject=0xe4) returned 1 [0134.014] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\thankyou[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\thankyou[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\thankyou[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\thankyou[1].htm.dvodltmf")) returned 0 [0134.015] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\thankyou[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\thankyou[1].htm.dvodltmf")) returned 0x2020 [0134.015] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\thankyou[1].htm", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x692027e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x692027e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69232580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x805a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="thankyou[1].htm", cAlternateFileName="THANKY~1.HTM")) returned 0x2e8598 [0134.015] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x692027e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x692027e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69232580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x805a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="thankyou[1].htm", cAlternateFileName="THANKY~1.HTM")) returned 0 [0134.015] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0134.015] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\thankyou[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\thankyou[1].htm")) returned 1 [0134.016] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\thankyou[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\thankyou[1].htm")) returned 0xffffffff [0134.016] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55c14b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x55c14b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55c14b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x911, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="th[1].jpg", cAlternateFileName="TH_1_~1.JPG")) returned 1 [0134.016] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\th[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0134.017] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\th[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0134.017] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x911 [0134.017] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0134.017] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0134.101] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x911, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x911, lpOverlapped=0x0) returned 1 [0134.103] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x920, lpOverlapped=0x0) returned 1 [0134.104] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0134.124] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0134.133] CloseHandle (hObject=0xe4) returned 1 [0134.133] CloseHandle (hObject=0xf4) returned 1 [0134.133] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\th[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\th[1].jpg.dvodltmf")) returned 0 [0134.134] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\th[1].jpg.dvodltmf")) returned 0x2020 [0134.134] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55c14b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x55c14b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55c14b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x911, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="th[1].jpg", cAlternateFileName="TH_1_~1.JPG")) returned 0x2e8598 [0134.134] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55c14b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x55c14b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55c14b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x911, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="th[1].jpg", cAlternateFileName="TH_1_~1.JPG")) returned 0 [0134.134] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0134.134] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\th[1].jpg")) returned 1 [0134.135] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\th[1].jpg")) returned 0xffffffff [0134.135] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55c14b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x55c14b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55c14b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x911, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="th[1].jpg", cAlternateFileName="TH_1_~1.JPG")) returned 0 [0134.135] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0134.136] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x54000, dwReserved0=0x6d74682e, dwReserved1=0x746f652e, cFileName="index.dat", cAlternateFileName="")) returned 1 [0134.136] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0134.136] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\index.dat.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0134.136] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x54000 [0134.136] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0134.137] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0134.220] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x54000, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x54000, lpOverlapped=0x0) returned 1 [0134.227] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x54010, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x54010, lpOverlapped=0x0) returned 1 [0134.234] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0134.253] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0134.262] CloseHandle (hObject=0xe0) returned 1 [0134.262] CloseHandle (hObject=0xf4) returned 1 [0134.262] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\index.dat.dvodltmf")) returned 0 [0134.263] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\index.dat.dvodltmf")) returned 0x2020 [0134.264] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\index.dat", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x54000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0x2e8558 [0134.264] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x54000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0 [0134.264] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0134.264] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\index.dat")) returned 1 [0134.267] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\index.dat")) returned 0xffffffff [0134.267] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YG1R61Z8", cAlternateFileName="")) returned 1 [0134.267] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0134.270] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.272] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe967230, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe967230, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7f7e, dwReserved0=0xe0, dwReserved1=0x0, cFileName="0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", cAlternateFileName="0FF929~1.JPG")) returned 1 [0134.272] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0134.272] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0134.276] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7f7e [0134.276] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0134.276] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0134.435] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x7f7e, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x7f7e, lpOverlapped=0x0) returned 1 [0134.526] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x7f80, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x7f80, lpOverlapped=0x0) returned 1 [0134.527] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0134.547] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0134.556] CloseHandle (hObject=0xe0) returned 1 [0134.556] CloseHandle (hObject=0xe4) returned 1 [0134.556] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg.dvodltmf")) returned 0 [0134.557] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg.dvodltmf")) returned 0x2020 [0134.557] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe967230, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe967230, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7f7e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", cAlternateFileName="0FF929~1.JPG")) returned 0x2e8598 [0134.558] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe967230, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe967230, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7f7e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", cAlternateFileName="0FF929~1.JPG")) returned 0 [0134.558] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0134.558] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg")) returned 1 [0134.559] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg")) returned 0xffffffff [0134.559] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54a20810, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54a20810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54a46970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc05f, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="26158[1].png", cAlternateFileName="26158_~1.PNG")) returned 1 [0134.559] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\26158[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0134.560] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\26158[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0134.560] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc05f [0134.560] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0134.561] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0134.715] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xc05f, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0xc05f, lpOverlapped=0x0) returned 1 [0134.718] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc060, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0xc060, lpOverlapped=0x0) returned 1 [0134.730] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0134.750] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0134.760] CloseHandle (hObject=0xe4) returned 1 [0134.760] CloseHandle (hObject=0xe0) returned 1 [0134.760] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\26158[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\26158[1].png.dvodltmf")) returned 0 [0134.761] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\26158[1].png.dvodltmf")) returned 0x2020 [0134.761] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54a20810, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54a20810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54a46970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc05f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="26158[1].png", cAlternateFileName="26158_~1.PNG")) returned 0x2e8598 [0134.761] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54a20810, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54a20810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54a46970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc05f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="26158[1].png", cAlternateFileName="26158_~1.PNG")) returned 0 [0134.761] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0134.761] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\26158[1].png")) returned 1 [0134.763] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\26158[1].png")) returned 0xffffffff [0134.763] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458eefb0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458eefb0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458eefb0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3e3, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AA42x3V[1].png", cAlternateFileName="AA42X3~1.PNG")) returned 1 [0134.763] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa42x3v[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0134.763] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa42x3v[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0134.764] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e3 [0134.764] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0134.765] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0134.850] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3e3, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x3e3, lpOverlapped=0x0) returned 1 [0134.852] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x3f0, lpOverlapped=0x0) returned 1 [0134.853] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0134.872] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0134.882] CloseHandle (hObject=0xe0) returned 1 [0134.882] CloseHandle (hObject=0xe4) returned 1 [0134.882] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa42x3v[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa42x3v[1].png.dvodltmf")) returned 0 [0134.883] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa42x3v[1].png.dvodltmf")) returned 0x2020 [0134.883] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458eefb0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458eefb0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458eefb0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3e3, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AA42x3V[1].png", cAlternateFileName="AA42X3~1.PNG")) returned 0x2e8598 [0134.883] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458eefb0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458eefb0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458eefb0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3e3, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AA42x3V[1].png", cAlternateFileName="AA42X3~1.PNG")) returned 0 [0134.883] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0134.883] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa42x3v[1].png")) returned 1 [0134.884] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa42x3v[1].png")) returned 0xffffffff [0134.884] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5341bc90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5341bc90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5341bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1d0, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AA58NQj[1].png", cAlternateFileName="AA58NQ~1.PNG")) returned 1 [0134.884] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa58nqj[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0134.884] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa58nqj[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0134.885] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d0 [0134.885] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0134.885] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0134.969] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1d0, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1d0, lpOverlapped=0x0) returned 1 [0134.970] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1e0, lpOverlapped=0x0) returned 1 [0134.971] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0134.991] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.000] CloseHandle (hObject=0xe4) returned 1 [0135.000] CloseHandle (hObject=0xe0) returned 1 [0135.001] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa58nqj[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa58nqj[1].png.dvodltmf")) returned 0 [0135.001] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa58nqj[1].png.dvodltmf")) returned 0x2020 [0135.001] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5341bc90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5341bc90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5341bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1d0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AA58NQj[1].png", cAlternateFileName="AA58NQ~1.PNG")) returned 0x2e8598 [0135.001] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5341bc90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5341bc90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5341bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1d0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AA58NQj[1].png", cAlternateFileName="AA58NQ~1.PNG")) returned 0 [0135.002] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0135.002] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa58nqj[1].png")) returned 1 [0135.002] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa58nqj[1].png")) returned 0xffffffff [0135.003] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AA61Ofl[1].png", cAlternateFileName="AA61OF~1.PNG")) returned 1 [0135.003] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa61ofl[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0135.003] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa61ofl[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0135.003] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c4 [0135.003] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0135.004] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0135.088] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1c4, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1c4, lpOverlapped=0x0) returned 1 [0135.089] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1d0, lpOverlapped=0x0) returned 1 [0135.090] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0135.110] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.119] CloseHandle (hObject=0xe0) returned 1 [0135.119] CloseHandle (hObject=0xe4) returned 1 [0135.119] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa61ofl[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa61ofl[1].png.dvodltmf")) returned 0 [0135.120] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa61ofl[1].png.dvodltmf")) returned 0x2020 [0135.120] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AA61Ofl[1].png", cAlternateFileName="AA61OF~1.PNG")) returned 0x2e8598 [0135.120] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AA61Ofl[1].png", cAlternateFileName="AA61OF~1.PNG")) returned 0 [0135.120] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0135.121] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa61ofl[1].png")) returned 1 [0135.121] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa61ofl[1].png")) returned 0xffffffff [0135.121] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AA6SFRQ[2].png", cAlternateFileName="AA6SFR~2.PNG")) returned 1 [0135.122] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa6sfrq[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0135.122] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa6sfrq[2].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0135.122] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ed [0135.122] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0135.123] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0135.206] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2ed, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2ed, lpOverlapped=0x0) returned 1 [0135.208] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2f0, lpOverlapped=0x0) returned 1 [0135.209] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0135.228] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.237] CloseHandle (hObject=0xe4) returned 1 [0135.237] CloseHandle (hObject=0xe0) returned 1 [0135.237] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa6sfrq[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa6sfrq[2].png.dvodltmf")) returned 0 [0135.238] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa6sfrq[2].png.dvodltmf")) returned 0x2020 [0135.238] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AA6SFRQ[2].png", cAlternateFileName="AA6SFR~2.PNG")) returned 0x2e8598 [0135.239] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AA6SFRQ[2].png", cAlternateFileName="AA6SFR~2.PNG")) returned 0 [0135.239] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0135.239] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa6sfrq[2].png")) returned 1 [0135.240] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa6sfrq[2].png")) returned 0xffffffff [0135.240] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4580a770, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4580a770, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4580a770, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AAa1vhm[1].png", cAlternateFileName="AAA1VH~1.PNG")) returned 1 [0135.240] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1vhm[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0135.240] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1vhm[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0135.240] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19e [0135.240] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0135.241] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0135.325] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x19e, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x19e, lpOverlapped=0x0) returned 1 [0135.327] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1a0, lpOverlapped=0x0) returned 1 [0135.328] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0135.347] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.363] CloseHandle (hObject=0xe0) returned 1 [0135.363] CloseHandle (hObject=0xe4) returned 1 [0135.363] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1vhm[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1vhm[1].png.dvodltmf")) returned 0 [0135.364] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1vhm[1].png.dvodltmf")) returned 0x2020 [0135.364] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4580a770, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4580a770, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4580a770, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AAa1vhm[1].png", cAlternateFileName="AAA1VH~1.PNG")) returned 0x2e8598 [0135.364] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4580a770, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4580a770, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4580a770, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AAa1vhm[1].png", cAlternateFileName="AAA1VH~1.PNG")) returned 0 [0135.364] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0135.364] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1vhm[1].png")) returned 1 [0135.365] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1vhm[1].png")) returned 0xffffffff [0135.365] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53846310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53846310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53846310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AAa1xJF[1].png", cAlternateFileName="AAA1XJ~1.PNG")) returned 1 [0135.365] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1xjf[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0135.366] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1xjf[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0135.366] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c1 [0135.366] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0135.366] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0135.462] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2c1, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2c1, lpOverlapped=0x0) returned 1 [0135.463] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2d0, lpOverlapped=0x0) returned 1 [0135.464] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0135.485] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.494] CloseHandle (hObject=0xe4) returned 1 [0135.494] CloseHandle (hObject=0xe0) returned 1 [0135.494] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1xjf[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1xjf[1].png.dvodltmf")) returned 0 [0135.495] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1xjf[1].png.dvodltmf")) returned 0x2020 [0135.495] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53846310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53846310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53846310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AAa1xJF[1].png", cAlternateFileName="AAA1XJ~1.PNG")) returned 0x2e8598 [0135.495] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53846310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53846310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53846310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AAa1xJF[1].png", cAlternateFileName="AAA1XJ~1.PNG")) returned 0 [0135.495] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0135.495] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1xjf[1].png")) returned 1 [0135.496] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1xjf[1].png")) returned 0xffffffff [0135.496] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5159c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5159c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5159c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7b8, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AAlG41q[1].jpg", cAlternateFileName="AALG41~1.JPG")) returned 1 [0135.496] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aalg41q[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0135.497] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aalg41q[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0135.497] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7b8 [0135.497] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0135.498] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0135.581] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x7b8, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x7b8, lpOverlapped=0x0) returned 1 [0135.583] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x7c0, lpOverlapped=0x0) returned 1 [0135.584] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0135.603] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.612] CloseHandle (hObject=0xe0) returned 1 [0135.612] CloseHandle (hObject=0xe4) returned 1 [0135.613] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aalg41q[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aalg41q[1].jpg.dvodltmf")) returned 0 [0135.613] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aalg41q[1].jpg.dvodltmf")) returned 0x2020 [0135.613] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5159c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5159c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5159c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7b8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AAlG41q[1].jpg", cAlternateFileName="AALG41~1.JPG")) returned 0x2e8598 [0135.614] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5159c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5159c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5159c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7b8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AAlG41q[1].jpg", cAlternateFileName="AALG41~1.JPG")) returned 0 [0135.614] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0135.614] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aalg41q[1].jpg")) returned 1 [0135.615] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aalg41q[1].jpg")) returned 0xffffffff [0135.615] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x157, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AAmin0Z[1].png", cAlternateFileName="AAMIN0~1.PNG")) returned 1 [0135.615] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aamin0z[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0135.615] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aamin0z[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0135.615] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x157 [0135.616] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0135.616] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0135.700] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x157, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x157, lpOverlapped=0x0) returned 1 [0135.702] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x160, lpOverlapped=0x0) returned 1 [0135.703] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0135.722] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.733] CloseHandle (hObject=0xe4) returned 1 [0135.733] CloseHandle (hObject=0xe0) returned 1 [0135.733] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aamin0z[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aamin0z[1].png.dvodltmf")) returned 0 [0135.734] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aamin0z[1].png.dvodltmf")) returned 0x2020 [0135.734] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x157, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AAmin0Z[1].png", cAlternateFileName="AAMIN0~1.PNG")) returned 0x2e8598 [0135.734] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x157, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AAmin0Z[1].png", cAlternateFileName="AAMIN0~1.PNG")) returned 0 [0135.735] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0135.735] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aamin0z[1].png")) returned 1 [0135.735] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aamin0z[1].png")) returned 0xffffffff [0135.736] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533f5b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533f5b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5341bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36b1, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="AAnhRyj[1].jpg", cAlternateFileName="AANHRY~1.JPG")) returned 1 [0135.736] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aanhryj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0135.736] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aanhryj[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0135.736] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x36b1 [0135.736] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0135.737] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0135.828] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x36b1, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x36b1, lpOverlapped=0x0) returned 1 [0135.830] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x36c0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x36c0, lpOverlapped=0x0) returned 1 [0135.831] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0135.850] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.860] CloseHandle (hObject=0xe0) returned 1 [0135.860] CloseHandle (hObject=0xe4) returned 1 [0135.860] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aanhryj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aanhryj[1].jpg.dvodltmf")) returned 0 [0135.861] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aanhryj[1].jpg.dvodltmf")) returned 0x2020 [0135.861] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533f5b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533f5b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5341bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36b1, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AAnhRyj[1].jpg", cAlternateFileName="AANHRY~1.JPG")) returned 0x2e8598 [0135.861] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533f5b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533f5b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5341bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36b1, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AAnhRyj[1].jpg", cAlternateFileName="AANHRY~1.JPG")) returned 0 [0135.861] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0135.861] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aanhryj[1].jpg")) returned 1 [0135.862] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aanhryj[1].jpg")) returned 0xffffffff [0135.862] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c161a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64c161a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64e9d900, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x39f, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", cAlternateFileName="ACTIVI~1.HTM")) returned 1 [0135.862] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\activityi;src=2542116;cat=chrom00;type=clien612;ord=2366422437621[1].htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0135.863] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\activityi;src=2542116;cat=chrom00;type=clien612;ord=2366422437621[1].htm.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0135.864] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x39f [0135.864] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0135.864] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0135.950] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x39f, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x39f, lpOverlapped=0x0) returned 1 [0135.951] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x3a0, lpOverlapped=0x0) returned 1 [0135.952] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0135.971] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.982] CloseHandle (hObject=0xe4) returned 1 [0135.982] CloseHandle (hObject=0xe0) returned 1 [0135.983] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\activityi;src=2542116;cat=chrom00;type=clien612;ord=2366422437621[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\activityi;src=2542116;cat=chrom00;type=clien612;ord=2366422437621[1].htm.dvodltmf")) returned 0 [0135.983] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\activityi;src=2542116;cat=chrom00;type=clien612;ord=2366422437621[1].htm.dvodltmf")) returned 0x2020 [0135.983] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c161a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64c161a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64e9d900, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x39f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", cAlternateFileName="ACTIVI~1.HTM")) returned 0x2e8598 [0135.984] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c161a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64c161a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64e9d900, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x39f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", cAlternateFileName="ACTIVI~1.HTM")) returned 0 [0135.984] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0135.984] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\activityi")) returned 0 [0135.984] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\activityi;src=2542116;cat=chrom00;type=clien612;ord=2366422437621[1].htm")) returned 0x2020 [0135.984] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2eca30, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf2eca30, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf312b90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x91dd, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="adex[1].js", cAlternateFileName="ADEX_1~1.JS")) returned 1 [0135.984] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adex[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0135.984] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adex[1].js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0135.985] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x91dd [0135.985] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0135.985] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0136.074] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x91dd, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x91dd, lpOverlapped=0x0) returned 1 [0136.076] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x91e0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x91e0, lpOverlapped=0x0) returned 1 [0136.077] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0136.097] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.106] CloseHandle (hObject=0xe0) returned 1 [0136.106] CloseHandle (hObject=0xe4) returned 1 [0136.107] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adex[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adex[1].js.dvodltmf")) returned 0 [0136.107] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adex[1].js.dvodltmf")) returned 0x2020 [0136.107] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2eca30, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf2eca30, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf312b90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x91dd, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="adex[1].js", cAlternateFileName="ADEX_1~1.JS")) returned 0x2e8598 [0136.108] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2eca30, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf2eca30, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf312b90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x91dd, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="adex[1].js", cAlternateFileName="ADEX_1~1.JS")) returned 0 [0136.108] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0136.108] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adex[1].js")) returned 1 [0136.109] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adex[1].js")) returned 0xffffffff [0136.109] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x540e72d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540e72d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x540e72d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2874, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="adfscript[1]", cAlternateFileName="ADFSCR~1")) returned 1 [0136.109] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdb6b0f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbdb6b0f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdb6b0f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x525b, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="adsWrapperMSNI[1].js", cAlternateFileName="ADSWRA~1.JS")) returned 1 [0136.109] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adswrappermsni[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0136.109] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adswrappermsni[1].js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0136.110] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x525b [0136.110] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0136.110] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0136.194] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x525b, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x525b, lpOverlapped=0x0) returned 1 [0136.196] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x5260, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x5260, lpOverlapped=0x0) returned 1 [0136.197] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0136.217] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.226] CloseHandle (hObject=0xe4) returned 1 [0136.226] CloseHandle (hObject=0xe0) returned 1 [0136.226] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adswrappermsni[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adswrappermsni[1].js.dvodltmf")) returned 0 [0136.227] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adswrappermsni[1].js.dvodltmf")) returned 0x2020 [0136.227] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdb6b0f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbdb6b0f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdb6b0f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x525b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="adsWrapperMSNI[1].js", cAlternateFileName="ADSWRA~1.JS")) returned 0x2e8598 [0136.227] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdb6b0f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbdb6b0f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdb6b0f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x525b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="adsWrapperMSNI[1].js", cAlternateFileName="ADSWRA~1.JS")) returned 0 [0136.227] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0136.227] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adswrappermsni[1].js")) returned 1 [0136.228] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adswrappermsni[1].js")) returned 0xffffffff [0136.228] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe967230, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe967230, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8217, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg", cAlternateFileName="AE8E98~1.JPG")) returned 1 [0136.228] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0136.229] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0136.230] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8217 [0136.230] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0136.230] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0136.314] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x8217, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x8217, lpOverlapped=0x0) returned 1 [0136.317] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x8220, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x8220, lpOverlapped=0x0) returned 1 [0136.318] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0136.338] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.347] CloseHandle (hObject=0xe0) returned 1 [0136.347] CloseHandle (hObject=0xe4) returned 1 [0136.347] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg.dvodltmf")) returned 0 [0136.348] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg.dvodltmf")) returned 0x2020 [0136.348] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe967230, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe967230, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8217, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg", cAlternateFileName="AE8E98~1.JPG")) returned 0x2e8598 [0136.348] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe967230, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe967230, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8217, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg", cAlternateFileName="AE8E98~1.JPG")) returned 0 [0136.348] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0136.348] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg")) returned 1 [0136.349] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg")) returned 0xffffffff [0136.349] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe112530, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe112530, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe15e7f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1183b, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="ast[1].js", cAlternateFileName="AST_1_~1.JS")) returned 1 [0136.350] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ast[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0136.350] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ast[1].js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0136.350] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1183b [0136.350] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0136.351] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0136.457] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1183b, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1183b, lpOverlapped=0x0) returned 1 [0136.460] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x11840, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x11840, lpOverlapped=0x0) returned 1 [0136.462] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0136.482] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.491] CloseHandle (hObject=0xe4) returned 1 [0136.491] CloseHandle (hObject=0xe0) returned 1 [0136.491] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ast[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ast[1].js.dvodltmf")) returned 0 [0136.492] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ast[1].js.dvodltmf")) returned 0x2020 [0136.492] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe112530, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe112530, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe15e7f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1183b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ast[1].js", cAlternateFileName="AST_1_~1.JS")) returned 0x2e8598 [0136.492] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe112530, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe112530, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe15e7f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1183b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ast[1].js", cAlternateFileName="AST_1_~1.JS")) returned 0 [0136.492] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0136.492] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ast[1].js")) returned 1 [0136.494] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ast[1].js")) returned 0xffffffff [0136.494] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58798580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58798580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x58798580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13a9, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="autotrack[1].js", cAlternateFileName="AUTOTR~1.JS")) returned 1 [0136.494] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\autotrack[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0136.495] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\autotrack[1].js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0136.495] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13a9 [0136.496] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0136.496] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0136.586] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x13a9, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x13a9, lpOverlapped=0x0) returned 1 [0136.588] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x13b0, lpOverlapped=0x0) returned 1 [0136.589] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0136.608] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.618] CloseHandle (hObject=0xe0) returned 1 [0136.618] CloseHandle (hObject=0xe4) returned 1 [0136.618] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\autotrack[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\autotrack[1].js.dvodltmf")) returned 0 [0136.619] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\autotrack[1].js.dvodltmf")) returned 0x2020 [0136.619] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58798580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58798580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x58798580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13a9, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="autotrack[1].js", cAlternateFileName="AUTOTR~1.JS")) returned 0x2e8598 [0136.619] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58798580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58798580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x58798580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13a9, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="autotrack[1].js", cAlternateFileName="AUTOTR~1.JS")) returned 0 [0136.619] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0136.619] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\autotrack[1].js")) returned 1 [0136.620] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\autotrack[1].js")) returned 0xffffffff [0136.620] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x145, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BB56XTo[1].png", cAlternateFileName="BB56XT~1.PNG")) returned 1 [0136.620] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb56xto[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0136.620] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb56xto[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0136.621] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x145 [0136.621] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0136.621] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0136.706] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x145, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x145, lpOverlapped=0x0) returned 1 [0136.708] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x150, lpOverlapped=0x0) returned 1 [0136.709] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0136.729] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.738] CloseHandle (hObject=0xe4) returned 1 [0136.738] CloseHandle (hObject=0xe0) returned 1 [0136.738] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb56xto[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb56xto[1].png.dvodltmf")) returned 0 [0136.739] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb56xto[1].png.dvodltmf")) returned 0x2020 [0136.739] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x145, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BB56XTo[1].png", cAlternateFileName="BB56XT~1.PNG")) returned 0x2e8598 [0136.739] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x145, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BB56XTo[1].png", cAlternateFileName="BB56XT~1.PNG")) returned 0 [0136.739] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0136.739] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb56xto[1].png")) returned 1 [0136.740] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb56xto[1].png")) returned 0xffffffff [0136.740] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1b6, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BB5vO0g[1].png", cAlternateFileName="BB5VO0~1.PNG")) returned 1 [0136.740] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb5vo0g[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0136.741] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb5vo0g[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0136.741] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b6 [0136.741] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0136.742] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0136.826] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1b6, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1b6, lpOverlapped=0x0) returned 1 [0136.827] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1c0, lpOverlapped=0x0) returned 1 [0136.828] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0136.847] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.857] CloseHandle (hObject=0xe0) returned 1 [0136.857] CloseHandle (hObject=0xe4) returned 1 [0136.857] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb5vo0g[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb5vo0g[1].png.dvodltmf")) returned 0 [0136.858] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb5vo0g[1].png.dvodltmf")) returned 0x2020 [0136.858] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1b6, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BB5vO0g[1].png", cAlternateFileName="BB5VO0~1.PNG")) returned 0x2e8598 [0136.858] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1b6, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BB5vO0g[1].png", cAlternateFileName="BB5VO0~1.PNG")) returned 0 [0136.858] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0136.858] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb5vo0g[1].png")) returned 1 [0136.859] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb5vo0g[1].png")) returned 0xffffffff [0136.859] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BB8AdqN[1].png", cAlternateFileName="BB8ADQ~1.PNG")) returned 1 [0136.859] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb8adqn[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0136.860] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb8adqn[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0136.860] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x156 [0136.860] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0136.861] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0136.946] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x156, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x156, lpOverlapped=0x0) returned 1 [0137.041] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x160, lpOverlapped=0x0) returned 1 [0137.043] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0137.062] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.072] CloseHandle (hObject=0xe4) returned 1 [0137.072] CloseHandle (hObject=0xe0) returned 1 [0137.072] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb8adqn[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb8adqn[1].png.dvodltmf")) returned 0 [0137.073] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb8adqn[1].png.dvodltmf")) returned 0x2020 [0137.073] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BB8AdqN[1].png", cAlternateFileName="BB8ADQ~1.PNG")) returned 0x2e8598 [0137.073] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BB8AdqN[1].png", cAlternateFileName="BB8ADQ~1.PNG")) returned 0 [0137.073] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0137.073] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb8adqn[1].png")) returned 1 [0137.074] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb8adqn[1].png")) returned 0xffffffff [0137.074] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45be8b30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45be8b30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ca7210, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x152c, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBALZyp[1].jpg", cAlternateFileName="BBALZY~1.JPG")) returned 1 [0137.074] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbalzyp[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0137.075] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbalzyp[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0137.075] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x152c [0137.075] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0137.076] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0137.163] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x152c, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x152c, lpOverlapped=0x0) returned 1 [0137.166] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1530, lpOverlapped=0x0) returned 1 [0137.167] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0137.186] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.196] CloseHandle (hObject=0xe0) returned 1 [0137.196] CloseHandle (hObject=0xe4) returned 1 [0137.196] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbalzyp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbalzyp[1].jpg.dvodltmf")) returned 0 [0137.197] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbalzyp[1].jpg.dvodltmf")) returned 0x2020 [0137.197] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45be8b30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45be8b30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ca7210, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x152c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBALZyp[1].jpg", cAlternateFileName="BBALZY~1.JPG")) returned 0x2e8598 [0137.197] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45be8b30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45be8b30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ca7210, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x152c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBALZyp[1].jpg", cAlternateFileName="BBALZY~1.JPG")) returned 0 [0137.197] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0137.197] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbalzyp[1].jpg")) returned 1 [0137.198] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbalzyp[1].jpg")) returned 0xffffffff [0137.198] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5360ae70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5360ae70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5360ae70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x97c, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBImKp[1].jpg", cAlternateFileName="BBBIMK~1.JPG")) returned 1 [0137.198] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbimkp[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0137.198] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbimkp[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0137.199] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x97c [0137.199] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0137.199] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0137.284] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x97c, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x97c, lpOverlapped=0x0) returned 1 [0137.285] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x980, lpOverlapped=0x0) returned 1 [0137.286] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0137.306] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.315] CloseHandle (hObject=0xe4) returned 1 [0137.315] CloseHandle (hObject=0xe0) returned 1 [0137.315] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbimkp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbimkp[1].jpg.dvodltmf")) returned 0 [0137.316] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbimkp[1].jpg.dvodltmf")) returned 0x2020 [0137.316] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5360ae70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5360ae70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5360ae70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x97c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBImKp[1].jpg", cAlternateFileName="BBBIMK~1.JPG")) returned 0x2e8598 [0137.316] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5360ae70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5360ae70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5360ae70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x97c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBImKp[1].jpg", cAlternateFileName="BBBIMK~1.JPG")) returned 0 [0137.316] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0137.317] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbimkp[1].jpg")) returned 1 [0137.317] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbimkp[1].jpg")) returned 0xffffffff [0137.317] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53598a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53598a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53630fd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29ca, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBMGJo[1].jpg", cAlternateFileName="BBBMGJ~1.JPG")) returned 1 [0137.317] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmgjo[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0137.318] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmgjo[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0137.318] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29ca [0137.318] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0137.319] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0137.417] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x29ca, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x29ca, lpOverlapped=0x0) returned 1 [0137.420] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x29d0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x29d0, lpOverlapped=0x0) returned 1 [0137.422] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0137.441] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.450] CloseHandle (hObject=0xe0) returned 1 [0137.450] CloseHandle (hObject=0xe4) returned 1 [0137.450] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmgjo[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmgjo[1].jpg.dvodltmf")) returned 0 [0137.451] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmgjo[1].jpg.dvodltmf")) returned 0x2020 [0137.451] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53598a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53598a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53630fd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29ca, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBMGJo[1].jpg", cAlternateFileName="BBBMGJ~1.JPG")) returned 0x2e8598 [0137.452] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53598a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53598a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53630fd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29ca, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBMGJo[1].jpg", cAlternateFileName="BBBMGJ~1.JPG")) returned 0 [0137.452] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0137.452] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmgjo[1].jpg")) returned 1 [0137.453] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmgjo[1].jpg")) returned 0xffffffff [0137.453] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x862, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBMKDF[1].jpg", cAlternateFileName="BBBMKD~1.JPG")) returned 1 [0137.453] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmkdf[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0137.453] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmkdf[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0137.454] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x862 [0137.454] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0137.454] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0137.538] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x862, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x862, lpOverlapped=0x0) returned 1 [0137.539] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x870, lpOverlapped=0x0) returned 1 [0137.540] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0137.562] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.572] CloseHandle (hObject=0xe4) returned 1 [0137.572] CloseHandle (hObject=0xe0) returned 1 [0137.572] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmkdf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmkdf[1].jpg.dvodltmf")) returned 0 [0137.573] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmkdf[1].jpg.dvodltmf")) returned 0x2020 [0137.573] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x862, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBMKDF[1].jpg", cAlternateFileName="BBBMKD~1.JPG")) returned 0x2e8598 [0137.573] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x862, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBMKDF[1].jpg", cAlternateFileName="BBBMKD~1.JPG")) returned 0 [0137.573] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0137.573] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmkdf[1].jpg")) returned 1 [0137.574] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmkdf[1].jpg")) returned 0xffffffff [0137.574] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53846310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53846310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53846310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x142e, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBMQch[1].jpg", cAlternateFileName="BBBMQC~1.JPG")) returned 1 [0137.574] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmqch[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0137.574] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmqch[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0137.575] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x142e [0137.575] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0137.575] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0137.660] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x142e, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x142e, lpOverlapped=0x0) returned 1 [0137.662] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1430, lpOverlapped=0x0) returned 1 [0137.663] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0137.682] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.692] CloseHandle (hObject=0xe0) returned 1 [0137.692] CloseHandle (hObject=0xe4) returned 1 [0137.692] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmqch[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmqch[1].jpg.dvodltmf")) returned 0 [0137.693] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmqch[1].jpg.dvodltmf")) returned 0x2020 [0137.693] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53846310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53846310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53846310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x142e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBMQch[1].jpg", cAlternateFileName="BBBMQC~1.JPG")) returned 0x2e8598 [0137.693] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53846310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53846310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53846310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x142e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBMQch[1].jpg", cAlternateFileName="BBBMQC~1.JPG")) returned 0 [0137.693] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0137.693] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmqch[1].jpg")) returned 1 [0137.694] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmqch[1].jpg")) returned 0xffffffff [0137.694] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58321c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58321c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x58321c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e6b, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBMyVh[1].jpg", cAlternateFileName="BBBMYV~1.JPG")) returned 1 [0137.694] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmyvh[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0137.694] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmyvh[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0137.695] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e6b [0137.695] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0137.695] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0137.791] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3e6b, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x3e6b, lpOverlapped=0x0) returned 1 [0137.793] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3e70, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x3e70, lpOverlapped=0x0) returned 1 [0137.794] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0137.813] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.823] CloseHandle (hObject=0xe4) returned 1 [0137.823] CloseHandle (hObject=0xe0) returned 1 [0137.823] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmyvh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmyvh[1].jpg.dvodltmf")) returned 0 [0137.824] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmyvh[1].jpg.dvodltmf")) returned 0x2020 [0137.824] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58321c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58321c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x58321c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e6b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBMyVh[1].jpg", cAlternateFileName="BBBMYV~1.JPG")) returned 0x2e8598 [0137.824] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58321c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58321c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x58321c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e6b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBMyVh[1].jpg", cAlternateFileName="BBBMYV~1.JPG")) returned 0 [0137.824] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0137.824] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmyvh[1].jpg")) returned 1 [0137.825] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmyvh[1].jpg")) returned 0xffffffff [0137.825] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53337450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x812, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBNAf7[1].jpg", cAlternateFileName="BBBNAF~1.JPG")) returned 1 [0137.825] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnaf7[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0137.825] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnaf7[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0137.826] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x812 [0137.826] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0137.826] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0137.911] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x812, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x812, lpOverlapped=0x0) returned 1 [0137.913] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x820, lpOverlapped=0x0) returned 1 [0137.914] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0137.933] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.942] CloseHandle (hObject=0xe0) returned 1 [0137.942] CloseHandle (hObject=0xe4) returned 1 [0137.942] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnaf7[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnaf7[1].jpg.dvodltmf")) returned 0 [0137.943] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnaf7[1].jpg.dvodltmf")) returned 0x2020 [0137.943] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53337450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x812, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBNAf7[1].jpg", cAlternateFileName="BBBNAF~1.JPG")) returned 0x2e8598 [0137.943] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53337450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x812, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBNAf7[1].jpg", cAlternateFileName="BBBNAF~1.JPG")) returned 0 [0137.943] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0137.944] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnaf7[1].jpg")) returned 1 [0137.944] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnaf7[1].jpg")) returned 0xffffffff [0137.944] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533a9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533a9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb22, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBNnTF[1].jpg", cAlternateFileName="BBBNNT~1.JPG")) returned 1 [0137.944] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnntf[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0137.945] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnntf[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0137.946] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb22 [0137.946] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0137.946] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0138.040] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb22, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0xb22, lpOverlapped=0x0) returned 1 [0138.041] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0xb30, lpOverlapped=0x0) returned 1 [0138.042] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0138.062] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.071] CloseHandle (hObject=0xe4) returned 1 [0138.071] CloseHandle (hObject=0xe0) returned 1 [0138.071] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnntf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnntf[1].jpg.dvodltmf")) returned 0 [0138.072] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnntf[1].jpg.dvodltmf")) returned 0x2020 [0138.072] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533a9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533a9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb22, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBNnTF[1].jpg", cAlternateFileName="BBBNNT~1.JPG")) returned 0x2e8598 [0138.072] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533a9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533a9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb22, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBNnTF[1].jpg", cAlternateFileName="BBBNNT~1.JPG")) returned 0 [0138.073] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0138.073] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnntf[1].jpg")) returned 1 [0138.073] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnntf[1].jpg")) returned 0xffffffff [0138.074] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539c30d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539c30d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539c30d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1529, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBO4dZ[1].jpg", cAlternateFileName="BBBO4D~1.JPG")) returned 1 [0138.075] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo4dz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0138.075] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo4dz[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0138.076] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1529 [0138.076] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0138.076] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0138.161] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1529, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1529, lpOverlapped=0x0) returned 1 [0138.162] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1530, lpOverlapped=0x0) returned 1 [0138.163] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0138.183] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.192] CloseHandle (hObject=0xe0) returned 1 [0138.192] CloseHandle (hObject=0xe4) returned 1 [0138.193] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo4dz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo4dz[1].jpg.dvodltmf")) returned 0 [0138.193] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo4dz[1].jpg.dvodltmf")) returned 0x2020 [0138.193] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539c30d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539c30d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539c30d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1529, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBO4dZ[1].jpg", cAlternateFileName="BBBO4D~1.JPG")) returned 0x2e8598 [0138.194] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539c30d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539c30d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539c30d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1529, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBO4dZ[1].jpg", cAlternateFileName="BBBO4D~1.JPG")) returned 0 [0138.194] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0138.194] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo4dz[1].jpg")) returned 1 [0138.195] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo4dz[1].jpg")) returned 0xffffffff [0138.195] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1e61, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBO8ow[1].jpg", cAlternateFileName="BBBO8O~1.JPG")) returned 1 [0138.195] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo8ow[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0138.195] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo8ow[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0138.196] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1e61 [0138.196] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0138.196] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0138.282] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1e61, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1e61, lpOverlapped=0x0) returned 1 [0138.284] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1e70, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1e70, lpOverlapped=0x0) returned 1 [0138.285] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0138.304] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.314] CloseHandle (hObject=0xe4) returned 1 [0138.314] CloseHandle (hObject=0xe0) returned 1 [0138.314] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo8ow[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo8ow[1].jpg.dvodltmf")) returned 0 [0138.315] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo8ow[1].jpg.dvodltmf")) returned 0x2020 [0138.315] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1e61, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBO8ow[1].jpg", cAlternateFileName="BBBO8O~1.JPG")) returned 0x2e8598 [0138.315] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1e61, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBO8ow[1].jpg", cAlternateFileName="BBBO8O~1.JPG")) returned 0 [0138.315] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0138.315] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo8ow[1].jpg")) returned 1 [0138.316] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo8ow[1].jpg")) returned 0xffffffff [0138.316] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x636, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBOaeS[1].jpg", cAlternateFileName="BBBOAE~1.JPG")) returned 1 [0138.316] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboaes[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0138.316] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboaes[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0138.317] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x636 [0138.317] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0138.317] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0138.414] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x636, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x636, lpOverlapped=0x0) returned 1 [0138.415] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x640, lpOverlapped=0x0) returned 1 [0138.416] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0138.435] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.445] CloseHandle (hObject=0xe0) returned 1 [0138.445] CloseHandle (hObject=0xe4) returned 1 [0138.445] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboaes[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboaes[1].jpg.dvodltmf")) returned 0 [0138.446] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboaes[1].jpg.dvodltmf")) returned 0x2020 [0138.446] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x636, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBOaeS[1].jpg", cAlternateFileName="BBBOAE~1.JPG")) returned 0x2e8598 [0138.446] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x636, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBOaeS[1].jpg", cAlternateFileName="BBBOAE~1.JPG")) returned 0 [0138.446] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0138.446] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboaes[1].jpg")) returned 1 [0138.447] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboaes[1].jpg")) returned 0xffffffff [0138.447] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53278d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53278d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53278d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x82a, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBOcIb[1].jpg", cAlternateFileName="BBBOCI~1.JPG")) returned 1 [0138.447] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbocib[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0138.448] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbocib[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0138.448] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x82a [0138.448] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0138.449] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0138.533] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x82a, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x82a, lpOverlapped=0x0) returned 1 [0138.535] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x830, lpOverlapped=0x0) returned 1 [0138.536] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0138.555] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.565] CloseHandle (hObject=0xe4) returned 1 [0138.565] CloseHandle (hObject=0xe0) returned 1 [0138.565] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbocib[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbocib[1].jpg.dvodltmf")) returned 0 [0138.566] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbocib[1].jpg.dvodltmf")) returned 0x2020 [0138.566] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53278d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53278d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53278d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x82a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBOcIb[1].jpg", cAlternateFileName="BBBOCI~1.JPG")) returned 0x2e8598 [0138.566] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53278d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53278d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53278d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x82a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBOcIb[1].jpg", cAlternateFileName="BBBOCI~1.JPG")) returned 0 [0138.566] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0138.566] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbocib[1].jpg")) returned 1 [0138.567] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbocib[1].jpg")) returned 0xffffffff [0138.567] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b8c150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b8c150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53b8c150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x161e, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBOddp[1].jpg", cAlternateFileName="BBBODD~1.JPG")) returned 1 [0138.567] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboddp[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0138.567] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboddp[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0138.568] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x161e [0138.568] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0138.568] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0138.653] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x161e, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x161e, lpOverlapped=0x0) returned 1 [0138.659] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1620, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1620, lpOverlapped=0x0) returned 1 [0138.660] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0138.679] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.689] CloseHandle (hObject=0xe0) returned 1 [0138.689] CloseHandle (hObject=0xe4) returned 1 [0138.689] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboddp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboddp[1].jpg.dvodltmf")) returned 0 [0138.690] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboddp[1].jpg.dvodltmf")) returned 0x2020 [0138.690] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b8c150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b8c150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53b8c150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x161e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBOddp[1].jpg", cAlternateFileName="BBBODD~1.JPG")) returned 0x2e8598 [0138.690] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b8c150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b8c150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53b8c150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x161e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBOddp[1].jpg", cAlternateFileName="BBBODD~1.JPG")) returned 0 [0138.690] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0138.690] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboddp[1].jpg")) returned 1 [0138.691] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboddp[1].jpg")) returned 0xffffffff [0138.691] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a1fd500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a1fd500, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a223660, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5685, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBOmar[1].jpg", cAlternateFileName="BBBOMA~1.JPG")) returned 1 [0138.691] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbomar[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0138.692] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbomar[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0138.693] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5685 [0138.693] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0138.693] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0138.778] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x5685, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x5685, lpOverlapped=0x0) returned 1 [0138.812] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x5690, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x5690, lpOverlapped=0x0) returned 1 [0138.817] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0138.836] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.845] CloseHandle (hObject=0xe4) returned 1 [0138.845] CloseHandle (hObject=0xe0) returned 1 [0138.846] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbomar[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbomar[1].jpg.dvodltmf")) returned 0 [0138.846] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbomar[1].jpg.dvodltmf")) returned 0x2020 [0138.846] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a1fd500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a1fd500, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a223660, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5685, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBOmar[1].jpg", cAlternateFileName="BBBOMA~1.JPG")) returned 0x2e8598 [0138.847] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a1fd500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a1fd500, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a223660, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5685, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBOmar[1].jpg", cAlternateFileName="BBBOMA~1.JPG")) returned 0 [0138.847] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0138.847] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbomar[1].jpg")) returned 1 [0138.848] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbomar[1].jpg")) returned 0xffffffff [0138.848] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f7f1f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f7f1f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f7f1f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2f6b, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBR4yQ[1].jpg", cAlternateFileName="BBBR4Y~1.JPG")) returned 1 [0138.848] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbr4yq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0138.849] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbr4yq[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0138.849] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2f6b [0138.849] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0138.850] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0138.941] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2f6b, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2f6b, lpOverlapped=0x0) returned 1 [0138.943] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2f70, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2f70, lpOverlapped=0x0) returned 1 [0138.945] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0138.964] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.973] CloseHandle (hObject=0xe0) returned 1 [0138.973] CloseHandle (hObject=0xe4) returned 1 [0138.973] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbr4yq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbr4yq[1].jpg.dvodltmf")) returned 0 [0138.974] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbr4yq[1].jpg.dvodltmf")) returned 0x2020 [0138.974] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f7f1f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f7f1f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f7f1f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2f6b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBR4yQ[1].jpg", cAlternateFileName="BBBR4Y~1.JPG")) returned 0x2e8598 [0138.974] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f7f1f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f7f1f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f7f1f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2f6b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBR4yQ[1].jpg", cAlternateFileName="BBBR4Y~1.JPG")) returned 0 [0138.974] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0138.974] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbr4yq[1].jpg")) returned 1 [0138.975] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbr4yq[1].jpg")) returned 0xffffffff [0138.976] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e4e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e4e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e4e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBUPaj[1].jpg", cAlternateFileName="BBBUPA~1.JPG")) returned 1 [0138.976] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbupaj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0138.976] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbupaj[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0138.976] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x264b [0138.976] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0138.977] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0139.060] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x264b, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x264b, lpOverlapped=0x0) returned 1 [0139.062] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2650, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2650, lpOverlapped=0x0) returned 1 [0139.063] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0139.082] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.092] CloseHandle (hObject=0xe4) returned 1 [0139.092] CloseHandle (hObject=0xe0) returned 1 [0139.092] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbupaj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbupaj[1].jpg.dvodltmf")) returned 0 [0139.093] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbupaj[1].jpg.dvodltmf")) returned 0x2020 [0139.093] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e4e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e4e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e4e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBUPaj[1].jpg", cAlternateFileName="BBBUPA~1.JPG")) returned 0x2e8598 [0139.093] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e4e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e4e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e4e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBUPaj[1].jpg", cAlternateFileName="BBBUPA~1.JPG")) returned 0 [0139.093] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0139.093] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbupaj[1].jpg")) returned 1 [0139.094] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbupaj[1].jpg")) returned 0xffffffff [0139.094] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5e275160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e275160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e275160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e08, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBVEOW[1].jpg", cAlternateFileName="BBBVEO~1.JPG")) returned 1 [0139.094] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbveow[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0139.094] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbveow[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0139.095] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e08 [0139.095] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0139.095] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0139.180] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3e08, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x3e08, lpOverlapped=0x0) returned 1 [0139.182] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3e10, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x3e10, lpOverlapped=0x0) returned 1 [0139.183] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0139.203] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.212] CloseHandle (hObject=0xe0) returned 1 [0139.212] CloseHandle (hObject=0xe4) returned 1 [0139.212] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbveow[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbveow[1].jpg.dvodltmf")) returned 0 [0139.213] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbveow[1].jpg.dvodltmf")) returned 0x2020 [0139.213] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5e275160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e275160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e275160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e08, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBVEOW[1].jpg", cAlternateFileName="BBBVEO~1.JPG")) returned 0x2e8598 [0139.213] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5e275160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e275160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e275160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e08, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBVEOW[1].jpg", cAlternateFileName="BBBVEO~1.JPG")) returned 0 [0139.213] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0139.213] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbveow[1].jpg")) returned 1 [0139.214] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbveow[1].jpg")) returned 0xffffffff [0139.214] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f32f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f32f30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f32f30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa1f, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBVLcG[1].jpg", cAlternateFileName="BBBVLC~1.JPG")) returned 1 [0139.214] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvlcg[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0139.215] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvlcg[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0139.215] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa1f [0139.215] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0139.216] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0139.299] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa1f, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0xa1f, lpOverlapped=0x0) returned 1 [0139.303] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0xa20, lpOverlapped=0x0) returned 1 [0139.304] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0139.324] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.333] CloseHandle (hObject=0xe4) returned 1 [0139.333] CloseHandle (hObject=0xe0) returned 1 [0139.333] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvlcg[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvlcg[1].jpg.dvodltmf")) returned 0 [0139.334] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvlcg[1].jpg.dvodltmf")) returned 0x2020 [0139.334] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f32f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f32f30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f32f30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa1f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBVLcG[1].jpg", cAlternateFileName="BBBVLC~1.JPG")) returned 0x2e8598 [0139.334] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f32f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f32f30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f32f30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa1f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBVLcG[1].jpg", cAlternateFileName="BBBVLC~1.JPG")) returned 0 [0139.334] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0139.334] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvlcg[1].jpg")) returned 1 [0139.335] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvlcg[1].jpg")) returned 0xffffffff [0139.335] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x82d, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBVSkP[1].jpg", cAlternateFileName="BBBVSK~1.JPG")) returned 1 [0139.335] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvskp[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0139.336] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvskp[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0139.336] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x82d [0139.336] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0139.337] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0139.435] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x82d, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x82d, lpOverlapped=0x0) returned 1 [0139.436] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x830, lpOverlapped=0x0) returned 1 [0139.437] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0139.456] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.466] CloseHandle (hObject=0xe0) returned 1 [0139.466] CloseHandle (hObject=0xe4) returned 1 [0139.466] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvskp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvskp[1].jpg.dvodltmf")) returned 0 [0139.467] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvskp[1].jpg.dvodltmf")) returned 0x2020 [0139.467] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x82d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBVSkP[1].jpg", cAlternateFileName="BBBVSK~1.JPG")) returned 0x2e8598 [0139.467] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x82d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBVSkP[1].jpg", cAlternateFileName="BBBVSK~1.JPG")) returned 0 [0139.467] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0139.467] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvskp[1].jpg")) returned 1 [0139.468] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvskp[1].jpg")) returned 0xffffffff [0139.468] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x612a8ee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x612a8ee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x612a8ee0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x16f5, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBYfEH[1].jpg", cAlternateFileName="BBBYFE~1.JPG")) returned 1 [0139.468] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbyfeh[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0139.469] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbyfeh[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0139.469] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16f5 [0139.469] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0139.469] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0139.553] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x16f5, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x16f5, lpOverlapped=0x0) returned 1 [0139.641] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1700, lpOverlapped=0x0) returned 1 [0139.642] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0139.662] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.671] CloseHandle (hObject=0xe4) returned 1 [0139.671] CloseHandle (hObject=0xe0) returned 1 [0139.671] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbyfeh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbyfeh[1].jpg.dvodltmf")) returned 0 [0139.672] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbyfeh[1].jpg.dvodltmf")) returned 0x2020 [0139.672] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x612a8ee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x612a8ee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x612a8ee0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x16f5, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBYfEH[1].jpg", cAlternateFileName="BBBYFE~1.JPG")) returned 0x2e8598 [0139.672] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x612a8ee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x612a8ee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x612a8ee0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x16f5, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBBYfEH[1].jpg", cAlternateFileName="BBBYFE~1.JPG")) returned 0 [0139.672] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0139.673] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbyfeh[1].jpg")) returned 1 [0139.673] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbyfeh[1].jpg")) returned 0xffffffff [0139.673] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53017770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53017770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53017770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc20, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBBZ5vT[1].jpg", cAlternateFileName="BBBZ5V~1.JPG")) returned 1 [0139.674] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbz5vt[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0139.674] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbz5vt[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0139.674] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc20 [0139.675] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0139.675] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0139.762] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xc20, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0xc20, lpOverlapped=0x0) returned 1 [0139.785] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0xc30, lpOverlapped=0x0) returned 1 [0139.786] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0139.806] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.815] CloseHandle (hObject=0xe0) returned 1 [0139.815] CloseHandle (hObject=0xe4) returned 1 [0139.816] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbz5vt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbz5vt[1].jpg.dvodltmf")) returned 0 [0139.816] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbz5vt[1].jpg.dvodltmf")) returned 0x2020 [0139.817] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53017770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53017770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53017770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc20, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBZ5vT[1].jpg", cAlternateFileName="BBBZ5V~1.JPG")) returned 0x2e8598 [0139.817] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53017770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53017770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53017770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc20, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBBZ5vT[1].jpg", cAlternateFileName="BBBZ5V~1.JPG")) returned 0 [0139.817] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0139.817] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbz5vt[1].jpg")) returned 1 [0139.818] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbz5vt[1].jpg")) returned 0xffffffff [0139.818] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x514ddbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x514ddbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x514ddbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x86e, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBC02Gr[1].jpg", cAlternateFileName="BBC02G~1.JPG")) returned 1 [0139.818] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0139.818] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0139.819] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x86e [0139.819] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0139.819] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0139.914] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x86e, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x86e, lpOverlapped=0x0) returned 1 [0139.916] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x870, lpOverlapped=0x0) returned 1 [0139.916] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0139.936] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.946] CloseHandle (hObject=0xe4) returned 1 [0139.946] CloseHandle (hObject=0xe0) returned 1 [0139.946] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[1].jpg.dvodltmf")) returned 0 [0139.947] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[1].jpg.dvodltmf")) returned 0x2020 [0139.947] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x514ddbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x514ddbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x514ddbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x86e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBC02Gr[1].jpg", cAlternateFileName="BBC02G~1.JPG")) returned 0x2e8598 [0139.947] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x514ddbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x514ddbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x514ddbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x86e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBC02Gr[1].jpg", cAlternateFileName="BBC02G~1.JPG")) returned 0 [0139.947] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0139.947] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[1].jpg")) returned 1 [0139.948] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[1].jpg")) returned 0xffffffff [0139.948] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5392ab50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5392ab50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5392ab50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x86e, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBC02Gr[2].jpg", cAlternateFileName="BBC02G~2.JPG")) returned 1 [0139.948] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0139.948] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[2].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0139.949] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x86e [0139.949] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0139.949] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0140.032] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x86e, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x86e, lpOverlapped=0x0) returned 1 [0140.033] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x870, lpOverlapped=0x0) returned 1 [0140.034] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0140.054] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.063] CloseHandle (hObject=0xe0) returned 1 [0140.063] CloseHandle (hObject=0xe4) returned 1 [0140.063] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[2].jpg.dvodltmf")) returned 0 [0140.064] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[2].jpg.dvodltmf")) returned 0x2020 [0140.064] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5392ab50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5392ab50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5392ab50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x86e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBC02Gr[2].jpg", cAlternateFileName="BBC02G~2.JPG")) returned 0x2e8598 [0140.064] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5392ab50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5392ab50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5392ab50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x86e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBC02Gr[2].jpg", cAlternateFileName="BBC02G~2.JPG")) returned 0 [0140.064] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0140.064] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[2].jpg")) returned 1 [0140.065] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[2].jpg")) returned 0xffffffff [0140.065] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fa5350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fa5350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fa5350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x89a, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBC03B1[1].jpg", cAlternateFileName="BBC03B~1.JPG")) returned 1 [0140.065] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc03b1[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0140.066] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc03b1[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0140.066] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x89a [0140.066] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0140.067] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0140.149] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x89a, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x89a, lpOverlapped=0x0) returned 1 [0140.150] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x8a0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x8a0, lpOverlapped=0x0) returned 1 [0140.151] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0140.170] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.180] CloseHandle (hObject=0xe4) returned 1 [0140.180] CloseHandle (hObject=0xe0) returned 1 [0140.180] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc03b1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc03b1[1].jpg.dvodltmf")) returned 0 [0140.181] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc03b1[1].jpg.dvodltmf")) returned 0x2020 [0140.181] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fa5350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fa5350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fa5350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x89a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBC03B1[1].jpg", cAlternateFileName="BBC03B~1.JPG")) returned 0x2e8598 [0140.181] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fa5350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fa5350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fa5350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x89a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBC03B1[1].jpg", cAlternateFileName="BBC03B~1.JPG")) returned 0 [0140.181] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0140.181] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc03b1[1].jpg")) returned 1 [0140.182] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc03b1[1].jpg")) returned 0xffffffff [0140.182] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f0cdd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f0cdd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f0cdd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7bb, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBC06Ub[1].jpg", cAlternateFileName="BBC06U~1.JPG")) returned 1 [0140.182] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc06ub[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0140.182] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc06ub[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0140.183] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7bb [0140.183] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0140.183] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0140.267] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x7bb, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x7bb, lpOverlapped=0x0) returned 1 [0140.268] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x7c0, lpOverlapped=0x0) returned 1 [0140.269] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0140.289] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.298] CloseHandle (hObject=0xe0) returned 1 [0140.298] CloseHandle (hObject=0xe4) returned 1 [0140.298] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc06ub[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc06ub[1].jpg.dvodltmf")) returned 0 [0140.299] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc06ub[1].jpg.dvodltmf")) returned 0x2020 [0140.299] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f0cdd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f0cdd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f0cdd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7bb, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBC06Ub[1].jpg", cAlternateFileName="BBC06U~1.JPG")) returned 0x2e8598 [0140.299] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f0cdd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f0cdd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f0cdd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7bb, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBC06Ub[1].jpg", cAlternateFileName="BBC06U~1.JPG")) returned 0 [0140.299] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0140.299] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc06ub[1].jpg")) returned 1 [0140.300] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc06ub[1].jpg")) returned 0xffffffff [0140.300] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9ab, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBC0Djg[1].jpg", cAlternateFileName="BBC0DJ~1.JPG")) returned 1 [0140.300] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0djg[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0140.301] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0djg[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0140.301] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9ab [0140.301] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0140.302] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0140.391] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x9ab, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x9ab, lpOverlapped=0x0) returned 1 [0140.392] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x9b0, lpOverlapped=0x0) returned 1 [0140.393] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0140.413] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.422] CloseHandle (hObject=0xe4) returned 1 [0140.422] CloseHandle (hObject=0xe0) returned 1 [0140.422] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0djg[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0djg[1].jpg.dvodltmf")) returned 0 [0140.423] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0djg[1].jpg.dvodltmf")) returned 0x2020 [0140.423] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9ab, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBC0Djg[1].jpg", cAlternateFileName="BBC0DJ~1.JPG")) returned 0x2e8598 [0140.423] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9ab, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBC0Djg[1].jpg", cAlternateFileName="BBC0DJ~1.JPG")) returned 0 [0140.423] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0140.423] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0djg[1].jpg")) returned 1 [0140.424] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0djg[1].jpg")) returned 0xffffffff [0140.424] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ec0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ec0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ec0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7fd, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBC0g7a[1].jpg", cAlternateFileName="BBC0G7~1.JPG")) returned 1 [0140.424] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0g7a[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0140.434] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0g7a[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0140.435] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7fd [0140.435] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0140.435] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0140.519] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x7fd, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x7fd, lpOverlapped=0x0) returned 1 [0140.520] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x800, lpOverlapped=0x0) returned 1 [0140.521] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0140.541] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.550] CloseHandle (hObject=0xe0) returned 1 [0140.550] CloseHandle (hObject=0xe4) returned 1 [0140.550] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0g7a[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0g7a[1].jpg.dvodltmf")) returned 0 [0140.551] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0g7a[1].jpg.dvodltmf")) returned 0x2020 [0140.551] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ec0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ec0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ec0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7fd, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBC0g7a[1].jpg", cAlternateFileName="BBC0G7~1.JPG")) returned 0x2e8598 [0140.551] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ec0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ec0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ec0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7fd, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBC0g7a[1].jpg", cAlternateFileName="BBC0G7~1.JPG")) returned 0 [0140.551] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0140.551] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0g7a[1].jpg")) returned 1 [0140.552] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0g7a[1].jpg")) returned 0xffffffff [0140.552] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x82f, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBC0lf2[1].jpg", cAlternateFileName="BBC0LF~1.JPG")) returned 1 [0140.552] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0lf2[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0140.553] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0lf2[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0140.554] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x82f [0140.554] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0140.554] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0140.639] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x82f, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x82f, lpOverlapped=0x0) returned 1 [0140.641] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x830, lpOverlapped=0x0) returned 1 [0140.642] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0140.661] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.670] CloseHandle (hObject=0xe4) returned 1 [0140.670] CloseHandle (hObject=0xe0) returned 1 [0140.670] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0lf2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0lf2[1].jpg.dvodltmf")) returned 0 [0140.671] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0lf2[1].jpg.dvodltmf")) returned 0x2020 [0140.671] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x82f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBC0lf2[1].jpg", cAlternateFileName="BBC0LF~1.JPG")) returned 0x2e8598 [0140.671] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x82f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBC0lf2[1].jpg", cAlternateFileName="BBC0LF~1.JPG")) returned 0 [0140.671] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0140.671] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0lf2[1].jpg")) returned 1 [0140.672] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0lf2[1].jpg")) returned 0xffffffff [0140.672] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b2e35a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5b2e35a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5b2e35a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1afe, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBC0mK1[1].jpg", cAlternateFileName="BBC0MK~1.JPG")) returned 1 [0140.672] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0mk1[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0140.672] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0mk1[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0140.673] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1afe [0140.673] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0140.673] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0140.762] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1afe, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1afe, lpOverlapped=0x0) returned 1 [0140.763] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1b00, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1b00, lpOverlapped=0x0) returned 1 [0140.764] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0140.783] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.793] CloseHandle (hObject=0xe0) returned 1 [0140.793] CloseHandle (hObject=0xe4) returned 1 [0140.793] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0mk1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0mk1[1].jpg.dvodltmf")) returned 0 [0140.794] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0mk1[1].jpg.dvodltmf")) returned 0x2020 [0140.794] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b2e35a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5b2e35a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5b2e35a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1afe, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBC0mK1[1].jpg", cAlternateFileName="BBC0MK~1.JPG")) returned 0x2e8598 [0140.794] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b2e35a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5b2e35a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5b2e35a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1afe, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBC0mK1[1].jpg", cAlternateFileName="BBC0MK~1.JPG")) returned 0 [0140.794] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0140.794] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0mk1[1].jpg")) returned 1 [0140.795] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0mk1[1].jpg")) returned 0xffffffff [0140.795] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53089b90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53089b90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1fc3, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBC0qlB[1].jpg", cAlternateFileName="BBC0QL~1.JPG")) returned 1 [0140.795] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0qlb[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0140.795] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0qlb[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0140.796] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1fc3 [0140.796] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0140.796] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0140.879] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1fc3, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1fc3, lpOverlapped=0x0) returned 1 [0140.883] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1fd0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1fd0, lpOverlapped=0x0) returned 1 [0140.884] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0140.903] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.913] CloseHandle (hObject=0xe4) returned 1 [0140.913] CloseHandle (hObject=0xe0) returned 1 [0140.913] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0qlb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0qlb[1].jpg.dvodltmf")) returned 0 [0140.914] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0qlb[1].jpg.dvodltmf")) returned 0x2020 [0140.914] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53089b90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53089b90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1fc3, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBC0qlB[1].jpg", cAlternateFileName="BBC0QL~1.JPG")) returned 0x2e8598 [0140.914] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53089b90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53089b90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1fc3, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBC0qlB[1].jpg", cAlternateFileName="BBC0QL~1.JPG")) returned 0 [0140.914] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0140.914] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0qlb[1].jpg")) returned 1 [0140.915] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0qlb[1].jpg")) returned 0xffffffff [0140.915] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2ecb, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBE7KPZ[1].jpg", cAlternateFileName="BBE7KP~1.JPG")) returned 1 [0140.915] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe7kpz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0140.915] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe7kpz[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0140.916] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ecb [0140.916] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0140.916] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0141.000] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2ecb, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2ecb, lpOverlapped=0x0) returned 1 [0141.002] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2ed0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2ed0, lpOverlapped=0x0) returned 1 [0141.003] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0141.023] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.032] CloseHandle (hObject=0xe0) returned 1 [0141.032] CloseHandle (hObject=0xe4) returned 1 [0141.032] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe7kpz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe7kpz[1].jpg.dvodltmf")) returned 0 [0141.033] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe7kpz[1].jpg.dvodltmf")) returned 0x2020 [0141.033] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2ecb, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBE7KPZ[1].jpg", cAlternateFileName="BBE7KP~1.JPG")) returned 0x2e8598 [0141.033] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2ecb, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBE7KPZ[1].jpg", cAlternateFileName="BBE7KP~1.JPG")) returned 0 [0141.033] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0141.033] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe7kpz[1].jpg")) returned 1 [0141.034] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe7kpz[1].jpg")) returned 0xffffffff [0141.034] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a6bd70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a6bd70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a6bd70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x9c5, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBE8IlA[1].jpg", cAlternateFileName="BBE8IL~1.JPG")) returned 1 [0141.035] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe8ila[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0141.035] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe8ila[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0141.035] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9c5 [0141.035] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0141.036] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0141.119] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x9c5, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x9c5, lpOverlapped=0x0) returned 1 [0141.121] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x9d0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x9d0, lpOverlapped=0x0) returned 1 [0141.122] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0141.141] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.151] CloseHandle (hObject=0xe4) returned 1 [0141.151] CloseHandle (hObject=0xe0) returned 1 [0141.151] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe8ila[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe8ila[1].jpg.dvodltmf")) returned 0 [0141.152] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe8ila[1].jpg.dvodltmf")) returned 0x2020 [0141.152] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a6bd70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a6bd70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a6bd70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x9c5, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBE8IlA[1].jpg", cAlternateFileName="BBE8IL~1.JPG")) returned 0x2e8598 [0141.152] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a6bd70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a6bd70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a6bd70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x9c5, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBE8IlA[1].jpg", cAlternateFileName="BBE8IL~1.JPG")) returned 0 [0141.152] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0141.152] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe8ila[1].jpg")) returned 1 [0141.153] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe8ila[1].jpg")) returned 0xffffffff [0141.153] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b9c870, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b9c870, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b9c870, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2669, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBE972F[1].jpg", cAlternateFileName="BBE972~1.JPG")) returned 1 [0141.153] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe972f[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0141.153] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe972f[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0141.154] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2669 [0141.154] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0141.154] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0141.238] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2669, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2669, lpOverlapped=0x0) returned 1 [0141.239] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2670, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2670, lpOverlapped=0x0) returned 1 [0141.241] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0141.260] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.270] CloseHandle (hObject=0xe0) returned 1 [0141.270] CloseHandle (hObject=0xe4) returned 1 [0141.270] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe972f[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe972f[1].jpg.dvodltmf")) returned 0 [0141.271] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe972f[1].jpg.dvodltmf")) returned 0x2020 [0141.271] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b9c870, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b9c870, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b9c870, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2669, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBE972F[1].jpg", cAlternateFileName="BBE972~1.JPG")) returned 0x2e8598 [0141.271] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b9c870, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b9c870, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b9c870, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2669, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBE972F[1].jpg", cAlternateFileName="BBE972~1.JPG")) returned 0 [0141.271] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0141.271] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe972f[1].jpg")) returned 1 [0141.272] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe972f[1].jpg")) returned 0xffffffff [0141.272] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2a77, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBE9tdx[1].jpg", cAlternateFileName="BBE9TD~1.JPG")) returned 1 [0141.272] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe9tdx[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0141.272] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe9tdx[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0141.273] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2a77 [0141.273] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0141.273] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0141.356] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2a77, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2a77, lpOverlapped=0x0) returned 1 [0141.359] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2a80, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2a80, lpOverlapped=0x0) returned 1 [0141.360] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0141.385] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.394] CloseHandle (hObject=0xe4) returned 1 [0141.394] CloseHandle (hObject=0xe0) returned 1 [0141.394] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe9tdx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe9tdx[1].jpg.dvodltmf")) returned 0 [0141.395] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe9tdx[1].jpg.dvodltmf")) returned 0x2020 [0141.395] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2a77, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBE9tdx[1].jpg", cAlternateFileName="BBE9TD~1.JPG")) returned 0x2e8598 [0141.396] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2a77, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBE9tdx[1].jpg", cAlternateFileName="BBE9TD~1.JPG")) returned 0 [0141.396] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0141.396] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe9tdx[1].jpg")) returned 1 [0141.397] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe9tdx[1].jpg")) returned 0xffffffff [0141.397] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2fe3, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEdrqt[1].jpg", cAlternateFileName="BBEDRQ~1.JPG")) returned 1 [0141.397] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbedrqt[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0141.397] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbedrqt[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0141.398] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2fe3 [0141.398] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0141.398] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0141.497] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2fe3, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2fe3, lpOverlapped=0x0) returned 1 [0141.517] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2ff0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2ff0, lpOverlapped=0x0) returned 1 [0141.518] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0141.538] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.547] CloseHandle (hObject=0xe0) returned 1 [0141.547] CloseHandle (hObject=0xe4) returned 1 [0141.547] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbedrqt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbedrqt[1].jpg.dvodltmf")) returned 0 [0141.548] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbedrqt[1].jpg.dvodltmf")) returned 0x2020 [0141.548] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2fe3, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEdrqt[1].jpg", cAlternateFileName="BBEDRQ~1.JPG")) returned 0x2e8598 [0141.549] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2fe3, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEdrqt[1].jpg", cAlternateFileName="BBEDRQ~1.JPG")) returned 0 [0141.549] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0141.549] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbedrqt[1].jpg")) returned 1 [0141.550] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbedrqt[1].jpg")) returned 0xffffffff [0141.550] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x857, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEeEwt[1].jpg", cAlternateFileName="BBEEEW~1.JPG")) returned 1 [0141.550] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeewt[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0141.550] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeewt[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0141.551] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x857 [0141.551] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0141.551] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0141.638] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x857, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x857, lpOverlapped=0x0) returned 1 [0141.644] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x860, lpOverlapped=0x0) returned 1 [0141.645] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0141.665] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.674] CloseHandle (hObject=0xe4) returned 1 [0141.674] CloseHandle (hObject=0xe0) returned 1 [0141.675] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeewt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeewt[1].jpg.dvodltmf")) returned 0 [0141.675] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeewt[1].jpg.dvodltmf")) returned 0x2020 [0141.675] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x857, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEeEwt[1].jpg", cAlternateFileName="BBEEEW~1.JPG")) returned 0x2e8598 [0141.676] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x857, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEeEwt[1].jpg", cAlternateFileName="BBEEEW~1.JPG")) returned 0 [0141.676] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0141.676] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeewt[1].jpg")) returned 1 [0141.677] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeewt[1].jpg")) returned 0xffffffff [0141.677] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4593b270, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4593b270, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4593b270, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7d9, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEeis3[1].jpg", cAlternateFileName="BBEEIS~1.JPG")) returned 1 [0141.677] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeis3[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0141.677] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeis3[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0141.678] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7d9 [0141.678] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0141.678] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0141.762] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x7d9, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x7d9, lpOverlapped=0x0) returned 1 [0141.763] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x7e0, lpOverlapped=0x0) returned 1 [0141.765] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0141.790] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.815] CloseHandle (hObject=0xe0) returned 1 [0141.815] CloseHandle (hObject=0xe4) returned 1 [0141.815] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeis3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeis3[1].jpg.dvodltmf")) returned 0 [0141.816] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeis3[1].jpg.dvodltmf")) returned 0x2020 [0141.816] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4593b270, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4593b270, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4593b270, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7d9, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEeis3[1].jpg", cAlternateFileName="BBEEIS~1.JPG")) returned 0x2e8598 [0141.816] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4593b270, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4593b270, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4593b270, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7d9, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEeis3[1].jpg", cAlternateFileName="BBEEIS~1.JPG")) returned 0 [0141.816] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0141.817] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeis3[1].jpg")) returned 1 [0141.817] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeis3[1].jpg")) returned 0xffffffff [0141.817] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8c5, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEeKvV[1].jpg", cAlternateFileName="BBEEKV~1.JPG")) returned 1 [0141.818] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeekvv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0141.818] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeekvv[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0141.818] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8c5 [0141.818] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0141.819] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0141.905] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x8c5, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x8c5, lpOverlapped=0x0) returned 1 [0141.906] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x8d0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x8d0, lpOverlapped=0x0) returned 1 [0141.907] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0141.927] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.936] CloseHandle (hObject=0xe4) returned 1 [0141.936] CloseHandle (hObject=0xe0) returned 1 [0141.936] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeekvv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeekvv[1].jpg.dvodltmf")) returned 0 [0141.937] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeekvv[1].jpg.dvodltmf")) returned 0x2020 [0141.937] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8c5, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEeKvV[1].jpg", cAlternateFileName="BBEEKV~1.JPG")) returned 0x2e8598 [0141.938] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8c5, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEeKvV[1].jpg", cAlternateFileName="BBEEKV~1.JPG")) returned 0 [0141.938] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0141.938] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeekvv[1].jpg")) returned 1 [0141.939] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeekvv[1].jpg")) returned 0xffffffff [0141.939] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a91ed0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a91ed0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xef00, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEeNd8[1].png", cAlternateFileName="BBEEND~1.PNG")) returned 1 [0141.939] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeend8[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0141.939] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeend8[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0141.940] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xef00 [0141.940] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0141.940] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0142.024] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xef00, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0xef00, lpOverlapped=0x0) returned 1 [0142.028] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xef10, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0xef10, lpOverlapped=0x0) returned 1 [0142.029] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0142.049] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.059] CloseHandle (hObject=0xe0) returned 1 [0142.059] CloseHandle (hObject=0xe4) returned 1 [0142.059] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeend8[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeend8[1].png.dvodltmf")) returned 0 [0142.060] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeend8[1].png.dvodltmf")) returned 0x2020 [0142.060] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a91ed0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a91ed0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xef00, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEeNd8[1].png", cAlternateFileName="BBEEND~1.PNG")) returned 0x2e8598 [0142.060] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a91ed0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a91ed0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xef00, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEeNd8[1].png", cAlternateFileName="BBEEND~1.PNG")) returned 0 [0142.060] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0142.060] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeend8[1].png")) returned 1 [0142.061] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeend8[1].png")) returned 0xffffffff [0142.061] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3323, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEewZB[1].jpg", cAlternateFileName="BBEEWZ~1.JPG")) returned 1 [0142.062] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeewzb[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0142.062] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeewzb[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0142.062] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3323 [0142.062] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0142.063] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0142.147] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3323, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x3323, lpOverlapped=0x0) returned 1 [0142.149] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x3330, lpOverlapped=0x0) returned 1 [0142.150] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0142.170] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.180] CloseHandle (hObject=0xe4) returned 1 [0142.180] CloseHandle (hObject=0xe0) returned 1 [0142.180] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeewzb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeewzb[1].jpg.dvodltmf")) returned 0 [0142.181] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeewzb[1].jpg.dvodltmf")) returned 0x2020 [0142.181] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3323, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEewZB[1].jpg", cAlternateFileName="BBEEWZ~1.JPG")) returned 0x2e8598 [0142.182] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3323, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEewZB[1].jpg", cAlternateFileName="BBEEWZ~1.JPG")) returned 0 [0142.182] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0142.182] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeewzb[1].jpg")) returned 1 [0142.183] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeewzb[1].jpg")) returned 0xffffffff [0142.183] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEeZ0k[1].jpg", cAlternateFileName="BBEEZ0~1.JPG")) returned 1 [0142.184] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeez0k[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0142.184] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeez0k[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0142.185] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9d7 [0142.185] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0142.185] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0142.269] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x9d7, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x9d7, lpOverlapped=0x0) returned 1 [0142.271] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x9e0, lpOverlapped=0x0) returned 1 [0142.272] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0142.292] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.302] CloseHandle (hObject=0xe0) returned 1 [0142.302] CloseHandle (hObject=0xe4) returned 1 [0142.302] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeez0k[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeez0k[1].jpg.dvodltmf")) returned 0 [0142.303] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeez0k[1].jpg.dvodltmf")) returned 0x2020 [0142.303] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEeZ0k[1].jpg", cAlternateFileName="BBEEZ0~1.JPG")) returned 0x2e8598 [0142.303] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEeZ0k[1].jpg", cAlternateFileName="BBEEZ0~1.JPG")) returned 0 [0142.303] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0142.303] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeez0k[1].jpg")) returned 1 [0142.304] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeez0k[1].jpg")) returned 0xffffffff [0142.304] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2d32, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEf6s4[1].jpg", cAlternateFileName="BBEF6S~1.JPG")) returned 1 [0142.304] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbef6s4[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0142.305] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbef6s4[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0142.305] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d32 [0142.305] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0142.305] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0142.457] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2d32, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2d32, lpOverlapped=0x0) returned 1 [0142.467] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2d40, lpOverlapped=0x0) returned 1 [0142.468] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0142.488] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.498] CloseHandle (hObject=0xe4) returned 1 [0142.498] CloseHandle (hObject=0xe0) returned 1 [0142.498] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbef6s4[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbef6s4[1].jpg.dvodltmf")) returned 0 [0142.499] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbef6s4[1].jpg.dvodltmf")) returned 0x2020 [0142.499] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2d32, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEf6s4[1].jpg", cAlternateFileName="BBEF6S~1.JPG")) returned 0x2e8598 [0142.499] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2d32, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEf6s4[1].jpg", cAlternateFileName="BBEF6S~1.JPG")) returned 0 [0142.499] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0142.499] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbef6s4[1].jpg")) returned 1 [0142.508] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbef6s4[1].jpg")) returned 0xffffffff [0142.508] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b2a450, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b2a450, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b2a450, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x85d, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEfAc5[1].jpg", cAlternateFileName="BBEFAC~1.JPG")) returned 1 [0142.508] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefac5[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0142.508] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefac5[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0142.509] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85d [0142.509] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0142.509] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0142.604] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x85d, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x85d, lpOverlapped=0x0) returned 1 [0142.606] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x860, lpOverlapped=0x0) returned 1 [0142.607] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0142.628] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.638] CloseHandle (hObject=0xe0) returned 1 [0142.638] CloseHandle (hObject=0xe4) returned 1 [0142.638] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefac5[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefac5[1].jpg.dvodltmf")) returned 0 [0142.639] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefac5[1].jpg.dvodltmf")) returned 0x2020 [0142.639] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b2a450, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b2a450, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b2a450, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x85d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEfAc5[1].jpg", cAlternateFileName="BBEFAC~1.JPG")) returned 0x2e8598 [0142.639] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b2a450, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b2a450, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b2a450, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x85d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEfAc5[1].jpg", cAlternateFileName="BBEFAC~1.JPG")) returned 0 [0142.639] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0142.639] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefac5[1].jpg")) returned 1 [0142.640] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefac5[1].jpg")) returned 0xffffffff [0142.640] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45510bf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45510bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45510bf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x197c, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEfgDi[1].jpg", cAlternateFileName="BBEFGD~1.JPG")) returned 1 [0142.640] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefgdi[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0142.640] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefgdi[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0142.641] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x197c [0142.641] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0142.641] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0142.725] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x197c, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x197c, lpOverlapped=0x0) returned 1 [0142.727] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1980, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1980, lpOverlapped=0x0) returned 1 [0142.728] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0142.747] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.756] CloseHandle (hObject=0xe4) returned 1 [0142.757] CloseHandle (hObject=0xe0) returned 1 [0142.757] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefgdi[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefgdi[1].jpg.dvodltmf")) returned 0 [0142.757] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefgdi[1].jpg.dvodltmf")) returned 0x2020 [0142.758] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45510bf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45510bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45510bf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x197c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEfgDi[1].jpg", cAlternateFileName="BBEFGD~1.JPG")) returned 0x2e8598 [0142.758] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45510bf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45510bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45510bf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x197c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEfgDi[1].jpg", cAlternateFileName="BBEFGD~1.JPG")) returned 0 [0142.758] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0142.758] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefgdi[1].jpg")) returned 1 [0142.759] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefgdi[1].jpg")) returned 0xffffffff [0142.759] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xb7e, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEfjuT[1].jpg", cAlternateFileName="BBEFJU~1.JPG")) returned 1 [0142.759] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefjut[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0142.759] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefjut[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0142.760] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb7e [0142.760] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0142.760] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0142.846] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb7e, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0xb7e, lpOverlapped=0x0) returned 1 [0142.849] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb80, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0xb80, lpOverlapped=0x0) returned 1 [0142.850] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0142.870] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.879] CloseHandle (hObject=0xe0) returned 1 [0142.879] CloseHandle (hObject=0xe4) returned 1 [0142.879] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefjut[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefjut[1].jpg.dvodltmf")) returned 0 [0142.880] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefjut[1].jpg.dvodltmf")) returned 0x2020 [0142.880] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xb7e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEfjuT[1].jpg", cAlternateFileName="BBEFJU~1.JPG")) returned 0x2e8598 [0142.881] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xb7e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEfjuT[1].jpg", cAlternateFileName="BBEFJU~1.JPG")) returned 0 [0142.881] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0142.881] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefjut[1].jpg")) returned 1 [0142.882] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefjut[1].jpg")) returned 0xffffffff [0142.882] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457be4b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457be4b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457be4b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1b14, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEfkgi[1].jpg", cAlternateFileName="BBEFKG~1.JPG")) returned 1 [0142.882] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefkgi[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0142.882] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefkgi[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0142.883] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b14 [0142.883] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0142.883] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0142.969] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1b14, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1b14, lpOverlapped=0x0) returned 1 [0142.971] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1b20, lpOverlapped=0x0) returned 1 [0142.981] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0143.001] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.011] CloseHandle (hObject=0xe4) returned 1 [0143.011] CloseHandle (hObject=0xe0) returned 1 [0143.011] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefkgi[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefkgi[1].jpg.dvodltmf")) returned 0 [0143.012] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefkgi[1].jpg.dvodltmf")) returned 0x2020 [0143.012] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457be4b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457be4b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457be4b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1b14, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEfkgi[1].jpg", cAlternateFileName="BBEFKG~1.JPG")) returned 0x2e8598 [0143.012] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457be4b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457be4b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457be4b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1b14, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEfkgi[1].jpg", cAlternateFileName="BBEFKG~1.JPG")) returned 0 [0143.012] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0143.012] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefkgi[1].jpg")) returned 1 [0143.013] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefkgi[1].jpg")) returned 0xffffffff [0143.013] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2978, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEfRKA[1].jpg", cAlternateFileName="BBEFRK~1.JPG")) returned 1 [0143.013] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrka[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0143.014] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrka[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0143.014] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2978 [0143.014] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0143.015] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0143.101] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2978, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2978, lpOverlapped=0x0) returned 1 [0143.103] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2980, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2980, lpOverlapped=0x0) returned 1 [0143.104] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0143.124] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.134] CloseHandle (hObject=0xe0) returned 1 [0143.134] CloseHandle (hObject=0xe4) returned 1 [0143.134] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrka[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrka[1].jpg.dvodltmf")) returned 0 [0143.135] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrka[1].jpg.dvodltmf")) returned 0x2020 [0143.135] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2978, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEfRKA[1].jpg", cAlternateFileName="BBEFRK~1.JPG")) returned 0x2e8598 [0143.135] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2978, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEfRKA[1].jpg", cAlternateFileName="BBEFRK~1.JPG")) returned 0 [0143.135] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0143.135] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrka[1].jpg")) returned 1 [0143.136] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrka[1].jpg")) returned 0xffffffff [0143.136] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457721f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b6c, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEfRwv[1].jpg", cAlternateFileName="BBEFRW~1.JPG")) returned 1 [0143.136] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrwv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0143.136] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrwv[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0143.137] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b6c [0143.137] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0143.137] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0143.221] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2b6c, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2b6c, lpOverlapped=0x0) returned 1 [0143.223] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2b70, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2b70, lpOverlapped=0x0) returned 1 [0143.224] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0143.244] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.254] CloseHandle (hObject=0xe4) returned 1 [0143.254] CloseHandle (hObject=0xe0) returned 1 [0143.254] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrwv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrwv[1].jpg.dvodltmf")) returned 0 [0143.255] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrwv[1].jpg.dvodltmf")) returned 0x2020 [0143.255] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457721f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b6c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEfRwv[1].jpg", cAlternateFileName="BBEFRW~1.JPG")) returned 0x2e8598 [0143.255] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457721f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b6c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEfRwv[1].jpg", cAlternateFileName="BBEFRW~1.JPG")) returned 0 [0143.255] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0143.255] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrwv[1].jpg")) returned 1 [0143.256] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrwv[1].jpg")) returned 0xffffffff [0143.256] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45478670, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45478670, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45478670, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2676, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEfwtU[1].jpg", cAlternateFileName="BBEFWT~1.JPG")) returned 1 [0143.256] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefwtu[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0143.257] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefwtu[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0143.257] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2676 [0143.257] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0143.257] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0143.341] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2676, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2676, lpOverlapped=0x0) returned 1 [0143.343] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2680, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2680, lpOverlapped=0x0) returned 1 [0143.344] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0143.369] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.378] CloseHandle (hObject=0xe0) returned 1 [0143.378] CloseHandle (hObject=0xe4) returned 1 [0143.378] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefwtu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefwtu[1].jpg.dvodltmf")) returned 0 [0143.379] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefwtu[1].jpg.dvodltmf")) returned 0x2020 [0143.379] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45478670, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45478670, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45478670, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2676, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEfwtU[1].jpg", cAlternateFileName="BBEFWT~1.JPG")) returned 0x2e8598 [0143.380] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45478670, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45478670, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45478670, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2676, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEfwtU[1].jpg", cAlternateFileName="BBEFWT~1.JPG")) returned 0 [0143.380] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0143.380] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefwtu[1].jpg")) returned 1 [0143.381] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefwtu[1].jpg")) returned 0xffffffff [0143.381] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xb41, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEfY4X[1].jpg", cAlternateFileName="BBEFY4~1.JPG")) returned 1 [0143.381] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefy4x[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0143.381] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefy4x[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0143.382] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb41 [0143.382] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0143.382] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0143.480] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb41, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0xb41, lpOverlapped=0x0) returned 1 [0143.482] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb50, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0xb50, lpOverlapped=0x0) returned 1 [0143.483] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0143.503] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.512] CloseHandle (hObject=0xe4) returned 1 [0143.512] CloseHandle (hObject=0xe0) returned 1 [0143.512] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefy4x[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefy4x[1].jpg.dvodltmf")) returned 0 [0143.513] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefy4x[1].jpg.dvodltmf")) returned 0x2020 [0143.513] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xb41, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEfY4X[1].jpg", cAlternateFileName="BBEFY4~1.JPG")) returned 0x2e8598 [0143.513] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xb41, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEfY4X[1].jpg", cAlternateFileName="BBEFY4~1.JPG")) returned 0 [0143.513] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0143.513] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefy4x[1].jpg")) returned 1 [0143.514] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefy4x[1].jpg")) returned 0xffffffff [0143.514] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x25f6, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEgD9f[1].jpg", cAlternateFileName="BBEGD9~1.JPG")) returned 1 [0143.514] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegd9f[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0143.515] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegd9f[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0143.515] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x25f6 [0143.515] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0143.516] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0143.600] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x25f6, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x25f6, lpOverlapped=0x0) returned 1 [0143.601] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2600, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2600, lpOverlapped=0x0) returned 1 [0143.602] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0143.622] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.633] CloseHandle (hObject=0xe0) returned 1 [0143.633] CloseHandle (hObject=0xe4) returned 1 [0143.633] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegd9f[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegd9f[1].jpg.dvodltmf")) returned 0 [0143.634] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegd9f[1].jpg.dvodltmf")) returned 0x2020 [0143.634] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x25f6, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEgD9f[1].jpg", cAlternateFileName="BBEGD9~1.JPG")) returned 0x2e8598 [0143.634] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x25f6, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEgD9f[1].jpg", cAlternateFileName="BBEGD9~1.JPG")) returned 0 [0143.634] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0143.634] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegd9f[1].jpg")) returned 1 [0143.635] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegd9f[1].jpg")) returned 0xffffffff [0143.635] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x819, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEgJfz[1].jpg", cAlternateFileName="BBEGJF~1.JPG")) returned 1 [0143.635] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegjfz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0143.635] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegjfz[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0143.636] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x819 [0143.636] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0143.636] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0143.723] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x819, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x819, lpOverlapped=0x0) returned 1 [0143.724] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x820, lpOverlapped=0x0) returned 1 [0143.725] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0143.745] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.754] CloseHandle (hObject=0xe4) returned 1 [0143.754] CloseHandle (hObject=0xe0) returned 1 [0143.755] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegjfz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegjfz[1].jpg.dvodltmf")) returned 0 [0143.755] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegjfz[1].jpg.dvodltmf")) returned 0x2020 [0143.755] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x819, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEgJfz[1].jpg", cAlternateFileName="BBEGJF~1.JPG")) returned 0x2e8598 [0143.756] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x819, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEgJfz[1].jpg", cAlternateFileName="BBEGJF~1.JPG")) returned 0 [0143.756] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0143.756] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegjfz[1].jpg")) returned 1 [0143.757] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegjfz[1].jpg")) returned 0xffffffff [0143.757] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b2a450, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b2a450, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b2a450, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x916, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEgsWA[1].jpg", cAlternateFileName="BBEGSW~1.JPG")) returned 1 [0143.757] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegswa[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0143.757] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegswa[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0143.757] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x916 [0143.758] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0143.758] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0143.874] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x916, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x916, lpOverlapped=0x0) returned 1 [0143.876] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x920, lpOverlapped=0x0) returned 1 [0143.876] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0143.896] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.905] CloseHandle (hObject=0xe0) returned 1 [0143.905] CloseHandle (hObject=0xe4) returned 1 [0143.905] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegswa[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegswa[1].jpg.dvodltmf")) returned 0 [0143.906] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegswa[1].jpg.dvodltmf")) returned 0x2020 [0143.906] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b2a450, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b2a450, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b2a450, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x916, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEgsWA[1].jpg", cAlternateFileName="BBEGSW~1.JPG")) returned 0x2e8598 [0143.907] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b2a450, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b2a450, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b2a450, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x916, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBEgsWA[1].jpg", cAlternateFileName="BBEGSW~1.JPG")) returned 0 [0143.907] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0143.907] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegswa[1].jpg")) returned 1 [0143.908] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegswa[1].jpg")) returned 0xffffffff [0143.908] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x918, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBEgX5G[1].jpg", cAlternateFileName="BBEGX5~1.JPG")) returned 1 [0143.908] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegx5g[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0143.908] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegx5g[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0143.908] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x918 [0143.908] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0143.909] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0143.992] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x918, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x918, lpOverlapped=0x0) returned 1 [0143.994] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x920, lpOverlapped=0x0) returned 1 [0143.995] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0144.014] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.023] CloseHandle (hObject=0xe4) returned 1 [0144.023] CloseHandle (hObject=0xe0) returned 1 [0144.024] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegx5g[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegx5g[1].jpg.dvodltmf")) returned 0 [0144.024] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegx5g[1].jpg.dvodltmf")) returned 0x2020 [0144.024] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x918, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEgX5G[1].jpg", cAlternateFileName="BBEGX5~1.JPG")) returned 0x2e8598 [0144.025] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x918, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBEgX5G[1].jpg", cAlternateFileName="BBEGX5~1.JPG")) returned 0 [0144.025] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0144.025] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegx5g[1].jpg")) returned 1 [0144.025] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegx5g[1].jpg")) returned 0xffffffff [0144.026] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51256470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51256470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51256470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3a2, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBih5H[1].png", cAlternateFileName="BBIH5H~1.PNG")) returned 1 [0144.026] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbih5h[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0144.026] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbih5h[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0144.026] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a2 [0144.026] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0144.027] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0144.109] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3a2, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x3a2, lpOverlapped=0x0) returned 1 [0144.111] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x3b0, lpOverlapped=0x0) returned 1 [0144.112] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0144.131] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.140] CloseHandle (hObject=0xe0) returned 1 [0144.140] CloseHandle (hObject=0xe4) returned 1 [0144.140] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbih5h[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbih5h[1].png.dvodltmf")) returned 0 [0144.141] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbih5h[1].png.dvodltmf")) returned 0x2020 [0144.141] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51256470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51256470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51256470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3a2, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBih5H[1].png", cAlternateFileName="BBIH5H~1.PNG")) returned 0x2e8598 [0144.141] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51256470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51256470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51256470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3a2, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBih5H[1].png", cAlternateFileName="BBIH5H~1.PNG")) returned 0 [0144.141] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0144.141] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbih5h[1].png")) returned 1 [0144.142] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbih5h[1].png")) returned 0xffffffff [0144.142] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBmUxRK[1].png", cAlternateFileName="BBMUXR~1.PNG")) returned 1 [0144.142] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbmuxrk[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0144.143] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbmuxrk[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0144.143] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x24c [0144.143] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0144.143] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0144.244] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x24c, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x24c, lpOverlapped=0x0) returned 1 [0144.246] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x250, lpOverlapped=0x0) returned 1 [0144.247] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0144.266] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.276] CloseHandle (hObject=0xe4) returned 1 [0144.276] CloseHandle (hObject=0xe0) returned 1 [0144.276] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbmuxrk[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbmuxrk[1].png.dvodltmf")) returned 0 [0144.277] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbmuxrk[1].png.dvodltmf")) returned 0x2020 [0144.277] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBmUxRK[1].png", cAlternateFileName="BBMUXR~1.PNG")) returned 0x2e8598 [0144.277] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBmUxRK[1].png", cAlternateFileName="BBMUXR~1.PNG")) returned 0 [0144.277] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0144.277] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbmuxrk[1].png")) returned 1 [0144.279] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbmuxrk[1].png")) returned 0xffffffff [0144.279] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459f9950, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459f9950, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459f9950, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x398, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBndhJA[1].png", cAlternateFileName="BBNDHJ~1.PNG")) returned 1 [0144.279] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbndhja[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0144.279] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbndhja[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0144.280] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x398 [0144.280] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0144.280] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0144.422] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x398, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x398, lpOverlapped=0x0) returned 1 [0144.424] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x3a0, lpOverlapped=0x0) returned 1 [0144.425] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0144.444] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.454] CloseHandle (hObject=0xe0) returned 1 [0144.454] CloseHandle (hObject=0xe4) returned 1 [0144.454] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbndhja[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbndhja[1].png.dvodltmf")) returned 0 [0144.455] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbndhja[1].png.dvodltmf")) returned 0x2020 [0144.455] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459f9950, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459f9950, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459f9950, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x398, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBndhJA[1].png", cAlternateFileName="BBNDHJ~1.PNG")) returned 0x2e8598 [0144.455] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459f9950, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459f9950, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459f9950, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x398, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBndhJA[1].png", cAlternateFileName="BBNDHJ~1.PNG")) returned 0 [0144.455] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0144.455] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbndhja[1].png")) returned 1 [0144.456] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbndhja[1].png")) returned 0xffffffff [0144.456] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x230, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBoqF0J[1].png", cAlternateFileName="BBOQF0~1.PNG")) returned 1 [0144.456] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bboqf0j[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0144.457] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bboqf0j[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0144.457] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x230 [0144.457] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0144.457] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0144.556] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x230, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x230, lpOverlapped=0x0) returned 1 [0144.558] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x240, lpOverlapped=0x0) returned 1 [0144.558] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0144.578] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.587] CloseHandle (hObject=0xe4) returned 1 [0144.587] CloseHandle (hObject=0xe0) returned 1 [0144.587] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bboqf0j[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bboqf0j[1].png.dvodltmf")) returned 0 [0144.588] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bboqf0j[1].png.dvodltmf")) returned 0x2020 [0144.588] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x230, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBoqF0J[1].png", cAlternateFileName="BBOQF0~1.PNG")) returned 0x2e8598 [0144.588] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x230, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BBoqF0J[1].png", cAlternateFileName="BBOQF0~1.PNG")) returned 0 [0144.588] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0144.588] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bboqf0j[1].png")) returned 1 [0144.589] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bboqf0j[1].png")) returned 0xffffffff [0144.589] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="BBzjV9E[1].png", cAlternateFileName="BBZJV9~1.PNG")) returned 1 [0144.589] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbzjv9e[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0144.589] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbzjv9e[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0144.590] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x116 [0144.590] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0144.591] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0144.681] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x116, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x116, lpOverlapped=0x0) returned 1 [0144.684] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x120, lpOverlapped=0x0) returned 1 [0144.685] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0144.704] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.714] CloseHandle (hObject=0xe0) returned 1 [0144.714] CloseHandle (hObject=0xe4) returned 1 [0144.714] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbzjv9e[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbzjv9e[1].png.dvodltmf")) returned 0 [0144.715] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbzjv9e[1].png.dvodltmf")) returned 0x2020 [0144.715] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBzjV9E[1].png", cAlternateFileName="BBZJV9~1.PNG")) returned 0x2e8598 [0144.715] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BBzjV9E[1].png", cAlternateFileName="BBZJV9~1.PNG")) returned 0 [0144.715] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0144.715] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbzjv9e[1].png")) returned 1 [0144.716] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbzjv9e[1].png")) returned 0xffffffff [0144.717] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60cdb940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60cdb940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60d4dd60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1fdaf, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="benefits-1[1].jpg", cAlternateFileName="BENEFI~1.JPG")) returned 1 [0144.717] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\benefits-1[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0144.717] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\benefits-1[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0144.717] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1fdaf [0144.718] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0144.718] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0144.802] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1fdaf, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1fdaf, lpOverlapped=0x0) returned 1 [0144.805] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1fdb0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1fdb0, lpOverlapped=0x0) returned 1 [0144.808] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0144.827] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.836] CloseHandle (hObject=0xe4) returned 1 [0144.836] CloseHandle (hObject=0xe0) returned 1 [0144.837] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\benefits-1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\benefits-1[1].jpg.dvodltmf")) returned 0 [0144.837] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\benefits-1[1].jpg.dvodltmf")) returned 0x2020 [0144.837] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60cdb940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60cdb940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60d4dd60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1fdaf, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="benefits-1[1].jpg", cAlternateFileName="BENEFI~1.JPG")) returned 0x2e8598 [0144.838] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60cdb940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60cdb940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60d4dd60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1fdaf, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="benefits-1[1].jpg", cAlternateFileName="BENEFI~1.JPG")) returned 0 [0144.838] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0144.838] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\benefits-1[1].jpg")) returned 1 [0144.839] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\benefits-1[1].jpg")) returned 0xffffffff [0144.839] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6157c900, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6157c900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x615c8bc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12282, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="cb=gapi[1].loaded_1", cAlternateFileName="CB_GAP~1.LOA")) returned 1 [0144.840] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\cb=gapi[1].loaded_1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0144.841] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\cb=gapi[1].loaded_1.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0144.841] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12282 [0144.841] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0144.842] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0144.926] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x12282, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x12282, lpOverlapped=0x0) returned 1 [0144.929] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x12290, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x12290, lpOverlapped=0x0) returned 1 [0144.931] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0144.951] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.960] CloseHandle (hObject=0xe0) returned 1 [0144.960] CloseHandle (hObject=0xe4) returned 1 [0144.960] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\cb=gapi[1].loaded_1"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\cb=gapi[1].loaded_1.dvodltmf")) returned 0 [0144.961] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\cb=gapi[1].loaded_1.dvodltmf")) returned 0x2020 [0144.961] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6157c900, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6157c900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x615c8bc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12282, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="cb=gapi[1].loaded_1", cAlternateFileName="CB_GAP~1.LOA")) returned 0x2e8598 [0144.961] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6157c900, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6157c900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x615c8bc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12282, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="cb=gapi[1].loaded_1", cAlternateFileName="CB_GAP~1.LOA")) returned 0 [0144.961] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0144.961] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\cb=gapi[1].loaded_1")) returned 1 [0144.963] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\cb=gapi[1].loaded_1")) returned 0xffffffff [0144.963] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50fa0830, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x82d8, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="chartbeat[1].js", cAlternateFileName="CHARTB~1.JS")) returned 1 [0144.963] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chartbeat[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0144.963] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chartbeat[1].js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0144.964] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x82d8 [0144.964] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0144.964] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0145.048] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x82d8, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x82d8, lpOverlapped=0x0) returned 1 [0145.051] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x82e0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x82e0, lpOverlapped=0x0) returned 1 [0145.052] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0145.072] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.081] CloseHandle (hObject=0xe4) returned 1 [0145.081] CloseHandle (hObject=0xe0) returned 1 [0145.082] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chartbeat[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chartbeat[1].js.dvodltmf")) returned 0 [0145.082] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chartbeat[1].js.dvodltmf")) returned 0x2020 [0145.082] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50fa0830, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x82d8, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="chartbeat[1].js", cAlternateFileName="CHARTB~1.JS")) returned 0x2e8598 [0145.083] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50fa0830, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x82d8, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="chartbeat[1].js", cAlternateFileName="CHARTB~1.JS")) returned 0 [0145.083] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0145.083] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chartbeat[1].js")) returned 1 [0145.084] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chartbeat[1].js")) returned 0xffffffff [0145.084] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60c8f680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60c8f680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60d01aa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3bf20, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="chrome-installer.min[1].js", cAlternateFileName="CHROME~1.JS")) returned 1 [0145.084] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome-installer.min[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0145.084] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome-installer.min[1].js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0145.085] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3bf20 [0145.085] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0145.085] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0145.169] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3bf20, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x3bf20, lpOverlapped=0x0) returned 1 [0145.174] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3bf30, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x3bf30, lpOverlapped=0x0) returned 1 [0145.178] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0145.198] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.207] CloseHandle (hObject=0xe0) returned 1 [0145.207] CloseHandle (hObject=0xe4) returned 1 [0145.207] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome-installer.min[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome-installer.min[1].js.dvodltmf")) returned 0 [0145.208] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome-installer.min[1].js.dvodltmf")) returned 0x2020 [0145.208] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60c8f680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60c8f680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60d01aa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3bf20, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="chrome-installer.min[1].js", cAlternateFileName="CHROME~1.JS")) returned 0x2e8598 [0145.208] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60c8f680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60c8f680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60d01aa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3bf20, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="chrome-installer.min[1].js", cAlternateFileName="CHROME~1.JS")) returned 0 [0145.208] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0145.208] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome-installer.min[1].js")) returned 1 [0145.210] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome-installer.min[1].js")) returned 0xffffffff [0145.211] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60aec760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60aec760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60aec760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1622, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="chrome_logo_2x[1].png", cAlternateFileName="CHROME~1.PNG")) returned 1 [0145.211] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome_logo_2x[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0145.211] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome_logo_2x[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0145.212] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1622 [0145.212] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0145.212] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0145.296] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1622, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1622, lpOverlapped=0x0) returned 1 [0145.297] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1630, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1630, lpOverlapped=0x0) returned 1 [0145.298] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0145.317] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.327] CloseHandle (hObject=0xe4) returned 1 [0145.327] CloseHandle (hObject=0xe0) returned 1 [0145.327] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome_logo_2x[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome_logo_2x[1].png.dvodltmf")) returned 0 [0145.327] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome_logo_2x[1].png.dvodltmf")) returned 0x2020 [0145.328] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60aec760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60aec760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60aec760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1622, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="chrome_logo_2x[1].png", cAlternateFileName="CHROME~1.PNG")) returned 0x2e8598 [0145.328] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60aec760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60aec760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60aec760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1622, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="chrome_logo_2x[1].png", cAlternateFileName="CHROME~1.PNG")) returned 0 [0145.328] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0145.328] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome_logo_2x[1].png")) returned 1 [0145.329] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome_logo_2x[1].png")) returned 0xffffffff [0145.329] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x610b9d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x610b9d00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x610b9d00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13d, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="close-icon[1].png", cAlternateFileName="CLOSE-~1.PNG")) returned 1 [0145.329] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\close-icon[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0145.329] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\close-icon[1].png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0145.329] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13d [0145.330] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0145.330] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0145.416] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x13d, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x13d, lpOverlapped=0x0) returned 1 [0145.418] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x140, lpOverlapped=0x0) returned 1 [0145.419] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0145.438] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.448] CloseHandle (hObject=0xe0) returned 1 [0145.448] CloseHandle (hObject=0xe4) returned 1 [0145.448] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\close-icon[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\close-icon[1].png.dvodltmf")) returned 0 [0145.449] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\close-icon[1].png.dvodltmf")) returned 0x2020 [0145.449] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x610b9d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x610b9d00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x610b9d00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="close-icon[1].png", cAlternateFileName="CLOSE-~1.PNG")) returned 0x2e8598 [0145.449] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x610b9d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x610b9d00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x610b9d00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="close-icon[1].png", cAlternateFileName="CLOSE-~1.PNG")) returned 0 [0145.449] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0145.449] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\close-icon[1].png")) returned 1 [0145.450] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\close-icon[1].png")) returned 0xffffffff [0145.450] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54e4ae90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54e4ae90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e4ae90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269b2, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="css[1].txt", cAlternateFileName="CSS_1_~1.TXT")) returned 1 [0145.450] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\css[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0145.450] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\css[1].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0145.451] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x269b2 [0145.451] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0145.451] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0145.544] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x269b2, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x269b2, lpOverlapped=0x0) returned 1 [0145.548] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x269c0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x269c0, lpOverlapped=0x0) returned 1 [0145.551] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0145.571] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.580] CloseHandle (hObject=0xe4) returned 1 [0145.580] CloseHandle (hObject=0xe0) returned 1 [0145.580] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\css[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\css[1].txt.dvodltmf")) returned 0 [0145.581] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\css[1].txt.dvodltmf")) returned 0x2020 [0145.581] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54e4ae90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54e4ae90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e4ae90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269b2, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="css[1].txt", cAlternateFileName="CSS_1_~1.TXT")) returned 0x2e8598 [0145.582] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54e4ae90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54e4ae90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e4ae90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269b2, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="css[1].txt", cAlternateFileName="CSS_1_~1.TXT")) returned 0 [0145.582] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0145.582] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\css[1].txt")) returned 1 [0145.583] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\css[1].txt")) returned 0xffffffff [0145.583] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0145.584] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0145.584] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0145.584] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0145.584] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0145.585] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0145.670] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x43, lpOverlapped=0x0) returned 1 [0145.671] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x50, lpOverlapped=0x0) returned 1 [0145.672] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0145.691] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.701] CloseHandle (hObject=0xe0) returned 1 [0145.701] CloseHandle (hObject=0xe4) returned 1 [0145.701] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\desktop.ini.dvodltmf")) returned 0 [0145.702] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\desktop.ini.dvodltmf")) returned 0x2020 [0145.702] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8598 [0145.702] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0145.702] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0145.702] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\desktop.ini")) returned 1 [0145.703] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\desktop.ini")) returned 0xffffffff [0145.703] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf7af630, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf7af630, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf821a50, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x4d5b9, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="ebHtml5Banner[1].js", cAlternateFileName="EBHTML~1.JS")) returned 1 [0145.703] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ebhtml5banner[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0145.704] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ebhtml5banner[1].js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0145.705] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4d5b9 [0145.705] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0145.705] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0145.810] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4d5b9, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x4d5b9, lpOverlapped=0x0) returned 1 [0145.816] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4d5c0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x4d5c0, lpOverlapped=0x0) returned 1 [0145.822] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0145.841] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.851] CloseHandle (hObject=0xe4) returned 1 [0145.851] CloseHandle (hObject=0xe0) returned 1 [0145.851] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ebhtml5banner[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ebhtml5banner[1].js.dvodltmf")) returned 0 [0145.852] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ebhtml5banner[1].js.dvodltmf")) returned 0x2020 [0145.852] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf7af630, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf7af630, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf821a50, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x4d5b9, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ebHtml5Banner[1].js", cAlternateFileName="EBHTML~1.JS")) returned 0x2e8598 [0145.852] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf7af630, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf7af630, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf821a50, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x4d5b9, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ebHtml5Banner[1].js", cAlternateFileName="EBHTML~1.JS")) returned 0 [0145.852] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0145.852] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ebhtml5banner[1].js")) returned 1 [0145.855] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ebhtml5banner[1].js")) returned 0xffffffff [0145.855] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64009240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64009240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6402f3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5244, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="eula-win[1].jpg", cAlternateFileName="EULA-W~1.JPG")) returned 1 [0145.855] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\eula-win[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0145.855] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\eula-win[1].jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0145.856] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5244 [0145.856] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0145.856] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0145.941] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x5244, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x5244, lpOverlapped=0x0) returned 1 [0145.943] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x5250, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x5250, lpOverlapped=0x0) returned 1 [0145.944] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0145.964] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.973] CloseHandle (hObject=0xe0) returned 1 [0145.973] CloseHandle (hObject=0xe4) returned 1 [0145.974] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\eula-win[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\eula-win[1].jpg.dvodltmf")) returned 0 [0145.974] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\eula-win[1].jpg.dvodltmf")) returned 0x2020 [0145.974] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64009240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64009240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6402f3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5244, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="eula-win[1].jpg", cAlternateFileName="EULA-W~1.JPG")) returned 0x2e8598 [0145.975] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64009240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64009240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6402f3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5244, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="eula-win[1].jpg", cAlternateFileName="EULA-W~1.JPG")) returned 0 [0145.975] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0145.975] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\eula-win[1].jpg")) returned 1 [0145.976] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\eula-win[1].jpg")) returned 0xffffffff [0145.976] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe15e7f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe15e7f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe15e7f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1303, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", cAlternateFileName="GETYPE~3")) returned 1 [0145.977] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8c3, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", cAlternateFileName="GETYPE~1")) returned 1 [0145.977] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe138690, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe138690, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe138690, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x972, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", cAlternateFileName="GETYPE~2")) returned 1 [0145.977] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x510ff810, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510ff810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51125970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1762e, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="jquery-1.11.1.min[1].js", cAlternateFileName="JQUERY~1.JS")) returned 1 [0145.977] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\jquery-1.11.1.min[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0145.977] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\jquery-1.11.1.min[1].js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0145.978] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1762e [0145.978] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0145.978] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0146.062] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1762e, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1762e, lpOverlapped=0x0) returned 1 [0146.066] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x17630, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x17630, lpOverlapped=0x0) returned 1 [0146.068] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0146.087] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.096] CloseHandle (hObject=0xe4) returned 1 [0146.096] CloseHandle (hObject=0xe0) returned 1 [0146.097] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\jquery-1.11.1.min[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\jquery-1.11.1.min[1].js.dvodltmf")) returned 0 [0146.097] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\jquery-1.11.1.min[1].js.dvodltmf")) returned 0x2020 [0146.097] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x510ff810, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510ff810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51125970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1762e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="jquery-1.11.1.min[1].js", cAlternateFileName="JQUERY~1.JS")) returned 0x2e8598 [0146.098] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x510ff810, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510ff810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51125970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1762e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="jquery-1.11.1.min[1].js", cAlternateFileName="JQUERY~1.JS")) returned 0 [0146.098] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0146.098] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\jquery-1.11.1.min[1].js")) returned 1 [0146.099] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\jquery-1.11.1.min[1].js")) returned 0xffffffff [0146.099] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5442d110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5442d110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5442d110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="js[1]", cAlternateFileName="JS_1_~1")) returned 1 [0146.099] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44bd95f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44bd95f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44bd95f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="js[2]", cAlternateFileName="JS_2_~1")) returned 1 [0146.099] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d66650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d66650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e70ff0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7154, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="latest[1].eot", cAlternateFileName="LATEST~1.EOT")) returned 1 [0146.099] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[1].eot"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0146.100] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[1].eot.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[1].eot.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0146.101] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7154 [0146.101] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0146.101] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0146.186] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x7154, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x7154, lpOverlapped=0x0) returned 1 [0146.188] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x7160, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x7160, lpOverlapped=0x0) returned 1 [0146.190] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0146.209] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.219] CloseHandle (hObject=0xe0) returned 1 [0146.219] CloseHandle (hObject=0xe4) returned 1 [0146.219] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[1].eot"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[1].eot.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[1].eot.dvodltmf")) returned 0 [0146.220] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[1].eot.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[1].eot.dvodltmf")) returned 0x2020 [0146.220] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[1].eot", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d66650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d66650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e70ff0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7154, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="latest[1].eot", cAlternateFileName="LATEST~1.EOT")) returned 0x2e8598 [0146.220] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d66650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d66650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e70ff0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7154, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="latest[1].eot", cAlternateFileName="LATEST~1.EOT")) returned 0 [0146.220] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0146.220] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[1].eot")) returned 1 [0146.221] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[1].eot")) returned 0xffffffff [0146.221] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d8c7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d8c7b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e97150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6e9b, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="latest[2].eot", cAlternateFileName="LATEST~2.EOT")) returned 1 [0146.221] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[2].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[2].eot"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0146.221] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[2].eot.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[2].eot.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0146.222] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6e9b [0146.222] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0146.222] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0146.306] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x6e9b, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x6e9b, lpOverlapped=0x0) returned 1 [0146.308] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x6ea0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x6ea0, lpOverlapped=0x0) returned 1 [0146.309] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0146.329] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.338] CloseHandle (hObject=0xe4) returned 1 [0146.338] CloseHandle (hObject=0xe0) returned 1 [0146.338] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[2].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[2].eot"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[2].eot.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[2].eot.dvodltmf")) returned 0 [0146.339] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[2].eot.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[2].eot.dvodltmf")) returned 0x2020 [0146.339] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[2].eot", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d8c7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d8c7b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e97150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6e9b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="latest[2].eot", cAlternateFileName="LATEST~2.EOT")) returned 0x2e8598 [0146.339] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d8c7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d8c7b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e97150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6e9b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="latest[2].eot", cAlternateFileName="LATEST~2.EOT")) returned 0 [0146.339] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0146.339] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[2].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[2].eot")) returned 1 [0146.341] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[2].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[2].eot")) returned 0xffffffff [0146.341] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d8c7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d8c7b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e97150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x77b3, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="latest[3].eot", cAlternateFileName="LATEST~3.EOT")) returned 1 [0146.341] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[3].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[3].eot"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0146.341] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[3].eot.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[3].eot.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0146.341] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x77b3 [0146.341] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0146.342] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0146.435] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x77b3, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x77b3, lpOverlapped=0x0) returned 1 [0146.438] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x77c0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x77c0, lpOverlapped=0x0) returned 1 [0146.439] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0146.458] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.468] CloseHandle (hObject=0xe0) returned 1 [0146.468] CloseHandle (hObject=0xe4) returned 1 [0146.468] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[3].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[3].eot"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[3].eot.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[3].eot.dvodltmf")) returned 0 [0146.469] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[3].eot.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[3].eot.dvodltmf")) returned 0x2020 [0146.469] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[3].eot", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d8c7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d8c7b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e97150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x77b3, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="latest[3].eot", cAlternateFileName="LATEST~3.EOT")) returned 0x2e8598 [0146.469] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d8c7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d8c7b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e97150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x77b3, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="latest[3].eot", cAlternateFileName="LATEST~3.EOT")) returned 0 [0146.469] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0146.469] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[3].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[3].eot")) returned 1 [0146.470] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[3].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[3].eot")) returned 0xffffffff [0146.470] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e4e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e4e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53122110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x922, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="msn[1].htm", cAlternateFileName="MSN_1_~1.HTM")) returned 1 [0146.471] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\msn[1].htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0146.471] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\msn[1].htm.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0146.471] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x922 [0146.471] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0146.472] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0146.564] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x922, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x922, lpOverlapped=0x0) returned 1 [0146.565] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x930, lpOverlapped=0x0) returned 1 [0146.566] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0146.585] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.595] CloseHandle (hObject=0xe4) returned 1 [0146.595] CloseHandle (hObject=0xe0) returned 1 [0146.595] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\msn[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\msn[1].htm.dvodltmf")) returned 0 [0146.596] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\msn[1].htm.dvodltmf")) returned 0x2020 [0146.596] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e4e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e4e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53122110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x922, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="msn[1].htm", cAlternateFileName="MSN_1_~1.HTM")) returned 0x2e8598 [0146.596] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e4e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e4e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53122110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x922, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="msn[1].htm", cAlternateFileName="MSN_1_~1.HTM")) returned 0 [0146.596] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0146.596] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\msn[1].htm")) returned 1 [0146.597] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\msn[1].htm")) returned 0xffffffff [0146.597] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6378e3e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6378e3e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x637b4540, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3112, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="rpc_shindig_random[1].js", cAlternateFileName="RPC_SH~1.JS")) returned 1 [0146.597] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\rpc_shindig_random[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\rpc_shindig_random[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0146.597] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\rpc_shindig_random[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\rpc_shindig_random[1].js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0146.598] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3112 [0146.598] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0146.598] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0146.683] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3112, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x3112, lpOverlapped=0x0) returned 1 [0146.698] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3120, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x3120, lpOverlapped=0x0) returned 1 [0146.699] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0146.719] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.728] CloseHandle (hObject=0xe0) returned 1 [0146.728] CloseHandle (hObject=0xe4) returned 1 [0146.728] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\rpc_shindig_random[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\rpc_shindig_random[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\rpc_shindig_random[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\rpc_shindig_random[1].js.dvodltmf")) returned 0 [0146.729] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\rpc_shindig_random[1].js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\rpc_shindig_random[1].js.dvodltmf")) returned 0x2020 [0146.729] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\rpc_shindig_random[1].js", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6378e3e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6378e3e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x637b4540, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3112, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="rpc_shindig_random[1].js", cAlternateFileName="RPC_SH~1.JS")) returned 0x2e8598 [0146.730] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6378e3e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6378e3e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x637b4540, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3112, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="rpc_shindig_random[1].js", cAlternateFileName="RPC_SH~1.JS")) returned 0 [0146.730] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0146.730] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\rpc_shindig_random[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\rpc_shindig_random[1].js")) returned 1 [0146.731] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\rpc_shindig_random[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\rpc_shindig_random[1].js")) returned 0xffffffff [0146.731] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0xbf7d5790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf7d5790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7d5790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="thirdparty[1]", cAlternateFileName="THIRDP~1")) returned 1 [0146.731] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54a20810, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54a20810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54adeef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa33, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="uid[1].htm", cAlternateFileName="UID_1_~1.HTM")) returned 1 [0146.731] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\uid[1].htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0146.731] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\uid[1].htm.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0146.732] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa33 [0146.732] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0146.732] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0146.816] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa33, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0xa33, lpOverlapped=0x0) returned 1 [0146.818] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0xa40, lpOverlapped=0x0) returned 1 [0146.819] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0146.839] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.848] CloseHandle (hObject=0xe4) returned 1 [0146.848] CloseHandle (hObject=0xe0) returned 1 [0146.848] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\uid[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\uid[1].htm.dvodltmf")) returned 0 [0146.849] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\uid[1].htm.dvodltmf")) returned 0x2020 [0146.849] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54a20810, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54a20810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54adeef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa33, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="uid[1].htm", cAlternateFileName="UID_1_~1.HTM")) returned 0x2e8598 [0146.849] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54a20810, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54a20810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54adeef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa33, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="uid[1].htm", cAlternateFileName="UID_1_~1.HTM")) returned 0 [0146.849] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0146.849] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\uid[1].htm")) returned 1 [0146.850] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\uid[1].htm")) returned 0xffffffff [0146.850] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe5d5130, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe5d5130, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe5d5130, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x3325, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="v2[1]", cAlternateFileName="V2_1_~1")) returned 1 [0146.850] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54c35b50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54c35b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54c5bcb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24fea, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="wc-addons[1].css", cAlternateFileName="WC-ADD~1.CSS")) returned 1 [0146.850] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\wc-addons[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\wc-addons[1].css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0146.851] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\wc-addons[1].css.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\wc-addons[1].css.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0146.851] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x24fea [0146.851] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0146.851] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0146.941] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x24fea, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x24fea, lpOverlapped=0x0) returned 1 [0146.948] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x24ff0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x24ff0, lpOverlapped=0x0) returned 1 [0146.951] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0146.971] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.982] CloseHandle (hObject=0xe0) returned 1 [0146.982] CloseHandle (hObject=0xe4) returned 1 [0146.982] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\wc-addons[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\wc-addons[1].css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\wc-addons[1].css.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\wc-addons[1].css.dvodltmf")) returned 0 [0146.983] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\wc-addons[1].css.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\wc-addons[1].css.dvodltmf")) returned 0x2020 [0146.983] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\wc-addons[1].css", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54c35b50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54c35b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54c5bcb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24fea, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="wc-addons[1].css", cAlternateFileName="WC-ADD~1.CSS")) returned 0x2e8598 [0146.983] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54c35b50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54c35b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54c5bcb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24fea, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="wc-addons[1].css", cAlternateFileName="WC-ADD~1.CSS")) returned 0 [0146.983] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0146.983] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\wc-addons[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\wc-addons[1].css")) returned 1 [0146.985] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\wc-addons[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\wc-addons[1].css")) returned 0xffffffff [0146.985] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54c35b50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54c35b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54c5bcb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24fea, dwReserved0=0x2ed3f8, dwReserved1=0x18e44c, cFileName="wc-addons[1].css", cAlternateFileName="WC-ADD~1.CSS")) returned 0 [0146.985] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0146.985] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YG1R61Z8", cAlternateFileName="")) returned 0 [0146.985] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0146.985] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x342d3841, dwReserved1=0x2d414133, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0146.985] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0146.986] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0146.988] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0146.988] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0146.988] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0147.071] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x43, lpOverlapped=0x0) returned 1 [0147.072] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x50, lpOverlapped=0x0) returned 1 [0147.073] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0147.092] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.101] CloseHandle (hObject=0xf0) returned 1 [0147.102] CloseHandle (hObject=0xf4) returned 1 [0147.102] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\desktop.ini.dvodltmf")) returned 0 [0147.102] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\desktop.ini.dvodltmf")) returned 0x2020 [0147.102] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8518 [0147.103] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0147.103] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0147.103] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\desktop.ini")) returned 1 [0147.104] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\desktop.ini")) returned 0xffffffff [0147.104] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51445650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 1 [0147.104] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\msimgsiz.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0147.104] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\msimgsiz.dat.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.104] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4000 [0147.104] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0147.105] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0147.188] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x4000, lpOverlapped=0x0) returned 1 [0147.190] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x4010, lpOverlapped=0x0) returned 1 [0147.191] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0147.210] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.219] CloseHandle (hObject=0xf4) returned 1 [0147.219] CloseHandle (hObject=0xf0) returned 1 [0147.219] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\msimgsiz.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\msimgsiz.dat.dvodltmf")) returned 0 [0147.220] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\msimgsiz.dat.dvodltmf")) returned 0x2020 [0147.220] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51445650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 0x2e8518 [0147.220] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51445650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 0 [0147.220] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0147.220] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\msimgsiz.dat")) returned 1 [0147.221] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\msimgsiz.dat")) returned 0xffffffff [0147.221] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51445650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 0 [0147.222] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0147.222] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e1354, dwReserved1=0x18eb84, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 1 [0147.222] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0147.222] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="..", cAlternateFileName="")) returned 1 [0147.222] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="C", cAlternateFileName="")) returned 1 [0147.222] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xce, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0147.223] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xce, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.223] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xce, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0147.223] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0147.223] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.223] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 1 [0147.223] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8598 [0147.223] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.223] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0147.223] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e85d8 [0147.224] FindNextFileA (in: hFindFile=0x2e85d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.224] FindNextFileA (in: hFindFile=0x2e85d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1 [0147.224] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*.*", lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName=".", cAlternateFileName="")) returned 0x2e8618 [0147.224] FindNextFileA (in: hFindFile=0x2e8618, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName="..", cAlternateFileName="")) returned 1 [0147.225] FindNextFileA (in: hFindFile=0x2e8618, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0147.225] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*", lpFindFileData=0x18dd18 | out: lpFindFileData=0x18dd18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName=".", cAlternateFileName="")) returned 0x2e8658 [0147.225] FindNextFileA (in: hFindFile=0x2e8658, lpFindFileData=0x18dd18 | out: lpFindFileData=0x18dd18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName="..", cAlternateFileName="")) returned 1 [0147.226] FindNextFileA (in: hFindFile=0x2e8658, lpFindFileData=0x18dd18 | out: lpFindFileData=0x18dd18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName="Windows", cAlternateFileName="")) returned 1 [0147.226] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*.*", lpFindFileData=0x18dab0 | out: lpFindFileData=0x18dab0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2f0fe8, dwReserved1=0x2c0000, cFileName=".", cAlternateFileName="")) returned 0x2e8698 [0147.226] FindNextFileA (in: hFindFile=0x2e8698, lpFindFileData=0x18dab0 | out: lpFindFileData=0x18dab0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2f0fe8, dwReserved1=0x2c0000, cFileName="..", cAlternateFileName="")) returned 1 [0147.226] FindNextFileA (in: hFindFile=0x2e8698, lpFindFileData=0x18dab0 | out: lpFindFileData=0x18dab0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2f0fe8, dwReserved1=0x2c0000, cFileName="PrivacIE", cAlternateFileName="")) returned 1 [0147.226] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*.*", lpFindFileData=0x18d848 | out: lpFindFileData=0x18d848*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName=".", cAlternateFileName="")) returned 0x2e86d8 [0147.226] FindNextFileA (in: hFindFile=0x2e86d8, lpFindFileData=0x18d848 | out: lpFindFileData=0x18d848*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName="..", cAlternateFileName="")) returned 1 [0147.226] FindNextFileA (in: hFindFile=0x2e86d8, lpFindFileData=0x18d848 | out: lpFindFileData=0x18d848*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName="Low", cAlternateFileName="")) returned 1 [0147.226] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*.*", lpFindFileData=0x18d5e0 | out: lpFindFileData=0x18d5e0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2f2fe8, dwReserved1=0x2c0000, cFileName=".", cAlternateFileName="")) returned 0x2e8718 [0147.227] FindNextFileA (in: hFindFile=0x2e8718, lpFindFileData=0x18d5e0 | out: lpFindFileData=0x18d5e0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2f2fe8, dwReserved1=0x2c0000, cFileName="..", cAlternateFileName="")) returned 1 [0147.227] FindNextFileA (in: hFindFile=0x2e8718, lpFindFileData=0x18d5e0 | out: lpFindFileData=0x18d5e0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2f2fe8, dwReserved1=0x2c0000, cFileName="..", cAlternateFileName="")) returned 0 [0147.227] FindClose (in: hFindFile=0x2e8718 | out: hFindFile=0x2e8718) returned 1 [0147.227] FindNextFileA (in: hFindFile=0x2e86d8, lpFindFileData=0x18d848 | out: lpFindFileData=0x18d848*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName="Low", cAlternateFileName="")) returned 0 [0147.227] FindClose (in: hFindFile=0x2e86d8 | out: hFindFile=0x2e86d8) returned 1 [0147.227] FindNextFileA (in: hFindFile=0x2e8698, lpFindFileData=0x18dab0 | out: lpFindFileData=0x18dab0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2f0fe8, dwReserved1=0x2c0000, cFileName="PrivacIE", cAlternateFileName="")) returned 0 [0147.227] FindClose (in: hFindFile=0x2e8698 | out: hFindFile=0x2e8698) returned 1 [0147.227] FindNextFileA (in: hFindFile=0x2e8658, lpFindFileData=0x18dd18 | out: lpFindFileData=0x18dd18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName="Windows", cAlternateFileName="")) returned 0 [0147.227] FindClose (in: hFindFile=0x2e8658 | out: hFindFile=0x2e8658) returned 1 [0147.227] FindNextFileA (in: hFindFile=0x2e8618, lpFindFileData=0x18df80 | out: lpFindFileData=0x18df80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0147.227] FindClose (in: hFindFile=0x2e8618 | out: hFindFile=0x2e8618) returned 1 [0147.227] FindNextFileA (in: hFindFile=0x2e85d8, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0147.227] FindClose (in: hFindFile=0x2e85d8 | out: hFindFile=0x2e85d8) returned 1 [0147.227] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0 [0147.227] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0147.227] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0 [0147.227] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0147.227] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xce, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0147.228] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0147.228] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23d8, dwReserved1=0x18e91c, cFileName="C", cAlternateFileName="")) returned 0 [0147.228] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0147.228] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e1354, dwReserved1=0x18eb84, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 0 [0147.228] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0147.228] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e7264, dwReserved1=0x5f626262, cFileName="Themes", cAlternateFileName="")) returned 1 [0147.228] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e1354, dwReserved1=0x18eb84, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0147.228] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e1354, dwReserved1=0x18eb84, cFileName="..", cAlternateFileName="")) returned 1 [0147.229] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d6bf40, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x70a, dwReserved0=0x2e1354, dwReserved1=0x18eb84, cFileName="Custom.theme", cAlternateFileName="CUSTOM~1.THE")) returned 1 [0147.229] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\themes\\custom.theme"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0147.230] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\themes\\custom.theme.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.230] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x70a [0147.230] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0147.230] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0147.331] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x70a, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x70a, lpOverlapped=0x0) returned 1 [0147.332] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x710, lpOverlapped=0x0) returned 1 [0147.333] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0147.400] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.410] CloseHandle (hObject=0xe8) returned 1 [0147.410] CloseHandle (hObject=0xf0) returned 1 [0147.410] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\themes\\custom.theme"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\themes\\custom.theme.dvodltmf")) returned 0 [0147.411] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\themes\\custom.theme.dvodltmf")) returned 0x2020 [0147.411] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d6bf40, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x70a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Custom.theme", cAlternateFileName="CUSTOM~1.THE")) returned 0x2e84d8 [0147.411] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d6bf40, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x70a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Custom.theme", cAlternateFileName="CUSTOM~1.THE")) returned 0 [0147.411] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0147.411] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\themes\\custom.theme")) returned 1 [0147.412] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\themes\\custom.theme")) returned 0xffffffff [0147.412] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d6bf40, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x70a, dwReserved0=0x2e1354, dwReserved1=0x18eb84, cFileName="Custom.theme", cAlternateFileName="CUSTOM~1.THE")) returned 0 [0147.412] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0147.412] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c4d89a0, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2c4d89a0, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x642e7265, dwReserved1=0x5f626262, cFileName="UsrClass.dat", cAlternateFileName="")) returned 1 [0147.412] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0147.412] CloseHandle (hObject=0xffffffff) returned 0 [0147.412] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat.dvodltmf")) returned 0 [0147.412] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat.dvodltmf")) returned 0xffffffff [0147.412] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c4d89a0, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2c4d89a0, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="UsrClass.dat", cAlternateFileName="")) returned 0x2e8498 [0147.413] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c4d89a0, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2c4d89a0, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="UsrClass.dat", cAlternateFileName="")) returned 0 [0147.413] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0147.413] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat")) returned 0 [0147.413] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat")) returned 0x22 [0147.413] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c3ce000, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat.LOG1", cAlternateFileName="USRCLA~2.LOG")) returned 1 [0147.413] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0147.413] CloseHandle (hObject=0xffffffff) returned 0 [0147.413] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat.log1"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat.log1.dvodltmf")) returned 0 [0147.413] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat.log1.dvodltmf")) returned 0xffffffff [0147.413] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c3ce000, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="UsrClass.dat.LOG1", cAlternateFileName="USRCLA~2.LOG")) returned 0x2e8498 [0147.413] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c3ce000, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="UsrClass.dat.LOG1", cAlternateFileName="USRCLA~2.LOG")) returned 0 [0147.413] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0147.413] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat.log1")) returned 0 [0147.413] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat.log1")) returned 0x2026 [0147.413] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9c5705f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e73f0, dwReserved1=0x18edec, cFileName="UsrClass.dat.LOG2", cAlternateFileName="USRCLA~1.LOG")) returned 1 [0147.414] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0147.414] CloseHandle (hObject=0xffffffff) returned 0 [0147.414] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat.log2"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat.log2.dvodltmf")) returned 0 [0147.414] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat.log2.dvodltmf")) returned 0xffffffff [0147.414] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9c5705f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="UsrClass.dat.LOG2", cAlternateFileName="USRCLA~1.LOG")) returned 0x2e8498 [0147.414] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9c5705f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="UsrClass.dat.LOG2", cAlternateFileName="USRCLA~1.LOG")) returned 0 [0147.414] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0147.414] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat.log2")) returned 0 [0147.414] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat.log2")) returned 0x2026 [0147.414] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x962222ec, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x2e73f0, dwReserved1=0x18edec, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf", cAlternateFileName="USRCLA~1.BLF")) returned 1 [0147.414] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tm.blf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0147.414] CloseHandle (hObject=0xffffffff) returned 0 [0147.414] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tm.blf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tm.blf.dvodltmf")) returned 0 [0147.414] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tm.blf.dvodltmf")) returned 0xffffffff [0147.415] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x962222ec, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf", cAlternateFileName="USRCLA~1.BLF")) returned 0x2e8498 [0147.415] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x962222ec, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf", cAlternateFileName="USRCLA~1.BLF")) returned 0 [0147.415] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0147.415] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tm.blf")) returned 0 [0147.415] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tm.blf")) returned 0x2026 [0147.415] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x2e73f0, dwReserved1=0x18edec, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="USRCLA~2.REG")) returned 1 [0147.415] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000001.regtrans-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0147.415] CloseHandle (hObject=0xffffffff) returned 0 [0147.415] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000001.regtrans-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000001.regtrans-ms.dvodltmf")) returned 0 [0147.415] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000001.regtrans-ms.dvodltmf")) returned 0xffffffff [0147.415] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="USRCLA~2.REG")) returned 0x2e8498 [0147.415] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="USRCLA~2.REG")) returned 0 [0147.415] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0147.415] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000001.regtrans-ms")) returned 0 [0147.416] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000001.regtrans-ms")) returned 0x2026 [0147.416] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x2e73f0, dwReserved1=0x18edec, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="USRCLA~1.REG")) returned 1 [0147.416] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000002.regtrans-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0147.416] CloseHandle (hObject=0xffffffff) returned 0 [0147.416] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000002.regtrans-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000002.regtrans-ms.dvodltmf")) returned 0 [0147.416] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000002.regtrans-ms.dvodltmf")) returned 0xffffffff [0147.416] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="USRCLA~1.REG")) returned 0x2e8498 [0147.416] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="USRCLA~1.REG")) returned 0 [0147.416] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0147.416] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000002.regtrans-ms")) returned 0 [0147.416] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000002.regtrans-ms")) returned 0x2026 [0147.416] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e73f0, dwReserved1=0x18edec, cFileName="WER", cAlternateFileName="")) returned 1 [0147.416] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x138, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0147.417] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x138, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.417] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x138, dwReserved1=0x0, cFileName="ERC", cAlternateFileName="")) returned 1 [0147.417] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x660030, dwReserved1=0x640036, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0147.417] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x660030, dwReserved1=0x640036, cFileName="..", cAlternateFileName="")) returned 1 [0147.417] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x660030, dwReserved1=0x640036, cFileName="..", cAlternateFileName="")) returned 0 [0147.417] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0147.417] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x138, dwReserved1=0x0, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 1 [0147.417] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x660030, dwReserved1=0x640036, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0147.418] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x660030, dwReserved1=0x640036, cFileName="..", cAlternateFileName="")) returned 1 [0147.418] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x660030, dwReserved1=0x640036, cFileName="..", cAlternateFileName="")) returned 0 [0147.418] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0147.418] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x138, dwReserved1=0x0, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 0 [0147.418] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0147.418] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa734ff0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa734ff0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa734ff0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e6576, dwReserved1=0x18edec, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 1 [0147.418] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WindowsUpdate.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\windowsupdate.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0147.429] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WindowsUpdate.log.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\windowsupdate.log.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.430] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0147.430] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0147.431] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0147.564] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x10, lpOverlapped=0x0) returned 1 [0147.565] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0147.585] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.595] CloseHandle (hObject=0xec) returned 1 [0147.595] CloseHandle (hObject=0xf0) returned 1 [0147.595] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WindowsUpdate.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\windowsupdate.log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WindowsUpdate.log.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\windowsupdate.log.dvodltmf")) returned 0 [0147.596] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WindowsUpdate.log.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\windowsupdate.log.dvodltmf")) returned 0x2020 [0147.596] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WindowsUpdate.log", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa734ff0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa734ff0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa734ff0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 0x2e8498 [0147.596] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa734ff0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa734ff0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa734ff0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 0 [0147.596] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0147.596] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WindowsUpdate.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\windowsupdate.log")) returned 1 [0147.596] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WindowsUpdate.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\windowsupdate.log")) returned 0xffffffff [0147.596] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa734ff0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa734ff0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa734ff0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e6576, dwReserved1=0x18edec, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 0 [0147.597] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0147.597] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c881c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c2e6574, dwReserved1=0x6137676f, cFileName="Windows Mail", cAlternateFileName="WINDOW~3")) returned 1 [0147.597] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c881c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e73f0, dwReserved1=0x18edec, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0147.599] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c881c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e73f0, dwReserved1=0x18edec, cFileName="..", cAlternateFileName="")) returned 1 [0147.599] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x5e4, dwReserved0=0x2e73f0, dwReserved1=0x18edec, cFileName="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", cAlternateFileName="ACCOUN~3.OEA")) returned 1 [0147.599] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.599] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0147.600] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5e4 [0147.600] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0147.600] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0147.686] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x5e4, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x5e4, lpOverlapped=0x0) returned 1 [0147.687] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x5f0, lpOverlapped=0x0) returned 1 [0147.688] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0147.708] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.717] CloseHandle (hObject=0xf0) returned 1 [0147.717] CloseHandle (hObject=0xec) returned 1 [0147.717] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount.dvodltmf")) returned 0 [0147.718] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount.dvodltmf")) returned 0x2020 [0147.718] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x5e4, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", cAlternateFileName="ACCOUN~3.OEA")) returned 0x2e8498 [0147.718] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x5e4, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", cAlternateFileName="ACCOUN~3.OEA")) returned 0 [0147.718] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0147.718] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount")) returned 1 [0147.719] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount")) returned 0xffffffff [0147.719] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf657b4d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x2e63e8, dwReserved1=0x18edec, cFileName="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", cAlternateFileName="ACCOUN~2.OEA")) returned 1 [0147.719] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0147.720] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.720] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2a0 [0147.720] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0147.720] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0147.828] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2a0, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x2a0, lpOverlapped=0x0) returned 1 [0147.829] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x2b0, lpOverlapped=0x0) returned 1 [0147.830] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0147.850] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.860] CloseHandle (hObject=0xec) returned 1 [0147.860] CloseHandle (hObject=0xf0) returned 1 [0147.860] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount.dvodltmf")) returned 0 [0147.861] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount.dvodltmf")) returned 0x2020 [0147.861] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf657b4d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", cAlternateFileName="ACCOUN~2.OEA")) returned 0x2e8498 [0147.861] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf657b4d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", cAlternateFileName="ACCOUN~2.OEA")) returned 0 [0147.861] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0147.861] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount")) returned 1 [0147.862] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount")) returned 0xffffffff [0147.862] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67b6975, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x2e63e8, dwReserved1=0x18edec, cFileName="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", cAlternateFileName="ACCOUN~1.OEA")) returned 1 [0147.862] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0147.867] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0147.877] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6c8 [0147.877] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0147.878] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0147.962] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x6c8, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x6c8, lpOverlapped=0x0) returned 1 [0147.963] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x6d0, lpOverlapped=0x0) returned 1 [0147.964] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0147.984] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.993] CloseHandle (hObject=0xf0) returned 1 [0147.993] CloseHandle (hObject=0xec) returned 1 [0147.993] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount.dvodltmf")) returned 0 [0147.994] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount.dvodltmf")) returned 0x2020 [0147.994] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67b6975, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", cAlternateFileName="ACCOUN~1.OEA")) returned 0x2e8498 [0147.994] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67b6975, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", cAlternateFileName="ACCOUN~1.OEA")) returned 0 [0147.994] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0147.994] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount")) returned 1 [0147.995] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount")) returned 0xffffffff [0147.995] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b9ed580, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9ed580, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e63e8, dwReserved1=0x18edec, cFileName="Backup", cAlternateFileName="")) returned 1 [0147.995] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b9ed580, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9ed580, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0147.996] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b9ed580, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9ed580, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.996] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf4, dwReserved1=0x0, cFileName="old", cAlternateFileName="")) returned 1 [0147.996] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x330037, dwReserved1=0x2d0037, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0147.997] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x330037, dwReserved1=0x2d0037, cFileName="..", cAlternateFileName="")) returned 1 [0147.997] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f2de8d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x330037, dwReserved1=0x2d0037, cFileName="edb00001.log", cAlternateFileName="")) returned 1 [0147.997] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\edb00001.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\edb00001.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0147.997] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\edb00001.log.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\edb00001.log.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0147.998] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x200000 [0147.998] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0147.998] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0148.083] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x200000, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x200000, lpOverlapped=0x0) returned 1 [0148.123] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x200010, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x200010, lpOverlapped=0x0) returned 1 [0148.163] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0148.183] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.192] CloseHandle (hObject=0xe8) returned 1 [0148.192] CloseHandle (hObject=0xf4) returned 1 [0148.193] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\edb00001.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\edb00001.log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\edb00001.log.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\edb00001.log.dvodltmf")) returned 0 [0148.193] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\edb00001.log.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\edb00001.log.dvodltmf")) returned 0x2020 [0148.194] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\edb00001.log", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f2de8d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="edb00001.log", cAlternateFileName="")) returned 0x2e8518 [0148.194] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f2de8d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="edb00001.log", cAlternateFileName="")) returned 0 [0148.194] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0148.194] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\edb00001.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\edb00001.log")) returned 1 [0148.202] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\edb00001.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\edb00001.log")) returned 0xffffffff [0148.202] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2ab7545, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x206000, dwReserved0=0x2e63e8, dwReserved1=0x18e91c, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 1 [0148.202] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.msmessagestore"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0148.202] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.msmessagestore.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0148.203] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x206000 [0148.203] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0148.203] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0148.293] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x206000, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x206000, lpOverlapped=0x0) returned 1 [0148.356] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x206010, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x206010, lpOverlapped=0x0) returned 1 [0148.402] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0148.421] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.431] CloseHandle (hObject=0xf4) returned 1 [0148.431] CloseHandle (hObject=0xe8) returned 1 [0148.431] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.msmessagestore"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.msmessagestore.dvodltmf")) returned 0 [0148.432] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.msmessagestore.dvodltmf")) returned 0x2020 [0148.432] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2ab7545, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x206000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 0x2e8518 [0148.432] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2ab7545, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x206000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 0 [0148.432] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0148.432] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.msmessagestore")) returned 1 [0148.433] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.msmessagestore")) returned 0xffffffff [0148.433] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2fec56f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2e63e8, dwReserved1=0x18e91c, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 1 [0148.433] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.pat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0148.434] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.pat.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0148.434] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4000 [0148.434] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0148.434] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0148.528] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x4000, lpOverlapped=0x0) returned 1 [0148.530] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x4010, lpOverlapped=0x0) returned 1 [0148.531] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0148.551] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.570] CloseHandle (hObject=0xe8) returned 1 [0148.570] CloseHandle (hObject=0xf4) returned 1 [0148.571] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.pat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.pat.dvodltmf")) returned 0 [0148.571] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.pat.dvodltmf")) returned 0x2020 [0148.571] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2fec56f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0x2e8518 [0148.572] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2fec56f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0 [0148.572] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0148.572] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.pat")) returned 1 [0148.573] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.pat")) returned 0xffffffff [0148.573] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2fec56f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2e63e8, dwReserved1=0x18e91c, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0 [0148.573] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0148.573] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf4, dwReserved1=0x0, cFileName="old", cAlternateFileName="")) returned 0 [0148.573] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0148.573] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x2e63e8, dwReserved1=0x18edec, cFileName="edb.chk", cAlternateFileName="")) returned 1 [0148.573] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.chk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0148.573] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.chk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0148.574] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2000 [0148.574] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0148.574] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0148.661] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x2000, lpOverlapped=0x0) returned 1 [0148.663] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x2010, lpOverlapped=0x0) returned 1 [0148.665] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0148.684] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.694] CloseHandle (hObject=0xec) returned 1 [0148.694] CloseHandle (hObject=0xf0) returned 1 [0148.694] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.chk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.chk.dvodltmf")) returned 0 [0148.695] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.chk.dvodltmf")) returned 0x2020 [0148.695] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="edb.chk", cAlternateFileName="")) returned 0x2e8498 [0148.695] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="edb.chk", cAlternateFileName="")) returned 0 [0148.695] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0148.695] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.chk")) returned 1 [0148.696] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.chk")) returned 0xffffffff [0148.696] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb.log", cAlternateFileName="")) returned 1 [0148.696] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0148.696] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.log.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0148.697] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x200000 [0148.697] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0148.697] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0148.782] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x200000, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x200000, lpOverlapped=0x0) returned 1 [0148.824] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x200010, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x200010, lpOverlapped=0x0) returned 1 [0148.864] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0148.884] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.893] CloseHandle (hObject=0xf0) returned 1 [0148.893] CloseHandle (hObject=0xec) returned 1 [0148.893] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.log.dvodltmf")) returned 0 [0148.894] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.log.dvodltmf")) returned 0x2020 [0148.894] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="edb.log", cAlternateFileName="")) returned 0x2e8498 [0148.894] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="edb.log", cAlternateFileName="")) returned 0 [0148.894] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0148.894] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.log")) returned 1 [0148.903] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.log")) returned 0xffffffff [0148.903] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2b29966, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb00001.log", cAlternateFileName="")) returned 1 [0148.903] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb00001.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0148.903] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb00001.log.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0148.904] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x200000 [0148.904] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0148.904] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0148.987] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x200000, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x200000, lpOverlapped=0x0) returned 1 [0149.028] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x200010, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x200010, lpOverlapped=0x0) returned 1 [0149.078] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0149.098] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.107] CloseHandle (hObject=0xec) returned 1 [0149.107] CloseHandle (hObject=0xf0) returned 1 [0149.107] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb00001.log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb00001.log.dvodltmf")) returned 0 [0149.108] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb00001.log.dvodltmf")) returned 0x2020 [0149.108] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2b29966, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="edb00001.log", cAlternateFileName="")) returned 0x2e8498 [0149.109] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2b29966, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="edb00001.log", cAlternateFileName="")) returned 0 [0149.109] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0149.109] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb00001.log")) returned 1 [0149.117] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb00001.log")) returned 0xffffffff [0149.117] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2027392, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x2e63e8, dwReserved1=0x18edec, cFileName="edbres00001.jrs", cAlternateFileName="EDBRES~2.JRS")) returned 1 [0149.117] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.117] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0149.118] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x200000 [0149.118] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0149.118] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0149.201] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x200000, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x200000, lpOverlapped=0x0) returned 1 [0149.250] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x200010, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x200010, lpOverlapped=0x0) returned 1 [0149.291] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0149.311] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.321] CloseHandle (hObject=0xf0) returned 1 [0149.321] CloseHandle (hObject=0xec) returned 1 [0149.321] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs.dvodltmf")) returned 0 [0149.322] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs.dvodltmf")) returned 0x2020 [0149.322] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2027392, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="edbres00001.jrs", cAlternateFileName="EDBRES~2.JRS")) returned 0x2e8498 [0149.323] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2027392, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="edbres00001.jrs", cAlternateFileName="EDBRES~2.JRS")) returned 0 [0149.323] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0149.323] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs")) returned 1 [0149.331] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs")) returned 0xffffffff [0149.331] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2216575, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x2e63e8, dwReserved1=0x18edec, cFileName="edbres00002.jrs", cAlternateFileName="EDBRES~1.JRS")) returned 1 [0149.331] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0149.332] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.333] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x200000 [0149.333] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0149.334] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0149.424] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x200000, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x200000, lpOverlapped=0x0) returned 1 [0149.464] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x200010, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x200010, lpOverlapped=0x0) returned 1 [0149.524] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0149.572] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.581] CloseHandle (hObject=0xec) returned 1 [0149.581] CloseHandle (hObject=0xf0) returned 1 [0149.581] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs.dvodltmf")) returned 0 [0149.582] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs.dvodltmf")) returned 0x2020 [0149.583] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2216575, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="edbres00002.jrs", cAlternateFileName="EDBRES~1.JRS")) returned 0x2e8498 [0149.583] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2216575, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="edbres00002.jrs", cAlternateFileName="EDBRES~1.JRS")) returned 0 [0149.583] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0149.583] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs")) returned 1 [0149.591] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs")) returned 0xffffffff [0149.591] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x2e63e8, dwReserved1=0x18edec, cFileName="oeold.xml", cAlternateFileName="")) returned 1 [0149.591] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\oeold.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.592] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\oeold.xml.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0149.592] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x104 [0149.592] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0149.593] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0149.701] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x104, lpOverlapped=0x0) returned 1 [0149.706] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x110, lpOverlapped=0x0) returned 1 [0149.707] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0149.732] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.747] CloseHandle (hObject=0xf0) returned 1 [0149.748] CloseHandle (hObject=0xec) returned 1 [0149.748] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\oeold.xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\oeold.xml.dvodltmf")) returned 0 [0149.749] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\oeold.xml.dvodltmf")) returned 0x2020 [0149.749] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="oeold.xml", cAlternateFileName="")) returned 0x2e8498 [0149.749] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="oeold.xml", cAlternateFileName="")) returned 0 [0149.749] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0149.749] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\oeold.xml")) returned 1 [0149.750] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\oeold.xml")) returned 0xffffffff [0149.750] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e63e8, dwReserved1=0x18edec, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0149.750] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0149.754] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.755] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x98, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0149.755] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.755] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0149.756] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xff [0149.756] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0149.756] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0149.858] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xff, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xff, lpOverlapped=0x0) returned 1 [0149.859] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x100, lpOverlapped=0x0) returned 1 [0149.860] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0149.885] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.895] CloseHandle (hObject=0xf0) returned 1 [0149.895] CloseHandle (hObject=0xf4) returned 1 [0149.895] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm.dvodltmf")) returned 0 [0149.896] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm.dvodltmf")) returned 0x2020 [0149.896] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Bears.htm", cAlternateFileName="")) returned 0x2e84d8 [0149.896] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Bears.htm", cAlternateFileName="")) returned 0 [0149.896] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0149.896] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm")) returned 1 [0149.897] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm")) returned 0xffffffff [0149.897] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x2e63e8, dwReserved1=0x18eb84, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0149.897] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0149.901] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.901] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x432 [0149.902] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0149.902] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0149.987] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x432, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x432, lpOverlapped=0x0) returned 1 [0149.989] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x440, lpOverlapped=0x0) returned 1 [0149.990] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0150.009] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.018] CloseHandle (hObject=0xf4) returned 1 [0150.019] CloseHandle (hObject=0xf0) returned 1 [0150.019] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg.dvodltmf")) returned 0 [0150.020] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg.dvodltmf")) returned 0x2020 [0150.020] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Bears.jpg", cAlternateFileName="")) returned 0x2e84d8 [0150.021] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Bears.jpg", cAlternateFileName="")) returned 0 [0150.021] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0150.021] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg")) returned 1 [0150.021] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg")) returned 0xffffffff [0150.022] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x2e63e8, dwReserved1=0x18eb84, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0150.022] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.022] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0150.022] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x285 [0150.022] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0150.023] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0150.155] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x285, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x285, lpOverlapped=0x0) returned 1 [0150.156] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x290, lpOverlapped=0x0) returned 1 [0150.157] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0150.177] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.186] CloseHandle (hObject=0xf0) returned 1 [0150.186] CloseHandle (hObject=0xf4) returned 1 [0150.186] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini.dvodltmf")) returned 0 [0150.187] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini.dvodltmf")) returned 0x2020 [0150.187] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x2e84d8 [0150.187] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0150.187] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0150.187] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini")) returned 1 [0150.188] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini")) returned 0xffffffff [0150.188] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x2e63e8, dwReserved1=0x18eb84, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0150.188] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0150.188] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.189] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe7 [0150.189] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0150.189] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0150.281] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe7, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xe7, lpOverlapped=0x0) returned 1 [0150.282] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xf0, lpOverlapped=0x0) returned 1 [0150.283] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0150.310] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.319] CloseHandle (hObject=0xf4) returned 1 [0150.319] CloseHandle (hObject=0xf0) returned 1 [0150.319] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm.dvodltmf")) returned 0 [0150.320] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm.dvodltmf")) returned 0x2020 [0150.320] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Garden.htm", cAlternateFileName="")) returned 0x2e84d8 [0150.320] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Garden.htm", cAlternateFileName="")) returned 0 [0150.321] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0150.321] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm")) returned 1 [0150.321] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm")) returned 0xffffffff [0150.321] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x2e63e8, dwReserved1=0x18eb84, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0150.322] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.322] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0150.324] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5d3f [0150.324] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0150.324] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0150.423] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x5d3f, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x5d3f, lpOverlapped=0x0) returned 1 [0150.435] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x5d40, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x5d40, lpOverlapped=0x0) returned 1 [0150.436] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0150.456] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.467] CloseHandle (hObject=0xf0) returned 1 [0150.467] CloseHandle (hObject=0xf4) returned 1 [0150.467] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg.dvodltmf")) returned 0 [0150.468] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg.dvodltmf")) returned 0x2020 [0150.468] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Garden.jpg", cAlternateFileName="")) returned 0x2e84d8 [0150.468] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Garden.jpg", cAlternateFileName="")) returned 0 [0150.468] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0150.468] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg")) returned 1 [0150.469] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg")) returned 0xffffffff [0150.469] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x2e63e8, dwReserved1=0x18eb84, cFileName="Green Bubbles.htm", cAlternateFileName="GREENB~1.HTM")) returned 1 [0150.469] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0150.469] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.470] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xed [0150.470] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0150.470] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0150.601] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xed, lpOverlapped=0x0) returned 1 [0150.602] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xf0, lpOverlapped=0x0) returned 1 [0150.602] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0150.622] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.633] CloseHandle (hObject=0xf4) returned 1 [0150.633] CloseHandle (hObject=0xf0) returned 1 [0150.633] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm.dvodltmf")) returned 0 [0150.634] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm.dvodltmf")) returned 0x2020 [0150.634] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Green Bubbles.htm", cAlternateFileName="GREENB~1.HTM")) returned 0x2e84d8 [0150.634] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Green Bubbles.htm", cAlternateFileName="GREENB~1.HTM")) returned 0 [0150.634] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0150.634] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm")) returned 1 [0150.635] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm")) returned 0xffffffff [0150.635] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x2e63e8, dwReserved1=0x18eb84, cFileName="GreenBubbles.jpg", cAlternateFileName="GREENB~1.JPG")) returned 1 [0150.635] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.636] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0150.636] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1906 [0150.636] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0150.636] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0150.720] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1906, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x1906, lpOverlapped=0x0) returned 1 [0150.722] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1910, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x1910, lpOverlapped=0x0) returned 1 [0150.723] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0150.743] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.758] CloseHandle (hObject=0xf0) returned 1 [0150.758] CloseHandle (hObject=0xf4) returned 1 [0150.758] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg.dvodltmf")) returned 0 [0150.759] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg.dvodltmf")) returned 0x2020 [0150.759] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="GreenBubbles.jpg", cAlternateFileName="GREENB~1.JPG")) returned 0x2e84d8 [0150.760] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="GreenBubbles.jpg", cAlternateFileName="GREENB~1.JPG")) returned 0 [0150.760] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0150.760] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg")) returned 1 [0150.761] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg")) returned 0xffffffff [0150.761] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x2e63e8, dwReserved1=0x18eb84, cFileName="Hand Prints.htm", cAlternateFileName="HANDPR~1.HTM")) returned 1 [0150.761] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0150.761] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.761] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xeb [0150.761] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0150.762] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0150.846] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xeb, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xeb, lpOverlapped=0x0) returned 1 [0150.848] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xf0, lpOverlapped=0x0) returned 1 [0150.848] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0150.868] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.877] CloseHandle (hObject=0xf4) returned 1 [0150.877] CloseHandle (hObject=0xf0) returned 1 [0150.877] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm.dvodltmf")) returned 0 [0150.878] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm.dvodltmf")) returned 0x2020 [0150.878] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Hand Prints.htm", cAlternateFileName="HANDPR~1.HTM")) returned 0x2e84d8 [0150.879] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Hand Prints.htm", cAlternateFileName="HANDPR~1.HTM")) returned 0 [0150.879] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0150.879] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm")) returned 1 [0150.880] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm")) returned 0xffffffff [0150.880] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x2e63e8, dwReserved1=0x18eb84, cFileName="HandPrints.jpg", cAlternateFileName="HANDPR~1.JPG")) returned 1 [0150.880] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.880] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0150.881] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x107e [0150.881] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0150.881] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0150.965] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x107e, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x107e, lpOverlapped=0x0) returned 1 [0150.968] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x1080, lpOverlapped=0x0) returned 1 [0150.980] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0151.000] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.009] CloseHandle (hObject=0xf0) returned 1 [0151.009] CloseHandle (hObject=0xf4) returned 1 [0151.010] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg.dvodltmf")) returned 0 [0151.010] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg.dvodltmf")) returned 0x2020 [0151.010] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="HandPrints.jpg", cAlternateFileName="HANDPR~1.JPG")) returned 0x2e84d8 [0151.011] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="HandPrints.jpg", cAlternateFileName="HANDPR~1.JPG")) returned 0 [0151.011] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0151.011] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg")) returned 1 [0151.012] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg")) returned 0xffffffff [0151.012] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x2e63e8, dwReserved1=0x18eb84, cFileName="Orange Circles.htm", cAlternateFileName="ORANGE~1.HTM")) returned 1 [0151.012] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0151.013] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.013] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xed [0151.013] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0151.014] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0151.098] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xed, lpOverlapped=0x0) returned 1 [0151.099] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xf0, lpOverlapped=0x0) returned 1 [0151.100] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0151.120] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.130] CloseHandle (hObject=0xf4) returned 1 [0151.130] CloseHandle (hObject=0xf0) returned 1 [0151.130] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm.dvodltmf")) returned 0 [0151.131] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm.dvodltmf")) returned 0x2020 [0151.131] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Orange Circles.htm", cAlternateFileName="ORANGE~1.HTM")) returned 0x2e84d8 [0151.131] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Orange Circles.htm", cAlternateFileName="ORANGE~1.HTM")) returned 0 [0151.131] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0151.131] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm")) returned 1 [0151.132] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm")) returned 0xffffffff [0151.132] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x2e63e8, dwReserved1=0x18eb84, cFileName="OrangeCircles.jpg", cAlternateFileName="ORANGE~1.JPG")) returned 1 [0151.132] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.133] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0151.134] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18ed [0151.134] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0151.134] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0151.220] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x18ed, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x18ed, lpOverlapped=0x0) returned 1 [0151.221] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x18f0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x18f0, lpOverlapped=0x0) returned 1 [0151.222] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0151.242] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.251] CloseHandle (hObject=0xf0) returned 1 [0151.252] CloseHandle (hObject=0xf4) returned 1 [0151.252] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg.dvodltmf")) returned 0 [0151.253] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg.dvodltmf")) returned 0x2020 [0151.253] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="OrangeCircles.jpg", cAlternateFileName="ORANGE~1.JPG")) returned 0x2e84d8 [0151.253] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="OrangeCircles.jpg", cAlternateFileName="ORANGE~1.JPG")) returned 0 [0151.253] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0151.253] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg")) returned 1 [0151.254] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg")) returned 0xffffffff [0151.254] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x2e63e8, dwReserved1=0x18eb84, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0151.254] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0151.254] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.255] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe8 [0151.255] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0151.255] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0151.340] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xe8, lpOverlapped=0x0) returned 1 [0151.341] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xf0, lpOverlapped=0x0) returned 1 [0151.342] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0151.366] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.376] CloseHandle (hObject=0xf4) returned 1 [0151.376] CloseHandle (hObject=0xf0) returned 1 [0151.376] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm.dvodltmf")) returned 0 [0151.377] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm.dvodltmf")) returned 0x2020 [0151.377] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Peacock.htm", cAlternateFileName="")) returned 0x2e84d8 [0151.377] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Peacock.htm", cAlternateFileName="")) returned 0 [0151.377] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0151.377] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm")) returned 1 [0151.378] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm")) returned 0xffffffff [0151.378] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x2e63e8, dwReserved1=0x18eb84, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0151.378] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.378] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0151.379] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13fb [0151.379] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0151.379] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0151.468] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x13fb, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x13fb, lpOverlapped=0x0) returned 1 [0151.471] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x1400, lpOverlapped=0x0) returned 1 [0151.472] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0151.492] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.501] CloseHandle (hObject=0xf0) returned 1 [0151.501] CloseHandle (hObject=0xf4) returned 1 [0151.501] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg.dvodltmf")) returned 0 [0151.502] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg.dvodltmf")) returned 0x2020 [0151.502] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Peacock.jpg", cAlternateFileName="")) returned 0x2e84d8 [0151.502] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Peacock.jpg", cAlternateFileName="")) returned 0 [0151.502] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0151.503] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg")) returned 1 [0151.503] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg")) returned 0xffffffff [0151.504] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x2e63e8, dwReserved1=0x18eb84, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0151.504] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0151.504] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.504] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe9 [0151.504] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0151.505] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0151.600] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe9, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xe9, lpOverlapped=0x0) returned 1 [0151.601] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xf0, lpOverlapped=0x0) returned 1 [0151.602] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0151.622] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.632] CloseHandle (hObject=0xf4) returned 1 [0151.632] CloseHandle (hObject=0xf0) returned 1 [0151.633] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm.dvodltmf")) returned 0 [0151.633] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm.dvodltmf")) returned 0x2020 [0151.633] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Roses.htm", cAlternateFileName="")) returned 0x2e84d8 [0151.634] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Roses.htm", cAlternateFileName="")) returned 0 [0151.634] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0151.634] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm")) returned 1 [0151.635] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm")) returned 0xffffffff [0151.635] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x2e63e8, dwReserved1=0x18eb84, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0151.635] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.635] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0151.636] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x780 [0151.636] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0151.636] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0151.725] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x780, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x780, lpOverlapped=0x0) returned 1 [0151.726] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x790, lpOverlapped=0x0) returned 1 [0151.727] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0151.747] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.757] CloseHandle (hObject=0xf0) returned 1 [0151.757] CloseHandle (hObject=0xf4) returned 1 [0151.758] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg.dvodltmf")) returned 0 [0151.758] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg.dvodltmf")) returned 0x2020 [0151.758] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Roses.jpg", cAlternateFileName="")) returned 0x2e84d8 [0151.759] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Roses.jpg", cAlternateFileName="")) returned 0 [0151.759] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0151.759] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg")) returned 1 [0151.760] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg")) returned 0xffffffff [0151.760] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x2e63e8, dwReserved1=0x18eb84, cFileName="Shades of Blue.htm", cAlternateFileName="SHADES~1.HTM")) returned 1 [0151.760] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0151.760] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.761] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xed [0151.761] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0151.761] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0151.852] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xed, lpOverlapped=0x0) returned 1 [0151.853] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xf0, lpOverlapped=0x0) returned 1 [0151.853] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0151.873] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.883] CloseHandle (hObject=0xf4) returned 1 [0151.883] CloseHandle (hObject=0xf0) returned 1 [0151.883] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm.dvodltmf")) returned 0 [0151.884] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm.dvodltmf")) returned 0x2020 [0151.884] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Shades of Blue.htm", cAlternateFileName="SHADES~1.HTM")) returned 0x2e84d8 [0151.884] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Shades of Blue.htm", cAlternateFileName="SHADES~1.HTM")) returned 0 [0151.884] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0151.884] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm")) returned 1 [0151.885] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm")) returned 0xffffffff [0151.885] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x2e63e8, dwReserved1=0x18eb84, cFileName="ShadesOfBlue.jpg", cAlternateFileName="SHADES~1.JPG")) returned 1 [0151.885] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.885] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0151.886] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x127e [0151.886] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0151.886] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0151.970] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x127e, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x127e, lpOverlapped=0x0) returned 1 [0151.972] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x1280, lpOverlapped=0x0) returned 1 [0151.973] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0151.993] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.002] CloseHandle (hObject=0xf0) returned 1 [0152.002] CloseHandle (hObject=0xf4) returned 1 [0152.002] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg.dvodltmf")) returned 0 [0152.003] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg.dvodltmf")) returned 0x2020 [0152.003] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ShadesOfBlue.jpg", cAlternateFileName="SHADES~1.JPG")) returned 0x2e84d8 [0152.003] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ShadesOfBlue.jpg", cAlternateFileName="SHADES~1.JPG")) returned 0 [0152.003] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0152.003] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg")) returned 1 [0152.004] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg")) returned 0xffffffff [0152.004] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x2e63e8, dwReserved1=0x18eb84, cFileName="Soft Blue.htm", cAlternateFileName="SOFTBL~1.HTM")) returned 1 [0152.004] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0152.005] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.005] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe8 [0152.005] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0152.005] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0152.097] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xe8, lpOverlapped=0x0) returned 1 [0152.098] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xf0, lpOverlapped=0x0) returned 1 [0152.099] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0152.119] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.129] CloseHandle (hObject=0xf4) returned 1 [0152.129] CloseHandle (hObject=0xf0) returned 1 [0152.129] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm.dvodltmf")) returned 0 [0152.130] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm.dvodltmf")) returned 0x2020 [0152.130] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Soft Blue.htm", cAlternateFileName="SOFTBL~1.HTM")) returned 0x2e84d8 [0152.130] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Soft Blue.htm", cAlternateFileName="SOFTBL~1.HTM")) returned 0 [0152.130] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0152.130] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm")) returned 1 [0152.131] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm")) returned 0xffffffff [0152.131] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x2e63e8, dwReserved1=0x18eb84, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0152.131] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.132] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0152.133] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2949 [0152.133] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0152.133] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0152.217] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2949, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x2949, lpOverlapped=0x0) returned 1 [0152.221] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x2950, lpOverlapped=0x0) returned 1 [0152.222] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0152.242] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.251] CloseHandle (hObject=0xf0) returned 1 [0152.251] CloseHandle (hObject=0xf4) returned 1 [0152.252] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg.dvodltmf")) returned 0 [0152.252] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg.dvodltmf")) returned 0x2020 [0152.252] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 0x2e84d8 [0152.253] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 0 [0152.253] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0152.253] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg")) returned 1 [0152.254] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg")) returned 0xffffffff [0152.254] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x2e63e8, dwReserved1=0x18eb84, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0152.254] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0152.254] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.258] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe6 [0152.258] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0152.258] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0152.344] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe6, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xe6, lpOverlapped=0x0) returned 1 [0152.345] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xf0, lpOverlapped=0x0) returned 1 [0152.346] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0152.413] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.449] CloseHandle (hObject=0xf4) returned 1 [0152.449] CloseHandle (hObject=0xf0) returned 1 [0152.450] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm.dvodltmf")) returned 0 [0152.450] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm.dvodltmf")) returned 0x2020 [0152.450] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Stars.htm", cAlternateFileName="")) returned 0x2e84d8 [0152.451] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Stars.htm", cAlternateFileName="")) returned 0 [0152.451] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0152.451] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm")) returned 1 [0152.452] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm")) returned 0xffffffff [0152.452] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x2e63e8, dwReserved1=0x18eb84, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0152.452] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.452] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0152.453] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d51 [0152.453] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0152.453] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0152.569] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1d51, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x1d51, lpOverlapped=0x0) returned 1 [0152.572] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1d60, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x1d60, lpOverlapped=0x0) returned 1 [0152.573] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0152.592] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.645] CloseHandle (hObject=0xf0) returned 1 [0152.645] CloseHandle (hObject=0xf4) returned 1 [0152.645] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg.dvodltmf")) returned 0 [0152.646] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg.dvodltmf")) returned 0x2020 [0152.646] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Stars.jpg", cAlternateFileName="")) returned 0x2e84d8 [0152.646] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Stars.jpg", cAlternateFileName="")) returned 0 [0152.646] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0152.646] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg")) returned 1 [0152.647] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg")) returned 0xffffffff [0152.647] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x2e63e8, dwReserved1=0x18eb84, cFileName="Stars.jpg", cAlternateFileName="")) returned 0 [0152.647] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0152.647] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x204000, dwReserved0=0x706a6d67, dwReserved1=0x6d7467, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 1 [0152.647] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0152.648] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0152.648] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x204000 [0152.648] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0152.648] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0152.733] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x204000, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x204000, lpOverlapped=0x0) returned 1 [0152.781] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x204010, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x204010, lpOverlapped=0x0) returned 1 [0152.831] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0152.850] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.860] CloseHandle (hObject=0xec) returned 1 [0152.860] CloseHandle (hObject=0xf4) returned 1 [0152.860] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore.dvodltmf")) returned 0 [0152.861] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore.dvodltmf")) returned 0x2020 [0152.861] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x204000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 0x2e8498 [0152.861] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x204000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 0 [0152.861] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0152.862] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore")) returned 1 [0152.863] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore")) returned 0xffffffff [0152.863] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9a12c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e63e8, dwReserved1=0x18edec, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 1 [0152.863] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\windowsmail.pat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0152.864] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\windowsmail.pat.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0152.864] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0152.864] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0152.864] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0152.951] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x10, lpOverlapped=0x0) returned 1 [0152.952] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0152.971] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.981] CloseHandle (hObject=0xf4) returned 1 [0152.981] CloseHandle (hObject=0xec) returned 1 [0152.981] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\windowsmail.pat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\windowsmail.pat.dvodltmf")) returned 0 [0152.982] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\windowsmail.pat.dvodltmf")) returned 0x2020 [0152.982] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9a12c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0x2e8498 [0152.982] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9a12c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0 [0152.982] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0152.982] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\windowsmail.pat")) returned 1 [0152.982] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\windowsmail.pat")) returned 0xffffffff [0152.982] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9a12c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e63e8, dwReserved1=0x18edec, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0 [0152.982] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0152.983] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461702e, dwReserved1=0x61737365, cFileName="Windows Media", cAlternateFileName="WINDOW~2")) returned 1 [0152.983] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e63e8, dwReserved1=0x18edec, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0152.983] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e63e8, dwReserved1=0x18edec, cFileName="..", cAlternateFileName="")) returned 1 [0152.983] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e63e8, dwReserved1=0x18edec, cFileName="12.0", cAlternateFileName="")) returned 1 [0152.983] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0152.984] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.984] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0xa4, dwReserved1=0x0, cFileName="WMSDKNS.DTD", cAlternateFileName="")) returned 1 [0152.984] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.dtd"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0152.984] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.dtd.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.984] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f2 [0152.984] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0152.985] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0153.069] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1f2, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x1f2, lpOverlapped=0x0) returned 1 [0153.069] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x200, lpOverlapped=0x0) returned 1 [0153.070] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0153.090] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.099] CloseHandle (hObject=0xf4) returned 1 [0153.100] CloseHandle (hObject=0xf0) returned 1 [0153.100] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.dtd"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.dtd.dvodltmf")) returned 0 [0153.100] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.dtd.dvodltmf")) returned 0x2020 [0153.101] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="WMSDKNS.DTD", cAlternateFileName="")) returned 0x2e84d8 [0153.101] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="WMSDKNS.DTD", cAlternateFileName="")) returned 0 [0153.101] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0153.101] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.dtd")) returned 1 [0153.102] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.dtd")) returned 0xffffffff [0153.102] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9269464, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x27cf, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="WMSDKNS.XML", cAlternateFileName="")) returned 1 [0153.102] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0153.103] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.xml.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0153.103] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x27cf [0153.103] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0153.104] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0153.188] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x27cf, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x27cf, lpOverlapped=0x0) returned 1 [0153.233] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x27d0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x27d0, lpOverlapped=0x0) returned 1 [0153.235] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0153.254] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.263] CloseHandle (hObject=0xf0) returned 1 [0153.263] CloseHandle (hObject=0xf4) returned 1 [0153.264] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.xml.dvodltmf")) returned 0 [0153.265] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.xml.dvodltmf")) returned 0x2020 [0153.265] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9269464, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x27cf, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="WMSDKNS.XML", cAlternateFileName="")) returned 0x2e84d8 [0153.265] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9269464, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x27cf, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="WMSDKNS.XML", cAlternateFileName="")) returned 0 [0153.265] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0153.265] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.xml")) returned 1 [0153.266] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.xml")) returned 0xffffffff [0153.266] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9269464, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x27cf, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="WMSDKNS.XML", cAlternateFileName="")) returned 0 [0153.266] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0153.266] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e63e8, dwReserved1=0x18edec, cFileName="12.0", cAlternateFileName="")) returned 0 [0153.266] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0153.266] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461702e, dwReserved1=0x61737365, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1 [0153.267] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e63e8, dwReserved1=0x18edec, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0153.267] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e63e8, dwReserved1=0x18edec, cFileName="..", cAlternateFileName="")) returned 1 [0153.267] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e63e8, dwReserved1=0x18edec, cFileName="Gadgets", cAlternateFileName="")) returned 1 [0153.267] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0153.267] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="..", cAlternateFileName="")) returned 1 [0153.268] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e13d0, dwReserved1=0x18eb84, cFileName="..", cAlternateFileName="")) returned 0 [0153.268] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0153.268] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x2e63e8, dwReserved1=0x18edec, cFileName="Settings.ini", cAlternateFileName="")) returned 1 [0153.268] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows sidebar\\settings.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0153.269] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows sidebar\\settings.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0153.269] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x54 [0153.269] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0153.269] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0153.355] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x54, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x54, lpOverlapped=0x0) returned 1 [0153.356] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x60, lpOverlapped=0x0) returned 1 [0153.356] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0153.381] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.391] CloseHandle (hObject=0xec) returned 1 [0153.391] CloseHandle (hObject=0xf4) returned 1 [0153.391] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows sidebar\\settings.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows sidebar\\settings.ini.dvodltmf")) returned 0 [0153.392] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows sidebar\\settings.ini.dvodltmf")) returned 0x2020 [0153.392] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Settings.ini", cAlternateFileName="")) returned 0x2e8498 [0153.392] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Settings.ini", cAlternateFileName="")) returned 0 [0153.392] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0153.392] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows sidebar\\settings.ini")) returned 1 [0153.393] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows sidebar\\settings.ini")) returned 0xffffffff [0153.393] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x2e63e8, dwReserved1=0x18edec, cFileName="Settings.ini", cAlternateFileName="")) returned 0 [0153.393] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0153.393] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461702e, dwReserved1=0x61737365, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 0 [0153.393] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0153.393] FindNextFileA (in: hFindFile=0x2dcc48, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72616265, dwReserved1=0x6769666e, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1 [0153.393] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617069, dwReserved1=0x61737365, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0153.394] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617069, dwReserved1=0x61737365, cFileName="..", cAlternateFileName="")) returned 1 [0153.394] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617069, dwReserved1=0x61737365, cFileName="..", cAlternateFileName="")) returned 0 [0153.394] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0153.394] FindNextFileA (in: hFindFile=0x2dcc48, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72616265, dwReserved1=0x6769666e, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0153.394] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617069, dwReserved1=0x61737365, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0153.394] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617069, dwReserved1=0x61737365, cFileName="..", cAlternateFileName="")) returned 1 [0153.394] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617069, dwReserved1=0x61737365, cFileName="Firefox", cAlternateFileName="")) returned 1 [0153.395] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e13d0, dwReserved1=0x18edec, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0153.395] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e13d0, dwReserved1=0x18edec, cFileName="..", cAlternateFileName="")) returned 1 [0153.395] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e13d0, dwReserved1=0x18edec, cFileName="Profiles", cAlternateFileName="")) returned 1 [0153.395] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0153.396] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.396] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826e2030, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826e2030, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 1 [0153.396] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826e2030, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826e2030, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0153.398] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826e2030, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826e2030, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.398] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0153.398] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0153.400] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.400] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0", cAlternateFileName="")) returned 1 [0153.400] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0153.400] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.400] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8c39470, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8c39470, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="98", cAlternateFileName="")) returned 1 [0153.400] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8c39470, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8c39470, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8598 [0153.401] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8c39470, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8c39470, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.401] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8c39470, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8cd19f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xb67e, dwReserved0=0x0, dwReserved1=0x0, cFileName="B60F3d01", cAlternateFileName="")) returned 1 [0153.401] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8c39470, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8cd19f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xb67e, dwReserved0=0x0, dwReserved1=0x0, cFileName="B60F3d01", cAlternateFileName="")) returned 0 [0153.401] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0153.401] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A8", cAlternateFileName="")) returned 1 [0153.401] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8598 [0153.402] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.402] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4898, dwReserved0=0x0, dwReserved1=0x0, cFileName="C3B7Bd01", cAlternateFileName="")) returned 1 [0153.402] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4898, dwReserved0=0x0, dwReserved1=0x0, cFileName="C3B7Bd01", cAlternateFileName="")) returned 0 [0153.402] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0153.402] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A8", cAlternateFileName="")) returned 0 [0153.402] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0153.402] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1", cAlternateFileName="")) returned 1 [0153.402] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0153.402] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.402] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7680bb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7680bb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0B", cAlternateFileName="")) returned 1 [0153.402] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7680bb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7680bb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8598 [0153.402] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7680bb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7680bb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.403] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7680bb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7680bb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x204fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="FCBF5d01", cAlternateFileName="")) returned 1 [0153.403] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7680bb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7680bb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x204fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="FCBF5d01", cAlternateFileName="")) returned 0 [0153.403] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0153.403] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2", cAlternateFileName="")) returned 1 [0153.403] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8598 [0153.403] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.403] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8272e2f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xaa05, dwReserved0=0x0, dwReserved1=0x0, cFileName="0B619d01", cAlternateFileName="")) returned 1 [0153.404] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8272e2f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xaa05, dwReserved0=0x0, dwReserved1=0x0, cFileName="0B619d01", cAlternateFileName="")) returned 0 [0153.404] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0153.404] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d7ec50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="F6", cAlternateFileName="")) returned 1 [0153.404] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d7ec50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8598 [0153.404] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d7ec50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.404] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa60b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CBD4Dd01", cAlternateFileName="")) returned 1 [0153.404] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa60b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CBD4Dd01", cAlternateFileName="")) returned 0 [0153.404] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0153.404] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d7ec50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="F6", cAlternateFileName="")) returned 0 [0153.404] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0153.404] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2", cAlternateFileName="")) returned 1 [0153.404] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0153.405] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.405] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0153.405] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0153.405] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3", cAlternateFileName="")) returned 1 [0153.405] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0153.406] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.406] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4B", cAlternateFileName="")) returned 1 [0153.406] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8598 [0153.407] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.407] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb72eeab0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x20543, dwReserved0=0x0, dwReserved1=0x0, cFileName="1D8FDd01", cAlternateFileName="")) returned 1 [0153.407] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb72eeab0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x20543, dwReserved0=0x0, dwReserved1=0x0, cFileName="1D8FDd01", cAlternateFileName="")) returned 0 [0153.407] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0153.407] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4B", cAlternateFileName="")) returned 0 [0153.407] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0153.407] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4", cAlternateFileName="")) returned 1 [0153.407] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0153.407] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.407] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0153.407] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0153.408] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5", cAlternateFileName="")) returned 1 [0153.408] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0153.408] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.408] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0153.408] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0153.408] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6", cAlternateFileName="")) returned 1 [0153.408] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0153.409] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.409] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0153.409] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0153.409] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7", cAlternateFileName="")) returned 1 [0153.409] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0153.409] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.410] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0153.410] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0153.410] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8", cAlternateFileName="")) returned 1 [0153.410] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0153.410] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.410] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0153.410] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0153.410] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9", cAlternateFileName="")) returned 1 [0153.410] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0153.411] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.411] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 1 [0153.411] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8598 [0153.411] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.411] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x534f, dwReserved0=0x0, dwReserved1=0x0, cFileName="16A09d01", cAlternateFileName="")) returned 1 [0153.411] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x534f, dwReserved0=0x0, dwReserved1=0x0, cFileName="16A09d01", cAlternateFileName="")) returned 0 [0153.411] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0153.411] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d58af0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d58af0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d58af0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2C", cAlternateFileName="")) returned 1 [0153.412] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d58af0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d58af0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d58af0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8598 [0153.412] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d58af0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d58af0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d58af0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.412] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7d58af0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d58af0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7dcaf10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x133d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="24B53d01", cAlternateFileName="")) returned 1 [0153.412] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7d58af0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d58af0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7dcaf10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x133d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="24B53d01", cAlternateFileName="")) returned 0 [0153.412] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0153.412] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="61", cAlternateFileName="")) returned 1 [0153.412] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8598 [0153.412] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.412] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7fba0f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa949, dwReserved0=0x0, dwReserved1=0x0, cFileName="28E95d01", cAlternateFileName="")) returned 1 [0153.412] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7fba0f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa949, dwReserved0=0x0, dwReserved1=0x0, cFileName="28E95d01", cAlternateFileName="")) returned 0 [0153.412] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0153.414] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E0", cAlternateFileName="")) returned 1 [0153.414] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8598 [0153.415] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.415] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x404f, dwReserved0=0x0, dwReserved1=0x0, cFileName="F17B2d01", cAlternateFileName="")) returned 1 [0153.415] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x404f, dwReserved0=0x0, dwReserved1=0x0, cFileName="F17B2d01", cAlternateFileName="")) returned 0 [0153.415] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0153.415] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E0", cAlternateFileName="")) returned 0 [0153.415] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0153.415] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A", cAlternateFileName="")) returned 1 [0153.415] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0153.415] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.415] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0153.415] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0153.415] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="B", cAlternateFileName="")) returned 1 [0153.415] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\B\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0153.416] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.416] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0153.416] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0153.416] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C", cAlternateFileName="")) returned 1 [0153.416] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0153.416] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.416] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E6", cAlternateFileName="")) returned 1 [0153.416] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8598 [0153.417] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.417] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f21b70, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x21839, dwReserved0=0x0, dwReserved1=0x0, cFileName="9DCB7d01", cAlternateFileName="")) returned 1 [0153.417] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f21b70, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x21839, dwReserved0=0x0, dwReserved1=0x0, cFileName="9DCB7d01", cAlternateFileName="")) returned 0 [0153.417] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0153.417] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E6", cAlternateFileName="")) returned 0 [0153.417] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0153.417] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="D", cAlternateFileName="")) returned 1 [0153.417] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0153.418] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.418] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="08", cAlternateFileName="")) returned 1 [0153.418] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8598 [0153.418] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.418] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8266, dwReserved0=0x0, dwReserved1=0x0, cFileName="71469d01", cAlternateFileName="")) returned 1 [0153.418] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8266, dwReserved0=0x0, dwReserved1=0x0, cFileName="71469d01", cAlternateFileName="")) returned 0 [0153.419] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0153.419] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="08", cAlternateFileName="")) returned 0 [0153.419] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0153.419] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E", cAlternateFileName="")) returned 1 [0153.419] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0153.419] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.419] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="69", cAlternateFileName="")) returned 1 [0153.419] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8598 [0153.419] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.419] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb80063b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x10d22, dwReserved0=0x0, dwReserved1=0x0, cFileName="885EEd01", cAlternateFileName="")) returned 1 [0153.419] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb80063b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x10d22, dwReserved0=0x0, dwReserved1=0x0, cFileName="885EEd01", cAlternateFileName="")) returned 0 [0153.419] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0153.419] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="69", cAlternateFileName="")) returned 0 [0153.419] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0153.420] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="F", cAlternateFileName="")) returned 1 [0153.420] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0153.420] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.420] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="23", cAlternateFileName="")) returned 1 [0153.420] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8598 [0153.421] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.421] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7fe0250, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xf888, dwReserved0=0x0, dwReserved1=0x0, cFileName="7E0FEd01", cAlternateFileName="")) returned 1 [0153.421] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7fe0250, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xf888, dwReserved0=0x0, dwReserved1=0x0, cFileName="7E0FEd01", cAlternateFileName="")) returned 0 [0153.421] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0153.421] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="F0", cAlternateFileName="")) returned 1 [0153.421] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8598 [0153.422] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.422] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x823c2350, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xa80f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECB2Dd01", cAlternateFileName="")) returned 1 [0153.422] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x823c2350, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xa80f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECB2Dd01", cAlternateFileName="")) returned 0 [0153.422] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0153.422] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="F0", cAlternateFileName="")) returned 0 [0153.422] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0153.422] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x851226b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x0, dwReserved1=0x0, cFileName="_CACHE_001_", cAlternateFileName="_CACHE~2")) returned 1 [0153.422] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x851e0d90, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x0, dwReserved1=0x0, cFileName="_CACHE_002_", cAlternateFileName="_CACHE~3")) returned 1 [0153.422] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x8529f470, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x0, dwReserved1=0x0, cFileName="_CACHE_003_", cAlternateFileName="_CACHE~4")) returned 1 [0153.422] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x8535db50, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2114, dwReserved0=0x0, dwReserved1=0x0, cFileName="_CACHE_MAP_", cAlternateFileName="_CACHE~1")) returned 1 [0153.422] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x8535db50, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2114, dwReserved0=0x0, dwReserved1=0x0, cFileName="_CACHE_MAP_", cAlternateFileName="_CACHE~1")) returned 0 [0153.422] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0153.422] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbece2650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbecfd400, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbecfd400, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfflineCache", cAlternateFileName="OFFLIN~1")) returned 1 [0153.422] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbece2650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbecfd400, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbecfd400, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0153.423] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbece2650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbecfd400, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbecfd400, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.423] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbece4d60, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbece4d60, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc399b820, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.sqlite", cAlternateFileName="INDEX~1.SQL")) returned 1 [0153.423] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\index.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\offlinecache\\index.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0153.423] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\index.sqlite.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\offlinecache\\index.sqlite.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0153.424] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40000 [0153.424] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0153.424] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0153.517] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x40000, lpOverlapped=0x0) returned 1 [0153.522] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x40010, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x40010, lpOverlapped=0x0) returned 1 [0153.528] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0153.548] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.557] CloseHandle (hObject=0xe8) returned 1 [0153.557] CloseHandle (hObject=0xe4) returned 1 [0153.557] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\index.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\offlinecache\\index.sqlite"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\index.sqlite.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\offlinecache\\index.sqlite.dvodltmf")) returned 0 [0153.558] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\index.sqlite.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\offlinecache\\index.sqlite.dvodltmf")) returned 0x2020 [0153.558] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\index.sqlite", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbece4d60, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbece4d60, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc399b820, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="index.sqlite", cAlternateFileName="INDEX~1.SQL")) returned 0x2e8558 [0153.558] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbece4d60, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbece4d60, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc399b820, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="index.sqlite", cAlternateFileName="INDEX~1.SQL")) returned 0 [0153.558] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0153.558] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\index.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\offlinecache\\index.sqlite")) returned 1 [0153.561] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\index.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\offlinecache\\index.sqlite")) returned 0xffffffff [0153.561] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbece4d60, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbece4d60, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc399b820, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.sqlite", cAlternateFileName="INDEX~1.SQL")) returned 0 [0153.561] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0153.561] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8234ff30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65, dwReserved1=0x0, cFileName="safebrowsing", cAlternateFileName="SAFEBR~2")) returned 1 [0153.561] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8234ff30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dfd10, dwReserved1=0x18e6b4, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0153.563] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8234ff30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dfd10, dwReserved1=0x18e6b4, cFileName="..", cAlternateFileName="")) returned 1 [0153.563] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x825fd7f0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x825fd7f0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x825fd7f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2c, dwReserved0=0x2dfd10, dwReserved1=0x18e6b4, cFileName="test-malware-simple.cache", cAlternateFileName="TEST-M~1.CAC")) returned 1 [0153.563] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.cache" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.cache"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0153.564] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.cache.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.cache.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0153.564] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c [0153.564] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0153.565] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0153.662] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2c, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x2c, lpOverlapped=0x0) returned 1 [0153.663] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x30, lpOverlapped=0x0) returned 1 [0153.664] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0153.683] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.693] CloseHandle (hObject=0xe4) returned 1 [0153.693] CloseHandle (hObject=0xe8) returned 1 [0153.693] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.cache" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.cache"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.cache.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.cache.dvodltmf")) returned 0 [0153.694] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.cache.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.cache.dvodltmf")) returned 0x2020 [0153.694] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.cache", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x825fd7f0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x825fd7f0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x825fd7f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="test-malware-simple.cache", cAlternateFileName="TEST-M~1.CAC")) returned 0x2e8558 [0153.694] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x825fd7f0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x825fd7f0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x825fd7f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="test-malware-simple.cache", cAlternateFileName="TEST-M~1.CAC")) returned 0 [0153.694] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0153.694] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.cache" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.cache")) returned 1 [0153.695] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.cache" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.cache")) returned 0xffffffff [0153.695] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8234ff30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8234ff30, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82649ab0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x2dfd10, dwReserved1=0x18e6b4, cFileName="test-malware-simple.pset", cAlternateFileName="TEST-M~1.PSE")) returned 1 [0153.695] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.pset" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.pset"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0153.695] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.pset.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.pset.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0153.696] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10 [0153.696] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0153.696] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0153.780] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x10, lpOverlapped=0x0) returned 1 [0153.787] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x20, lpOverlapped=0x0) returned 1 [0153.788] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0153.808] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.818] CloseHandle (hObject=0xe8) returned 1 [0153.818] CloseHandle (hObject=0xe4) returned 1 [0153.818] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.pset" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.pset"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.pset.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.pset.dvodltmf")) returned 0 [0153.819] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.pset.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.pset.dvodltmf")) returned 0x2020 [0153.819] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.pset", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8234ff30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8234ff30, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82649ab0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="test-malware-simple.pset", cAlternateFileName="TEST-M~1.PSE")) returned 0x2e8558 [0153.819] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8234ff30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8234ff30, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82649ab0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="test-malware-simple.pset", cAlternateFileName="TEST-M~1.PSE")) returned 0 [0153.819] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0153.819] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.pset" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.pset")) returned 1 [0153.820] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.pset" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.pset")) returned 0xffffffff [0153.820] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82376090, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82376090, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82376090, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x2dfd10, dwReserved1=0x18e6b4, cFileName="test-malware-simple.sbstore", cAlternateFileName="TEST-M~1.SBS")) returned 1 [0153.820] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.sbstore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.sbstore"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0153.820] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.sbstore.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.sbstore.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0153.821] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe8 [0153.821] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0153.821] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0153.904] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0xe8, lpOverlapped=0x0) returned 1 [0153.905] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0xf0, lpOverlapped=0x0) returned 1 [0153.906] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0153.925] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.934] CloseHandle (hObject=0xe4) returned 1 [0153.934] CloseHandle (hObject=0xe8) returned 1 [0153.934] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.sbstore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.sbstore"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.sbstore.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.sbstore.dvodltmf")) returned 0 [0153.934] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.sbstore.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.sbstore.dvodltmf")) returned 0x2020 [0153.934] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.sbstore", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82376090, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82376090, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82376090, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="test-malware-simple.sbstore", cAlternateFileName="TEST-M~1.SBS")) returned 0x2e8558 [0153.935] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82376090, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82376090, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82376090, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="test-malware-simple.sbstore", cAlternateFileName="TEST-M~1.SBS")) returned 0 [0153.935] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0153.935] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.sbstore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.sbstore")) returned 1 [0153.936] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.sbstore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.sbstore")) returned 0xffffffff [0153.936] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82695d70, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82695d70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82695d70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2c, dwReserved0=0x2dfd10, dwReserved1=0x18e6b4, cFileName="test-phish-simple.cache", cAlternateFileName="TEST-P~1.CAC")) returned 1 [0153.936] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.cache" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.cache"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0153.937] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.cache.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.cache.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0153.937] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c [0153.937] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0153.937] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0154.019] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2c, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x2c, lpOverlapped=0x0) returned 1 [0154.020] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x30, lpOverlapped=0x0) returned 1 [0154.021] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0154.040] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.049] CloseHandle (hObject=0xe8) returned 1 [0154.049] CloseHandle (hObject=0xe4) returned 1 [0154.049] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.cache" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.cache"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.cache.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.cache.dvodltmf")) returned 0 [0154.050] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.cache.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.cache.dvodltmf")) returned 0x2020 [0154.050] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.cache", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82695d70, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82695d70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82695d70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="test-phish-simple.cache", cAlternateFileName="TEST-P~1.CAC")) returned 0x2e8558 [0154.050] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82695d70, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82695d70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82695d70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="test-phish-simple.cache", cAlternateFileName="TEST-P~1.CAC")) returned 0 [0154.050] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0154.050] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.cache" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.cache")) returned 1 [0154.051] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.cache" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.cache")) returned 0xffffffff [0154.051] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82376090, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82376090, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x2dfd10, dwReserved1=0x18e6b4, cFileName="test-phish-simple.pset", cAlternateFileName="TEST-P~1.PSE")) returned 1 [0154.051] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.pset" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.pset"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0154.051] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.pset.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.pset.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0154.052] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10 [0154.052] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0154.052] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0154.135] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x10, lpOverlapped=0x0) returned 1 [0154.136] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x20, lpOverlapped=0x0) returned 1 [0154.137] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0154.158] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.168] CloseHandle (hObject=0xe4) returned 1 [0154.168] CloseHandle (hObject=0xe8) returned 1 [0154.168] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.pset" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.pset"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.pset.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.pset.dvodltmf")) returned 0 [0154.169] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.pset.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.pset.dvodltmf")) returned 0x2020 [0154.169] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.pset", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82376090, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82376090, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="test-phish-simple.pset", cAlternateFileName="TEST-P~1.PSE")) returned 0x2e8558 [0154.169] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82376090, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82376090, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="test-phish-simple.pset", cAlternateFileName="TEST-P~1.PSE")) returned 0 [0154.169] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0154.169] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.pset" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.pset")) returned 1 [0154.170] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.pset" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.pset")) returned 0xffffffff [0154.170] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82649ab0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82649ab0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82649ab0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x2dfd10, dwReserved1=0x18e6b4, cFileName="test-phish-simple.sbstore", cAlternateFileName="TEST-P~1.SBS")) returned 1 [0154.170] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.sbstore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.sbstore"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0154.170] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.sbstore.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.sbstore.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0154.171] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe8 [0154.171] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0154.171] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0154.255] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0xe8, lpOverlapped=0x0) returned 1 [0154.256] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0xf0, lpOverlapped=0x0) returned 1 [0154.257] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0154.277] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.286] CloseHandle (hObject=0xe8) returned 1 [0154.286] CloseHandle (hObject=0xe4) returned 1 [0154.286] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.sbstore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.sbstore"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.sbstore.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.sbstore.dvodltmf")) returned 0 [0154.287] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.sbstore.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.sbstore.dvodltmf")) returned 0x2020 [0154.287] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.sbstore", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82649ab0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82649ab0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82649ab0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="test-phish-simple.sbstore", cAlternateFileName="TEST-P~1.SBS")) returned 0x2e8558 [0154.287] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82649ab0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82649ab0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82649ab0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="test-phish-simple.sbstore", cAlternateFileName="TEST-P~1.SBS")) returned 0 [0154.288] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0154.288] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.sbstore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.sbstore")) returned 1 [0154.288] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.sbstore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.sbstore")) returned 0xffffffff [0154.289] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82649ab0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82649ab0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82649ab0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x2dfd10, dwReserved1=0x18e6b4, cFileName="test-phish-simple.sbstore", cAlternateFileName="TEST-P~1.SBS")) returned 0 [0154.289] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0154.289] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x807f0230, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706d6973, dwReserved1=0x732e656c, cFileName="startupCache", cAlternateFileName="STARTU~1")) returned 1 [0154.289] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x807f0230, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dfd10, dwReserved1=0x18e6b4, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0154.290] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x807f0230, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dfd10, dwReserved1=0x18e6b4, cFileName="..", cAlternateFileName="")) returned 1 [0154.290] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x854b47b0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85572e90, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe59f6, dwReserved0=0x2dfd10, dwReserved1=0x18e6b4, cFileName="startupCache.4.little", cAlternateFileName="STARTU~1.LIT")) returned 1 [0154.290] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\startupCache.4.little" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\startupcache\\startupcache.4.little"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0154.290] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\startupCache.4.little.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\startupcache\\startupcache.4.little.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0154.291] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe59f6 [0154.291] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0154.291] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0154.379] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe59f6, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0xe59f6, lpOverlapped=0x0) returned 1 [0154.396] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe5a00, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0xe5a00, lpOverlapped=0x0) returned 1 [0154.412] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0154.431] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.440] CloseHandle (hObject=0xe4) returned 1 [0154.440] CloseHandle (hObject=0xe8) returned 1 [0154.440] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\startupCache.4.little" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\startupcache\\startupcache.4.little"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\startupCache.4.little.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\startupcache\\startupcache.4.little.dvodltmf")) returned 0 [0154.441] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\startupCache.4.little.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\startupcache\\startupcache.4.little.dvodltmf")) returned 0x2020 [0154.441] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\startupCache.4.little", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x854b47b0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85572e90, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe59f6, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="startupCache.4.little", cAlternateFileName="STARTU~1.LIT")) returned 0x2e8558 [0154.442] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x854b47b0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85572e90, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe59f6, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="startupCache.4.little", cAlternateFileName="STARTU~1.LIT")) returned 0 [0154.442] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0154.442] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\startupCache.4.little" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\startupcache\\startupcache.4.little")) returned 1 [0154.451] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\startupCache.4.little" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\startupcache\\startupcache.4.little")) returned 0xffffffff [0154.452] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x854b47b0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85572e90, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe59f6, dwReserved0=0x2dfd10, dwReserved1=0x18e6b4, cFileName="startupCache.4.little", cAlternateFileName="STARTU~1.LIT")) returned 0 [0154.452] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0154.452] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb653ec30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x83ce6bb0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e342e65, dwReserved1=0x7474696c, cFileName="thumbnails", cAlternateFileName="THUMBN~1")) returned 1 [0154.452] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb653ec30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x83ce6bb0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dfd10, dwReserved1=0x18e6b4, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0154.454] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb653ec30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x83ce6bb0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dfd10, dwReserved1=0x18e6b4, cFileName="..", cAlternateFileName="")) returned 1 [0154.454] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83cc0a50, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x83cc0a50, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x40b0, dwReserved0=0x2dfd10, dwReserved1=0x18e6b4, cFileName="4cc87c1409819bf06f42b782d4902b2f.png", cAlternateFileName="4CC87C~1.PNG")) returned 1 [0154.454] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0154.455] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0154.455] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40b0 [0154.455] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0154.455] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0154.541] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x40b0, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x40b0, lpOverlapped=0x0) returned 1 [0154.543] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x40c0, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x40c0, lpOverlapped=0x0) returned 1 [0154.544] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0154.564] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.574] CloseHandle (hObject=0xe8) returned 1 [0154.574] CloseHandle (hObject=0xe4) returned 1 [0154.574] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png.dvodltmf")) returned 0 [0154.575] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png.dvodltmf")) returned 0x2020 [0154.575] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83cc0a50, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x83cc0a50, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x40b0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="4cc87c1409819bf06f42b782d4902b2f.png", cAlternateFileName="4CC87C~1.PNG")) returned 0x2e8558 [0154.576] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83cc0a50, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x83cc0a50, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x40b0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="4cc87c1409819bf06f42b782d4902b2f.png", cAlternateFileName="4CC87C~1.PNG")) returned 0 [0154.576] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0154.576] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png")) returned 1 [0154.577] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png")) returned 0xffffffff [0154.577] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83ce6bb0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x83ce6bb0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x40b0, dwReserved0=0x2dfd10, dwReserved1=0x18e6b4, cFileName="ba182bcd131f1f3c6b6fbbb1ba078341.png", cAlternateFileName="BA182B~1.PNG")) returned 1 [0154.577] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0154.577] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0154.578] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40b0 [0154.578] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0154.578] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0154.673] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x40b0, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x40b0, lpOverlapped=0x0) returned 1 [0154.675] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x40c0, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x40c0, lpOverlapped=0x0) returned 1 [0154.676] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0154.696] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.706] CloseHandle (hObject=0xe4) returned 1 [0154.706] CloseHandle (hObject=0xe8) returned 1 [0154.706] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.dvodltmf")) returned 0 [0154.707] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.dvodltmf")) returned 0x2020 [0154.707] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83ce6bb0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x83ce6bb0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x40b0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="ba182bcd131f1f3c6b6fbbb1ba078341.png", cAlternateFileName="BA182B~1.PNG")) returned 0x2e8558 [0154.707] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83ce6bb0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x83ce6bb0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x40b0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="ba182bcd131f1f3c6b6fbbb1ba078341.png", cAlternateFileName="BA182B~1.PNG")) returned 0 [0154.707] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0154.707] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png")) returned 1 [0154.708] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png")) returned 0xffffffff [0154.708] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb97ade50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb97ade50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb97ade50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x1c362, dwReserved0=0x2dfd10, dwReserved1=0x18e6b4, cFileName="ce8c0453589216a67cddb50284fbfe8d.png", cAlternateFileName="CE8C04~1.PNG")) returned 1 [0154.708] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0154.709] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0154.710] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c362 [0154.710] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0154.710] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0154.795] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1c362, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x1c362, lpOverlapped=0x0) returned 1 [0154.799] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1c370, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x1c370, lpOverlapped=0x0) returned 1 [0154.802] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0154.821] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.831] CloseHandle (hObject=0xe8) returned 1 [0154.832] CloseHandle (hObject=0xe4) returned 1 [0154.832] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png.dvodltmf")) returned 0 [0154.832] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png.dvodltmf")) returned 0x2020 [0154.833] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb97ade50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb97ade50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb97ade50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x1c362, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ce8c0453589216a67cddb50284fbfe8d.png", cAlternateFileName="CE8C04~1.PNG")) returned 0x2e8558 [0154.833] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb97ade50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb97ade50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb97ade50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x1c362, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ce8c0453589216a67cddb50284fbfe8d.png", cAlternateFileName="CE8C04~1.PNG")) returned 0 [0154.833] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0154.833] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png")) returned 1 [0154.834] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png")) returned 0xffffffff [0154.834] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb97ade50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb97ade50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb97ade50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x1c362, dwReserved0=0x2dfd10, dwReserved1=0x18e6b4, cFileName="ce8c0453589216a67cddb50284fbfe8d.png", cAlternateFileName="CE8C04~1.PNG")) returned 0 [0154.834] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0154.835] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x853a9e10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x61363132, dwReserved1=0x64633736, cFileName="_CACHE_CLEAN_", cAlternateFileName="_CACHE~1")) returned 1 [0154.835] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x853a9e10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x61363132, dwReserved1=0x64633736, cFileName="_CACHE_CLEAN_", cAlternateFileName="_CACHE~1")) returned 0 [0154.835] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0154.835] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826e2030, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826e2030, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 0 [0154.835] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0154.835] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e13d0, dwReserved1=0x18edec, cFileName="Profiles", cAlternateFileName="")) returned 0 [0154.835] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0154.835] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617069, dwReserved1=0x61737365, cFileName="updates", cAlternateFileName="")) returned 1 [0154.835] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c756166, dwReserved1=0x18ed74, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0154.835] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c756166, dwReserved1=0x18ed74, cFileName="..", cAlternateFileName="")) returned 1 [0154.835] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c756166, dwReserved1=0x18ed74, cFileName="E7CF176E110C211B", cAlternateFileName="E7CF17~1")) returned 1 [0154.835] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5f4e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0154.837] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5f4e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.837] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80a2b6d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x464, dwReserved0=0x5f4e, dwReserved1=0x0, cFileName="active-update.xml", cAlternateFileName="ACTIVE~1.XML")) returned 1 [0154.837] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\active-update.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0154.838] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\active-update.xml.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.839] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x464 [0154.839] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0154.839] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0154.925] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x464, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x464, lpOverlapped=0x0) returned 1 [0155.224] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x470, lpOverlapped=0x0) returned 1 [0155.225] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0155.244] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.253] CloseHandle (hObject=0xec) returned 1 [0155.253] CloseHandle (hObject=0xf0) returned 1 [0155.253] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\active-update.xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\active-update.xml.dvodltmf")) returned 0 [0155.254] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\active-update.xml.dvodltmf")) returned 0x2020 [0155.254] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80a2b6d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x464, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="active-update.xml", cAlternateFileName="ACTIVE~1.XML")) returned 0x2e84d8 [0155.254] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80a2b6d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x464, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="active-update.xml", cAlternateFileName="ACTIVE~1.XML")) returned 0 [0155.254] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0155.254] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\active-update.xml")) returned 1 [0155.255] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\active-update.xml")) returned 0xffffffff [0155.255] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb74b7b30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb74b7b30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dfd10, dwReserved1=0x18eb84, cFileName="updates", cAlternateFileName="")) returned 1 [0155.255] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb74b7b30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb74b7b30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0155.256] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb74b7b30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb74b7b30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.256] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80a2b6d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80a2b6d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbc, dwReserved1=0x0, cFileName="0", cAlternateFileName="")) returned 1 [0155.256] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80a2b6d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80a2b6d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78002e, dwReserved1=0x6c006d, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0155.256] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80a2b6d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80a2b6d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78002e, dwReserved1=0x6c006d, cFileName="..", cAlternateFileName="")) returned 1 [0155.256] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x818016b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x927c0, dwReserved0=0x78002e, dwReserved1=0x6c006d, cFileName="update.mar", cAlternateFileName="")) returned 1 [0155.256] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\0\\update.mar"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0155.257] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\0\\update.mar.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0155.258] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x927c0 [0155.258] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0155.258] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0155.343] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x927c0, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x927c0, lpOverlapped=0x0) returned 1 [0156.237] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x927d0, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x927d0, lpOverlapped=0x0) returned 1 [0156.247] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0156.267] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.278] CloseHandle (hObject=0xe4) returned 1 [0156.278] CloseHandle (hObject=0xe8) returned 1 [0156.278] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\0\\update.mar"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\0\\update.mar.dvodltmf")) returned 0 [0156.279] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\0\\update.mar.dvodltmf")) returned 0x2020 [0156.279] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x818016b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x927c0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="update.mar", cAlternateFileName="")) returned 0x2e8558 [0156.279] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x818016b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x927c0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="update.mar", cAlternateFileName="")) returned 0 [0156.279] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0156.279] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\0\\update.mar")) returned 1 [0156.284] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\0\\update.mar")) returned 0xffffffff [0156.284] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80993150, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80993150, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80993150, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc, dwReserved0=0x2dfd10, dwReserved1=0x18e6b4, cFileName="update.status", cAlternateFileName="UPDATE~1.STA")) returned 1 [0156.284] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\0\\update.status"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0156.288] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\0\\update.status.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0156.290] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc [0156.290] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0156.290] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0156.380] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xc, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0xc, lpOverlapped=0x0) returned 1 [0156.381] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x10, lpOverlapped=0x0) returned 1 [0156.382] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0156.404] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.414] CloseHandle (hObject=0xe8) returned 1 [0156.414] CloseHandle (hObject=0xe4) returned 1 [0156.414] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\0\\update.status"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\0\\update.status.dvodltmf")) returned 0 [0156.415] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\0\\update.status.dvodltmf")) returned 0x2020 [0156.415] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80993150, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80993150, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80993150, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="update.status", cAlternateFileName="UPDATE~1.STA")) returned 0x2e8558 [0156.416] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80993150, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80993150, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80993150, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="update.status", cAlternateFileName="UPDATE~1.STA")) returned 0 [0156.416] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0156.416] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\0\\update.status")) returned 1 [0156.416] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\0\\update.status")) returned 0xffffffff [0156.417] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80993150, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80993150, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80993150, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc, dwReserved0=0x2dfd10, dwReserved1=0x18e6b4, cFileName="update.status", cAlternateFileName="UPDATE~1.STA")) returned 0 [0156.417] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0156.417] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80a2b6d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80a2b6d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbc, dwReserved1=0x0, cFileName="0", cAlternateFileName="")) returned 0 [0156.417] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0156.417] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80a9daf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8548e650, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8548e650, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x39, dwReserved0=0x2dfd10, dwReserved1=0x18eb84, cFileName="updates.xml", cAlternateFileName="")) returned 1 [0156.417] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0156.417] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates.xml.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0156.418] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x39 [0156.418] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0156.418] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0156.506] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x39, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x39, lpOverlapped=0x0) returned 1 [0156.507] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x40, lpOverlapped=0x0) returned 1 [0156.508] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0156.529] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.538] CloseHandle (hObject=0xf0) returned 1 [0156.538] CloseHandle (hObject=0xec) returned 1 [0156.538] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates.xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates.xml.dvodltmf")) returned 0 [0156.539] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates.xml.dvodltmf")) returned 0x2020 [0156.539] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80a9daf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8548e650, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8548e650, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x39, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="updates.xml", cAlternateFileName="")) returned 0x2e84d8 [0156.540] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80a9daf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8548e650, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8548e650, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x39, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="updates.xml", cAlternateFileName="")) returned 0 [0156.540] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0156.540] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates.xml")) returned 1 [0156.541] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates.xml")) returned 0xffffffff [0156.541] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80a9daf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8548e650, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8548e650, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x39, dwReserved0=0x2dfd10, dwReserved1=0x18eb84, cFileName="updates.xml", cAlternateFileName="")) returned 0 [0156.541] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0156.541] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c756166, dwReserved1=0x18ed74, cFileName="E7CF176E110C211B", cAlternateFileName="E7CF17~1")) returned 0 [0156.541] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0156.541] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617069, dwReserved1=0x61737365, cFileName="updates", cAlternateFileName="")) returned 0 [0156.541] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0156.541] FindNextFileA (in: hFindFile=0x2dcc48, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7acc4d40, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7acc4d40, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72616265, dwReserved1=0x6769666e, cFileName="Temp", cAlternateFileName="")) returned 1 [0156.541] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7acc4d40, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7acc4d40, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31313243, dwReserved1=0x61737342, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0156.541] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7acc4d40, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7acc4d40, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31313243, dwReserved1=0x61737342, cFileName="..", cAlternateFileName="")) returned 1 [0156.542] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd8ed3fd0, ftCreationTime.dwHighDateTime=0x1d4ca92, ftLastAccessTime.dwLowDateTime=0x717c62d0, ftLastAccessTime.dwHighDateTime=0x1d4c890, ftLastWriteTime.dwLowDateTime=0x717c62d0, ftLastWriteTime.dwHighDateTime=0x1d4c890, nFileSizeHigh=0x0, nFileSizeLow=0x887b, dwReserved0=0x31313243, dwReserved1=0x61737342, cFileName="-Abs.mp4", cAlternateFileName="")) returned 1 [0156.542] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-Abs.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\-abs.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.542] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-Abs.mp4.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\-abs.mp4.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0156.543] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x887b [0156.543] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0156.543] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0156.631] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x887b, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x887b, lpOverlapped=0x0) returned 1 [0156.632] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x8880, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x8880, lpOverlapped=0x0) returned 1 [0156.633] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0156.654] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.664] CloseHandle (hObject=0xdc) returned 1 [0156.664] CloseHandle (hObject=0xf4) returned 1 [0156.664] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-Abs.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\-abs.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-Abs.mp4.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\-abs.mp4.dvodltmf")) returned 0 [0156.665] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-Abs.mp4.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\-abs.mp4.dvodltmf")) returned 0x2020 [0156.665] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-Abs.mp4", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd8ed3fd0, ftCreationTime.dwHighDateTime=0x1d4ca92, ftLastAccessTime.dwLowDateTime=0x717c62d0, ftLastAccessTime.dwHighDateTime=0x1d4c890, ftLastWriteTime.dwLowDateTime=0x717c62d0, ftLastWriteTime.dwHighDateTime=0x1d4c890, nFileSizeHigh=0x0, nFileSizeLow=0x887b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="-Abs.mp4", cAlternateFileName="")) returned 0x2e8458 [0156.674] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd8ed3fd0, ftCreationTime.dwHighDateTime=0x1d4ca92, ftLastAccessTime.dwLowDateTime=0x717c62d0, ftLastAccessTime.dwHighDateTime=0x1d4c890, ftLastWriteTime.dwLowDateTime=0x717c62d0, ftLastWriteTime.dwHighDateTime=0x1d4c890, nFileSizeHigh=0x0, nFileSizeLow=0x887b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="-Abs.mp4", cAlternateFileName="")) returned 0 [0156.675] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0156.675] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-Abs.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\-abs.mp4")) returned 1 [0156.676] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-Abs.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\-abs.mp4")) returned 0xffffffff [0156.676] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3bfe24e0, ftCreationTime.dwHighDateTime=0x1d4ce94, ftLastAccessTime.dwLowDateTime=0x43b74da0, ftLastAccessTime.dwHighDateTime=0x1d4d35e, ftLastWriteTime.dwLowDateTime=0x43b74da0, ftLastWriteTime.dwHighDateTime=0x1d4d35e, nFileSizeHigh=0x0, nFileSizeLow=0x4bcb, dwReserved0=0x0, dwReserved1=0x0, cFileName="-l8 F.flv", cAlternateFileName="-L8F~1.FLV")) returned 1 [0156.676] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-l8 F.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\-l8 f.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0156.676] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-l8 F.flv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\-l8 f.flv.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.677] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4bcb [0156.677] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0156.677] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0156.765] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4bcb, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x4bcb, lpOverlapped=0x0) returned 1 [0156.766] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4bd0, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x4bd0, lpOverlapped=0x0) returned 1 [0156.767] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0156.789] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.799] CloseHandle (hObject=0xf4) returned 1 [0156.799] CloseHandle (hObject=0xdc) returned 1 [0156.799] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-l8 F.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\-l8 f.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-l8 F.flv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\-l8 f.flv.dvodltmf")) returned 0 [0156.800] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-l8 F.flv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\-l8 f.flv.dvodltmf")) returned 0x2020 [0156.800] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-l8 F.flv", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3bfe24e0, ftCreationTime.dwHighDateTime=0x1d4ce94, ftLastAccessTime.dwLowDateTime=0x43b74da0, ftLastAccessTime.dwHighDateTime=0x1d4d35e, ftLastWriteTime.dwLowDateTime=0x43b74da0, ftLastWriteTime.dwHighDateTime=0x1d4d35e, nFileSizeHigh=0x0, nFileSizeLow=0x4bcb, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="-l8 F.flv", cAlternateFileName="-L8F~1.FLV")) returned 0x2e8458 [0156.800] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3bfe24e0, ftCreationTime.dwHighDateTime=0x1d4ce94, ftLastAccessTime.dwLowDateTime=0x43b74da0, ftLastAccessTime.dwHighDateTime=0x1d4d35e, ftLastWriteTime.dwLowDateTime=0x43b74da0, ftLastWriteTime.dwHighDateTime=0x1d4d35e, nFileSizeHigh=0x0, nFileSizeLow=0x4bcb, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="-l8 F.flv", cAlternateFileName="-L8F~1.FLV")) returned 0 [0156.800] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0156.800] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-l8 F.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\-l8 f.flv")) returned 1 [0156.801] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-l8 F.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\-l8 f.flv")) returned 0xffffffff [0156.801] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb157aad0, ftCreationTime.dwHighDateTime=0x1d4c55d, ftLastAccessTime.dwLowDateTime=0xa9b78d50, ftLastAccessTime.dwHighDateTime=0x1d4d3e4, ftLastWriteTime.dwLowDateTime=0xa9b78d50, ftLastWriteTime.dwHighDateTime=0x1d4d3e4, nFileSizeHigh=0x0, nFileSizeLow=0x44dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="3KruyrF2FrzWbu9.mp3", cAlternateFileName="3KRUYR~1.MP3")) returned 1 [0156.801] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\3KruyrF2FrzWbu9.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\3kruyrf2frzwbu9.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.801] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\3KruyrF2FrzWbu9.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\3kruyrf2frzwbu9.mp3.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0156.802] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x44dd [0156.802] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0156.803] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0156.888] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x44dd, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x44dd, lpOverlapped=0x0) returned 1 [0156.889] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x44e0, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x44e0, lpOverlapped=0x0) returned 1 [0156.890] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0156.910] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.920] CloseHandle (hObject=0xdc) returned 1 [0156.920] CloseHandle (hObject=0xf4) returned 1 [0156.920] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\3KruyrF2FrzWbu9.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\3kruyrf2frzwbu9.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\3KruyrF2FrzWbu9.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\3kruyrf2frzwbu9.mp3.dvodltmf")) returned 0 [0156.921] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\3KruyrF2FrzWbu9.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\3kruyrf2frzwbu9.mp3.dvodltmf")) returned 0x2020 [0156.921] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\3KruyrF2FrzWbu9.mp3", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb157aad0, ftCreationTime.dwHighDateTime=0x1d4c55d, ftLastAccessTime.dwLowDateTime=0xa9b78d50, ftLastAccessTime.dwHighDateTime=0x1d4d3e4, ftLastWriteTime.dwLowDateTime=0xa9b78d50, ftLastWriteTime.dwHighDateTime=0x1d4d3e4, nFileSizeHigh=0x0, nFileSizeLow=0x44dd, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="3KruyrF2FrzWbu9.mp3", cAlternateFileName="3KRUYR~1.MP3")) returned 0x2e8458 [0156.922] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb157aad0, ftCreationTime.dwHighDateTime=0x1d4c55d, ftLastAccessTime.dwLowDateTime=0xa9b78d50, ftLastAccessTime.dwHighDateTime=0x1d4d3e4, ftLastWriteTime.dwLowDateTime=0xa9b78d50, ftLastWriteTime.dwHighDateTime=0x1d4d3e4, nFileSizeHigh=0x0, nFileSizeLow=0x44dd, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="3KruyrF2FrzWbu9.mp3", cAlternateFileName="3KRUYR~1.MP3")) returned 0 [0156.922] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0156.922] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\3KruyrF2FrzWbu9.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\3kruyrf2frzwbu9.mp3")) returned 1 [0156.923] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\3KruyrF2FrzWbu9.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\3kruyrf2frzwbu9.mp3")) returned 0xffffffff [0156.923] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcae1a940, ftCreationTime.dwHighDateTime=0x1d4cd3e, ftLastAccessTime.dwLowDateTime=0x2c82f810, ftLastAccessTime.dwHighDateTime=0x1d4cd77, ftLastWriteTime.dwLowDateTime=0x2c82f810, ftLastWriteTime.dwHighDateTime=0x1d4cd77, nFileSizeHigh=0x0, nFileSizeLow=0x4bff, dwReserved0=0x0, dwReserved1=0x0, cFileName="5zvif2K10j.mp3", cAlternateFileName="5ZVIF2~1.MP3")) returned 1 [0156.923] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5zvif2K10j.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\5zvif2k10j.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0156.923] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5zvif2K10j.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\5zvif2k10j.mp3.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.924] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4bff [0156.924] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0156.924] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0157.011] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4bff, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x4bff, lpOverlapped=0x0) returned 1 [0157.012] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4c00, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x4c00, lpOverlapped=0x0) returned 1 [0157.014] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0157.033] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.043] CloseHandle (hObject=0xf4) returned 1 [0157.043] CloseHandle (hObject=0xdc) returned 1 [0157.043] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5zvif2K10j.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\5zvif2k10j.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5zvif2K10j.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\5zvif2k10j.mp3.dvodltmf")) returned 0 [0157.044] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5zvif2K10j.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\5zvif2k10j.mp3.dvodltmf")) returned 0x2020 [0157.044] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5zvif2K10j.mp3", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcae1a940, ftCreationTime.dwHighDateTime=0x1d4cd3e, ftLastAccessTime.dwLowDateTime=0x2c82f810, ftLastAccessTime.dwHighDateTime=0x1d4cd77, ftLastWriteTime.dwLowDateTime=0x2c82f810, ftLastWriteTime.dwHighDateTime=0x1d4cd77, nFileSizeHigh=0x0, nFileSizeLow=0x4bff, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5zvif2K10j.mp3", cAlternateFileName="5ZVIF2~1.MP3")) returned 0x2e8458 [0157.044] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcae1a940, ftCreationTime.dwHighDateTime=0x1d4cd3e, ftLastAccessTime.dwLowDateTime=0x2c82f810, ftLastAccessTime.dwHighDateTime=0x1d4cd77, ftLastWriteTime.dwLowDateTime=0x2c82f810, ftLastWriteTime.dwHighDateTime=0x1d4cd77, nFileSizeHigh=0x0, nFileSizeLow=0x4bff, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5zvif2K10j.mp3", cAlternateFileName="5ZVIF2~1.MP3")) returned 0 [0157.045] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0157.045] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5zvif2K10j.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\5zvif2k10j.mp3")) returned 1 [0157.046] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5zvif2K10j.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\5zvif2k10j.mp3")) returned 0xffffffff [0157.046] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c9d800, ftCreationTime.dwHighDateTime=0x1d4c8f6, ftLastAccessTime.dwLowDateTime=0x16d2ed60, ftLastAccessTime.dwHighDateTime=0x1d4ca55, ftLastWriteTime.dwLowDateTime=0x16d2ed60, ftLastWriteTime.dwHighDateTime=0x1d4ca55, nFileSizeHigh=0x0, nFileSizeLow=0xb57a, dwReserved0=0x2dfd10, dwReserved1=0x18f054, cFileName="6fdVD3ESWkRD 874jp.wav", cAlternateFileName="6FDVD3~1.WAV")) returned 1 [0157.046] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6fdVD3ESWkRD 874jp.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\6fdvd3eswkrd 874jp.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.046] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6fdVD3ESWkRD 874jp.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\6fdvd3eswkrd 874jp.wav.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0157.047] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb57a [0157.047] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0157.047] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0157.133] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb57a, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0xb57a, lpOverlapped=0x0) returned 1 [0157.134] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb580, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0xb580, lpOverlapped=0x0) returned 1 [0157.136] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0157.156] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.166] CloseHandle (hObject=0xdc) returned 1 [0157.166] CloseHandle (hObject=0xf4) returned 1 [0157.166] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6fdVD3ESWkRD 874jp.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\6fdvd3eswkrd 874jp.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6fdVD3ESWkRD 874jp.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\6fdvd3eswkrd 874jp.wav.dvodltmf")) returned 0 [0157.167] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6fdVD3ESWkRD 874jp.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\6fdvd3eswkrd 874jp.wav.dvodltmf")) returned 0x2020 [0157.167] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6fdVD3ESWkRD 874jp.wav", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c9d800, ftCreationTime.dwHighDateTime=0x1d4c8f6, ftLastAccessTime.dwLowDateTime=0x16d2ed60, ftLastAccessTime.dwHighDateTime=0x1d4ca55, ftLastWriteTime.dwLowDateTime=0x16d2ed60, ftLastWriteTime.dwHighDateTime=0x1d4ca55, nFileSizeHigh=0x0, nFileSizeLow=0xb57a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="6fdVD3ESWkRD 874jp.wav", cAlternateFileName="6FDVD3~1.WAV")) returned 0x2e8458 [0157.167] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c9d800, ftCreationTime.dwHighDateTime=0x1d4c8f6, ftLastAccessTime.dwLowDateTime=0x16d2ed60, ftLastAccessTime.dwHighDateTime=0x1d4ca55, ftLastWriteTime.dwLowDateTime=0x16d2ed60, ftLastWriteTime.dwHighDateTime=0x1d4ca55, nFileSizeHigh=0x0, nFileSizeLow=0xb57a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="6fdVD3ESWkRD 874jp.wav", cAlternateFileName="6FDVD3~1.WAV")) returned 0 [0157.167] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0157.167] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6fdVD3ESWkRD 874jp.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\6fdvd3eswkrd 874jp.wav")) returned 1 [0157.168] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6fdVD3ESWkRD 874jp.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\6fdvd3eswkrd 874jp.wav")) returned 0xffffffff [0157.168] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8426eba0, ftCreationTime.dwHighDateTime=0x1d4d5ae, ftLastAccessTime.dwLowDateTime=0x8426eba0, ftLastAccessTime.dwHighDateTime=0x1d4d5ae, ftLastWriteTime.dwLowDateTime=0x842e0fc0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeARM.log", cAlternateFileName="")) returned 1 [0157.168] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\adobearm.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0157.168] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\adobearm.log.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.169] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2fc [0157.169] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0157.170] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0157.255] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2fc, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x2fc, lpOverlapped=0x0) returned 1 [0157.256] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x300, lpOverlapped=0x0) returned 1 [0157.257] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0157.277] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.287] CloseHandle (hObject=0xf4) returned 1 [0157.287] CloseHandle (hObject=0xdc) returned 1 [0157.287] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\adobearm.log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\adobearm.log.dvodltmf")) returned 0 [0157.288] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\adobearm.log.dvodltmf")) returned 0x2020 [0157.288] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8426eba0, ftCreationTime.dwHighDateTime=0x1d4d5ae, ftLastAccessTime.dwLowDateTime=0x8426eba0, ftLastAccessTime.dwHighDateTime=0x1d4d5ae, ftLastWriteTime.dwLowDateTime=0x842e0fc0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AdobeARM.log", cAlternateFileName="")) returned 0x2e8458 [0157.288] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8426eba0, ftCreationTime.dwHighDateTime=0x1d4d5ae, ftLastAccessTime.dwLowDateTime=0x8426eba0, ftLastAccessTime.dwHighDateTime=0x1d4d5ae, ftLastWriteTime.dwLowDateTime=0x842e0fc0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AdobeARM.log", cAlternateFileName="")) returned 0 [0157.288] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0157.288] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\adobearm.log")) returned 1 [0157.289] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\adobearm.log")) returned 0xffffffff [0157.290] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x680feaa0, ftCreationTime.dwHighDateTime=0x1d4d141, ftLastAccessTime.dwLowDateTime=0xacfabd90, ftLastAccessTime.dwHighDateTime=0x1d4d338, ftLastWriteTime.dwLowDateTime=0xacfabd90, ftLastWriteTime.dwHighDateTime=0x1d4d338, nFileSizeHigh=0x0, nFileSizeLow=0x9467, dwReserved0=0x2dfd10, dwReserved1=0x18f054, cFileName="ak3Si0Nk8M.wav", cAlternateFileName="AK3SI0~1.WAV")) returned 1 [0157.290] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ak3Si0Nk8M.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ak3si0nk8m.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.290] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ak3Si0Nk8M.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ak3si0nk8m.wav.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0157.291] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9467 [0157.291] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0157.291] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0157.388] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x9467, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x9467, lpOverlapped=0x0) returned 1 [0157.389] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x9470, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x9470, lpOverlapped=0x0) returned 1 [0157.390] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0157.410] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.420] CloseHandle (hObject=0xdc) returned 1 [0157.420] CloseHandle (hObject=0xf4) returned 1 [0157.420] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ak3Si0Nk8M.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ak3si0nk8m.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ak3Si0Nk8M.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ak3si0nk8m.wav.dvodltmf")) returned 0 [0157.421] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ak3Si0Nk8M.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ak3si0nk8m.wav.dvodltmf")) returned 0x2020 [0157.421] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ak3Si0Nk8M.wav", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x680feaa0, ftCreationTime.dwHighDateTime=0x1d4d141, ftLastAccessTime.dwLowDateTime=0xacfabd90, ftLastAccessTime.dwHighDateTime=0x1d4d338, ftLastWriteTime.dwLowDateTime=0xacfabd90, ftLastWriteTime.dwHighDateTime=0x1d4d338, nFileSizeHigh=0x0, nFileSizeLow=0x9467, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="ak3Si0Nk8M.wav", cAlternateFileName="AK3SI0~1.WAV")) returned 0x2e8458 [0157.421] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x680feaa0, ftCreationTime.dwHighDateTime=0x1d4d141, ftLastAccessTime.dwLowDateTime=0xacfabd90, ftLastAccessTime.dwHighDateTime=0x1d4d338, ftLastWriteTime.dwLowDateTime=0xacfabd90, ftLastWriteTime.dwHighDateTime=0x1d4d338, nFileSizeHigh=0x0, nFileSizeLow=0x9467, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="ak3Si0Nk8M.wav", cAlternateFileName="AK3SI0~1.WAV")) returned 0 [0157.421] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0157.421] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ak3Si0Nk8M.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ak3si0nk8m.wav")) returned 1 [0157.422] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ak3Si0Nk8M.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ak3si0nk8m.wav")) returned 0xffffffff [0157.422] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2faa8270, ftCreationTime.dwHighDateTime=0x1d4ca38, ftLastAccessTime.dwLowDateTime=0x7ffd49a0, ftLastAccessTime.dwHighDateTime=0x1d4c656, ftLastWriteTime.dwLowDateTime=0x7ffd49a0, ftLastWriteTime.dwHighDateTime=0x1d4c656, nFileSizeHigh=0x0, nFileSizeLow=0x151a2, dwReserved0=0x2dfd10, dwReserved1=0x18f054, cFileName="bDzRS5.png", cAlternateFileName="")) returned 1 [0157.422] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bDzRS5.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\bdzrs5.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0157.422] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bDzRS5.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\bdzrs5.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.423] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x151a2 [0157.423] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0157.424] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0157.515] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x151a2, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x151a2, lpOverlapped=0x0) returned 1 [0157.517] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x151b0, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x151b0, lpOverlapped=0x0) returned 1 [0157.519] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0157.540] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.549] CloseHandle (hObject=0xf4) returned 1 [0157.549] CloseHandle (hObject=0xdc) returned 1 [0157.549] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bDzRS5.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\bdzrs5.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bDzRS5.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\bdzrs5.png.dvodltmf")) returned 0 [0157.550] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bDzRS5.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\bdzrs5.png.dvodltmf")) returned 0x2020 [0157.550] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bDzRS5.png", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2faa8270, ftCreationTime.dwHighDateTime=0x1d4ca38, ftLastAccessTime.dwLowDateTime=0x7ffd49a0, ftLastAccessTime.dwHighDateTime=0x1d4c656, ftLastWriteTime.dwLowDateTime=0x7ffd49a0, ftLastWriteTime.dwHighDateTime=0x1d4c656, nFileSizeHigh=0x0, nFileSizeLow=0x151a2, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="bDzRS5.png", cAlternateFileName="")) returned 0x2e8458 [0157.551] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2faa8270, ftCreationTime.dwHighDateTime=0x1d4ca38, ftLastAccessTime.dwLowDateTime=0x7ffd49a0, ftLastAccessTime.dwHighDateTime=0x1d4c656, ftLastWriteTime.dwLowDateTime=0x7ffd49a0, ftLastWriteTime.dwHighDateTime=0x1d4c656, nFileSizeHigh=0x0, nFileSizeLow=0x151a2, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="bDzRS5.png", cAlternateFileName="")) returned 0 [0157.551] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0157.551] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bDzRS5.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\bdzrs5.png")) returned 1 [0157.552] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bDzRS5.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\bdzrs5.png")) returned 0xffffffff [0157.552] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40afd5a0, ftCreationTime.dwHighDateTime=0x1d4c97c, ftLastAccessTime.dwLowDateTime=0xee42dfc0, ftLastAccessTime.dwHighDateTime=0x1d4c925, ftLastWriteTime.dwLowDateTime=0xee42dfc0, ftLastWriteTime.dwHighDateTime=0x1d4c925, nFileSizeHigh=0x0, nFileSizeLow=0x1569b, dwReserved0=0x0, dwReserved1=0x0, cFileName="cIS87Ho.mp4", cAlternateFileName="")) returned 1 [0157.552] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cIS87Ho.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cis87ho.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.552] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cIS87Ho.mp4.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cis87ho.mp4.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0157.553] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1569b [0157.553] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0157.553] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0157.639] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1569b, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x1569b, lpOverlapped=0x0) returned 1 [0157.640] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x156a0, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x156a0, lpOverlapped=0x0) returned 1 [0157.642] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0157.662] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.672] CloseHandle (hObject=0xdc) returned 1 [0157.672] CloseHandle (hObject=0xf4) returned 1 [0157.672] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cIS87Ho.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cis87ho.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cIS87Ho.mp4.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cis87ho.mp4.dvodltmf")) returned 0 [0157.673] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cIS87Ho.mp4.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cis87ho.mp4.dvodltmf")) returned 0x2020 [0157.673] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cIS87Ho.mp4", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40afd5a0, ftCreationTime.dwHighDateTime=0x1d4c97c, ftLastAccessTime.dwLowDateTime=0xee42dfc0, ftLastAccessTime.dwHighDateTime=0x1d4c925, ftLastWriteTime.dwLowDateTime=0xee42dfc0, ftLastWriteTime.dwHighDateTime=0x1d4c925, nFileSizeHigh=0x0, nFileSizeLow=0x1569b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="cIS87Ho.mp4", cAlternateFileName="")) returned 0x2e8458 [0157.673] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40afd5a0, ftCreationTime.dwHighDateTime=0x1d4c97c, ftLastAccessTime.dwLowDateTime=0xee42dfc0, ftLastAccessTime.dwHighDateTime=0x1d4c925, ftLastWriteTime.dwLowDateTime=0xee42dfc0, ftLastWriteTime.dwHighDateTime=0x1d4c925, nFileSizeHigh=0x0, nFileSizeLow=0x1569b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="cIS87Ho.mp4", cAlternateFileName="")) returned 0 [0157.673] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0157.673] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cIS87Ho.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cis87ho.mp4")) returned 1 [0157.674] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cIS87Ho.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cis87ho.mp4")) returned 0xffffffff [0157.674] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dfd10, dwReserved1=0x18f054, cFileName="Cookies", cAlternateFileName="")) returned 1 [0157.674] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0157.684] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.684] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x78, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0157.684] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cookies\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.685] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cookies\\index.dat.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0157.685] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4000 [0157.685] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0157.686] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0157.775] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x4000, lpOverlapped=0x0) returned 1 [0157.777] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x4010, lpOverlapped=0x0) returned 1 [0157.778] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0157.799] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.809] CloseHandle (hObject=0xdc) returned 1 [0157.809] CloseHandle (hObject=0xec) returned 1 [0157.810] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cookies\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cookies\\index.dat.dvodltmf")) returned 0 [0157.810] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cookies\\index.dat.dvodltmf")) returned 0x2020 [0157.810] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0x2e8498 [0157.811] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0 [0157.811] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0157.811] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cookies\\index.dat")) returned 1 [0157.812] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cookies\\index.dat")) returned 0xffffffff [0157.812] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x78, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0157.812] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0157.812] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb416f6a0, ftCreationTime.dwHighDateTime=0x1d4d46b, ftLastAccessTime.dwLowDateTime=0xb8062500, ftLastAccessTime.dwHighDateTime=0x1d4c8a0, ftLastWriteTime.dwLowDateTime=0xb8062500, ftLastWriteTime.dwHighDateTime=0x1d4c8a0, nFileSizeHigh=0x0, nFileSizeLow=0x9a85, dwReserved0=0x2dfd10, dwReserved1=0x18f054, cFileName="cPfAqgTj0J-.m4a", cAlternateFileName="CPFAQG~1.M4A")) returned 1 [0157.812] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cPfAqgTj0J-.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cpfaqgtj0j-.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0157.812] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cPfAqgTj0J-.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cpfaqgtj0j-.m4a.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0157.813] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9a85 [0157.813] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0157.813] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0157.900] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x9a85, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x9a85, lpOverlapped=0x0) returned 1 [0157.902] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x9a90, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x9a90, lpOverlapped=0x0) returned 1 [0157.903] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0157.923] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.933] CloseHandle (hObject=0xf4) returned 1 [0157.933] CloseHandle (hObject=0xec) returned 1 [0157.933] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cPfAqgTj0J-.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cpfaqgtj0j-.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cPfAqgTj0J-.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cpfaqgtj0j-.m4a.dvodltmf")) returned 0 [0157.934] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cPfAqgTj0J-.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cpfaqgtj0j-.m4a.dvodltmf")) returned 0x2020 [0157.934] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cPfAqgTj0J-.m4a", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb416f6a0, ftCreationTime.dwHighDateTime=0x1d4d46b, ftLastAccessTime.dwLowDateTime=0xb8062500, ftLastAccessTime.dwHighDateTime=0x1d4c8a0, ftLastWriteTime.dwLowDateTime=0xb8062500, ftLastWriteTime.dwHighDateTime=0x1d4c8a0, nFileSizeHigh=0x0, nFileSizeLow=0x9a85, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="cPfAqgTj0J-.m4a", cAlternateFileName="CPFAQG~1.M4A")) returned 0x2e8458 [0157.934] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb416f6a0, ftCreationTime.dwHighDateTime=0x1d4d46b, ftLastAccessTime.dwLowDateTime=0xb8062500, ftLastAccessTime.dwHighDateTime=0x1d4c8a0, ftLastWriteTime.dwLowDateTime=0xb8062500, ftLastWriteTime.dwHighDateTime=0x1d4c8a0, nFileSizeHigh=0x0, nFileSizeLow=0x9a85, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="cPfAqgTj0J-.m4a", cAlternateFileName="CPFAQG~1.M4A")) returned 0 [0157.934] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0157.934] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cPfAqgTj0J-.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cpfaqgtj0j-.m4a")) returned 1 [0157.935] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cPfAqgTj0J-.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cpfaqgtj0j-.m4a")) returned 0xffffffff [0157.935] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x397d2590, ftCreationTime.dwHighDateTime=0x1d4cb42, ftLastAccessTime.dwLowDateTime=0xee056760, ftLastAccessTime.dwHighDateTime=0x1d4c8be, ftLastWriteTime.dwLowDateTime=0xee056760, ftLastWriteTime.dwHighDateTime=0x1d4c8be, nFileSizeHigh=0x0, nFileSizeLow=0xf37b, dwReserved0=0x2dfd10, dwReserved1=0x18f054, cFileName="EAK6sqGmvGxQ.mp3", cAlternateFileName="EAK6SQ~1.MP3")) returned 1 [0157.935] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\EAK6sqGmvGxQ.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\eak6sqgmvgxq.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0157.935] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\EAK6sqGmvGxQ.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\eak6sqgmvgxq.mp3.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0157.936] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf37b [0157.936] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0157.936] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0158.023] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xf37b, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0xf37b, lpOverlapped=0x0) returned 1 [0158.025] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf380, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0xf380, lpOverlapped=0x0) returned 1 [0158.026] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0158.046] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.056] CloseHandle (hObject=0xec) returned 1 [0158.056] CloseHandle (hObject=0xf4) returned 1 [0158.057] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\EAK6sqGmvGxQ.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\eak6sqgmvgxq.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\EAK6sqGmvGxQ.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\eak6sqgmvgxq.mp3.dvodltmf")) returned 0 [0158.057] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\EAK6sqGmvGxQ.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\eak6sqgmvgxq.mp3.dvodltmf")) returned 0x2020 [0158.058] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\EAK6sqGmvGxQ.mp3", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x397d2590, ftCreationTime.dwHighDateTime=0x1d4cb42, ftLastAccessTime.dwLowDateTime=0xee056760, ftLastAccessTime.dwHighDateTime=0x1d4c8be, ftLastWriteTime.dwLowDateTime=0xee056760, ftLastWriteTime.dwHighDateTime=0x1d4c8be, nFileSizeHigh=0x0, nFileSizeLow=0xf37b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="EAK6sqGmvGxQ.mp3", cAlternateFileName="EAK6SQ~1.MP3")) returned 0x2e8458 [0158.058] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x397d2590, ftCreationTime.dwHighDateTime=0x1d4cb42, ftLastAccessTime.dwLowDateTime=0xee056760, ftLastAccessTime.dwHighDateTime=0x1d4c8be, ftLastWriteTime.dwLowDateTime=0xee056760, ftLastWriteTime.dwHighDateTime=0x1d4c8be, nFileSizeHigh=0x0, nFileSizeLow=0xf37b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="EAK6sqGmvGxQ.mp3", cAlternateFileName="EAK6SQ~1.MP3")) returned 0 [0158.058] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0158.058] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\EAK6sqGmvGxQ.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\eak6sqgmvgxq.mp3")) returned 1 [0158.059] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\EAK6sqGmvGxQ.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\eak6sqgmvgxq.mp3")) returned 0xffffffff [0158.059] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd50491c0, ftCreationTime.dwHighDateTime=0x1d4c5a1, ftLastAccessTime.dwLowDateTime=0xd7d1740, ftLastAccessTime.dwHighDateTime=0x1d4cd70, ftLastWriteTime.dwLowDateTime=0xd7d1740, ftLastWriteTime.dwHighDateTime=0x1d4cd70, nFileSizeHigh=0x0, nFileSizeLow=0x434e, dwReserved0=0x2dfd10, dwReserved1=0x18f054, cFileName="fBdGp7x.bmp", cAlternateFileName="")) returned 1 [0158.059] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fBdGp7x.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fbdgp7x.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0158.059] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fBdGp7x.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fbdgp7x.bmp.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0158.060] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x434e [0158.060] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0158.061] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0158.158] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x434e, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x434e, lpOverlapped=0x0) returned 1 [0158.159] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4350, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x4350, lpOverlapped=0x0) returned 1 [0158.161] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0158.181] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.190] CloseHandle (hObject=0xf4) returned 1 [0158.190] CloseHandle (hObject=0xec) returned 1 [0158.191] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fBdGp7x.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fbdgp7x.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fBdGp7x.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fbdgp7x.bmp.dvodltmf")) returned 0 [0158.191] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fBdGp7x.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fbdgp7x.bmp.dvodltmf")) returned 0x2020 [0158.192] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fBdGp7x.bmp", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd50491c0, ftCreationTime.dwHighDateTime=0x1d4c5a1, ftLastAccessTime.dwLowDateTime=0xd7d1740, ftLastAccessTime.dwHighDateTime=0x1d4cd70, ftLastWriteTime.dwLowDateTime=0xd7d1740, ftLastWriteTime.dwHighDateTime=0x1d4cd70, nFileSizeHigh=0x0, nFileSizeLow=0x434e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="fBdGp7x.bmp", cAlternateFileName="")) returned 0x2e8458 [0158.192] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd50491c0, ftCreationTime.dwHighDateTime=0x1d4c5a1, ftLastAccessTime.dwLowDateTime=0xd7d1740, ftLastAccessTime.dwHighDateTime=0x1d4cd70, ftLastWriteTime.dwLowDateTime=0xd7d1740, ftLastWriteTime.dwHighDateTime=0x1d4cd70, nFileSizeHigh=0x0, nFileSizeLow=0x434e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="fBdGp7x.bmp", cAlternateFileName="")) returned 0 [0158.192] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0158.192] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fBdGp7x.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fbdgp7x.bmp")) returned 1 [0158.193] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fBdGp7x.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fbdgp7x.bmp")) returned 0xffffffff [0158.193] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd372be60, ftCreationTime.dwHighDateTime=0x1d4d51c, ftLastAccessTime.dwLowDateTime=0x90ce38d0, ftLastAccessTime.dwHighDateTime=0x1d4d1ef, ftLastWriteTime.dwLowDateTime=0x90ce38d0, ftLastWriteTime.dwHighDateTime=0x1d4d1ef, nFileSizeHigh=0x0, nFileSizeLow=0x11352, dwReserved0=0x2dfd10, dwReserved1=0x18f054, cFileName="fnfAz6VHnulgk.ods", cAlternateFileName="FNFAZ6~1.ODS")) returned 1 [0158.193] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fnfAz6VHnulgk.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fnfaz6vhnulgk.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0158.193] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fnfAz6VHnulgk.ods.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fnfaz6vhnulgk.ods.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0158.194] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11352 [0158.194] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0158.194] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0158.281] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x11352, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x11352, lpOverlapped=0x0) returned 1 [0158.282] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x11360, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x11360, lpOverlapped=0x0) returned 1 [0158.284] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0158.304] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.314] CloseHandle (hObject=0xec) returned 1 [0158.314] CloseHandle (hObject=0xf4) returned 1 [0158.314] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fnfAz6VHnulgk.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fnfaz6vhnulgk.ods"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fnfAz6VHnulgk.ods.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fnfaz6vhnulgk.ods.dvodltmf")) returned 0 [0158.315] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fnfAz6VHnulgk.ods.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fnfaz6vhnulgk.ods.dvodltmf")) returned 0x2020 [0158.315] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fnfAz6VHnulgk.ods", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd372be60, ftCreationTime.dwHighDateTime=0x1d4d51c, ftLastAccessTime.dwLowDateTime=0x90ce38d0, ftLastAccessTime.dwHighDateTime=0x1d4d1ef, ftLastWriteTime.dwLowDateTime=0x90ce38d0, ftLastWriteTime.dwHighDateTime=0x1d4d1ef, nFileSizeHigh=0x0, nFileSizeLow=0x11352, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="fnfAz6VHnulgk.ods", cAlternateFileName="FNFAZ6~1.ODS")) returned 0x2e8458 [0158.315] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd372be60, ftCreationTime.dwHighDateTime=0x1d4d51c, ftLastAccessTime.dwLowDateTime=0x90ce38d0, ftLastAccessTime.dwHighDateTime=0x1d4d1ef, ftLastWriteTime.dwLowDateTime=0x90ce38d0, ftLastWriteTime.dwHighDateTime=0x1d4d1ef, nFileSizeHigh=0x0, nFileSizeLow=0x11352, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="fnfAz6VHnulgk.ods", cAlternateFileName="FNFAZ6~1.ODS")) returned 0 [0158.315] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0158.315] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fnfAz6VHnulgk.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fnfaz6vhnulgk.ods")) returned 1 [0158.316] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fnfAz6VHnulgk.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fnfaz6vhnulgk.ods")) returned 0xffffffff [0158.316] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33d9ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x33d9ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dfd10, dwReserved1=0x18f054, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 1 [0158.316] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fxsapidebuglogfile.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0158.317] CloseHandle (hObject=0xffffffff) returned 0 [0158.317] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fxsapidebuglogfile.txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fxsapidebuglogfile.txt.dvodltmf")) returned 0 [0158.317] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fxsapidebuglogfile.txt.dvodltmf")) returned 0xffffffff [0158.317] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33d9ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x33d9ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 0x2e8458 [0158.317] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33d9ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x33d9ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 0 [0158.317] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0158.317] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fxsapidebuglogfile.txt")) returned 0 [0158.317] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fxsapidebuglogfile.txt")) returned 0x80 [0158.317] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29261740, ftCreationTime.dwHighDateTime=0x1d4cf81, ftLastAccessTime.dwLowDateTime=0xbfa24770, ftLastAccessTime.dwHighDateTime=0x1d4d0ad, ftLastWriteTime.dwLowDateTime=0xbfa24770, ftLastWriteTime.dwHighDateTime=0x1d4d0ad, nFileSizeHigh=0x0, nFileSizeLow=0xb8d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fZOTCMeSX.gif", cAlternateFileName="FZOTCM~1.GIF")) returned 1 [0158.317] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fZOTCMeSX.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fzotcmesx.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0158.317] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fZOTCMeSX.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fzotcmesx.gif.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0158.318] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb8d0 [0158.318] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0158.319] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0158.408] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb8d0, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0xb8d0, lpOverlapped=0x0) returned 1 [0158.409] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb8e0, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0xb8e0, lpOverlapped=0x0) returned 1 [0158.411] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0158.430] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.440] CloseHandle (hObject=0xf4) returned 1 [0158.440] CloseHandle (hObject=0xec) returned 1 [0158.440] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fZOTCMeSX.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fzotcmesx.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fZOTCMeSX.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fzotcmesx.gif.dvodltmf")) returned 0 [0158.441] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fZOTCMeSX.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fzotcmesx.gif.dvodltmf")) returned 0x2020 [0158.441] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fZOTCMeSX.gif", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29261740, ftCreationTime.dwHighDateTime=0x1d4cf81, ftLastAccessTime.dwLowDateTime=0xbfa24770, ftLastAccessTime.dwHighDateTime=0x1d4d0ad, ftLastWriteTime.dwLowDateTime=0xbfa24770, ftLastWriteTime.dwHighDateTime=0x1d4d0ad, nFileSizeHigh=0x0, nFileSizeLow=0xb8d0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="fZOTCMeSX.gif", cAlternateFileName="FZOTCM~1.GIF")) returned 0x2e8458 [0158.441] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29261740, ftCreationTime.dwHighDateTime=0x1d4cf81, ftLastAccessTime.dwLowDateTime=0xbfa24770, ftLastAccessTime.dwHighDateTime=0x1d4d0ad, ftLastWriteTime.dwLowDateTime=0xbfa24770, ftLastWriteTime.dwHighDateTime=0x1d4d0ad, nFileSizeHigh=0x0, nFileSizeLow=0xb8d0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="fZOTCMeSX.gif", cAlternateFileName="FZOTCM~1.GIF")) returned 0 [0158.441] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0158.441] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fZOTCMeSX.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fzotcmesx.gif")) returned 1 [0158.442] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fZOTCMeSX.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fzotcmesx.gif")) returned 0xffffffff [0158.442] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xab342f10, ftCreationTime.dwHighDateTime=0x1d4cacc, ftLastAccessTime.dwLowDateTime=0xc2cdcc40, ftLastAccessTime.dwHighDateTime=0x1d4cf99, ftLastWriteTime.dwLowDateTime=0xc2cdcc40, ftLastWriteTime.dwHighDateTime=0x1d4cf99, nFileSizeHigh=0x0, nFileSizeLow=0x9aa1, dwReserved0=0x2dfd10, dwReserved1=0x18f054, cFileName="H0f6fLZgcSgr.swf", cAlternateFileName="H0F6FL~1.SWF")) returned 1 [0158.442] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\H0f6fLZgcSgr.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\h0f6flzgcsgr.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0158.442] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\H0f6fLZgcSgr.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\h0f6flzgcsgr.swf.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0158.443] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9aa1 [0158.443] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0158.443] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0158.528] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x9aa1, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x9aa1, lpOverlapped=0x0) returned 1 [0158.530] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x9ab0, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x9ab0, lpOverlapped=0x0) returned 1 [0158.531] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0158.551] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.560] CloseHandle (hObject=0xec) returned 1 [0158.560] CloseHandle (hObject=0xf4) returned 1 [0158.560] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\H0f6fLZgcSgr.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\h0f6flzgcsgr.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\H0f6fLZgcSgr.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\h0f6flzgcsgr.swf.dvodltmf")) returned 0 [0158.561] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\H0f6fLZgcSgr.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\h0f6flzgcsgr.swf.dvodltmf")) returned 0x2020 [0158.561] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\H0f6fLZgcSgr.swf", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xab342f10, ftCreationTime.dwHighDateTime=0x1d4cacc, ftLastAccessTime.dwLowDateTime=0xc2cdcc40, ftLastAccessTime.dwHighDateTime=0x1d4cf99, ftLastWriteTime.dwLowDateTime=0xc2cdcc40, ftLastWriteTime.dwHighDateTime=0x1d4cf99, nFileSizeHigh=0x0, nFileSizeLow=0x9aa1, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="H0f6fLZgcSgr.swf", cAlternateFileName="H0F6FL~1.SWF")) returned 0x2e8458 [0158.562] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xab342f10, ftCreationTime.dwHighDateTime=0x1d4cacc, ftLastAccessTime.dwLowDateTime=0xc2cdcc40, ftLastAccessTime.dwHighDateTime=0x1d4cf99, ftLastWriteTime.dwLowDateTime=0xc2cdcc40, ftLastWriteTime.dwHighDateTime=0x1d4cf99, nFileSizeHigh=0x0, nFileSizeLow=0x9aa1, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="H0f6fLZgcSgr.swf", cAlternateFileName="H0F6FL~1.SWF")) returned 0 [0158.562] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0158.562] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\H0f6fLZgcSgr.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\h0f6flzgcsgr.swf")) returned 1 [0158.563] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\H0f6fLZgcSgr.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\h0f6flzgcsgr.swf")) returned 0xffffffff [0158.563] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dfd10, dwReserved1=0x18f054, cFileName="History", cAlternateFileName="")) returned 1 [0158.563] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x82, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0158.564] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x82, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0158.564] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x82, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1 [0158.564] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x770073, dwReserved1=0x6c0066, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0158.564] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x770073, dwReserved1=0x6c0066, cFileName="..", cAlternateFileName="")) returned 1 [0158.564] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9824200, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x770073, dwReserved1=0x6c0066, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0158.564] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.565] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0158.569] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x91 [0158.569] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0158.569] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0158.654] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x91, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x91, lpOverlapped=0x0) returned 1 [0158.655] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xa0, lpOverlapped=0x0) returned 1 [0158.656] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0158.676] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.695] CloseHandle (hObject=0xdc) returned 1 [0158.695] CloseHandle (hObject=0xf0) returned 1 [0158.695] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\desktop.ini.dvodltmf")) returned 0 [0158.696] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\desktop.ini.dvodltmf")) returned 0x2020 [0158.696] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9824200, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e84d8 [0158.696] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9824200, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0158.696] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0158.696] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\desktop.ini")) returned 1 [0158.697] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\desktop.ini")) returned 0xffffffff [0158.697] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2dfd10, dwReserved1=0x18eb84, cFileName="index.dat", cAlternateFileName="")) returned 1 [0158.697] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0158.697] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\index.dat.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0158.698] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4000 [0158.698] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0158.698] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0158.783] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x4000, lpOverlapped=0x0) returned 1 [0158.784] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x4010, lpOverlapped=0x0) returned 1 [0158.785] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0158.805] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.814] CloseHandle (hObject=0xf0) returned 1 [0158.814] CloseHandle (hObject=0xdc) returned 1 [0158.814] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\index.dat.dvodltmf")) returned 0 [0158.815] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\index.dat.dvodltmf")) returned 0x2020 [0158.815] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0x2e84d8 [0158.815] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0 [0158.816] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0158.816] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\index.dat")) returned 1 [0158.816] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\index.dat")) returned 0xffffffff [0158.817] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2dfd10, dwReserved1=0x18eb84, cFileName="index.dat", cAlternateFileName="")) returned 0 [0158.817] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0158.817] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x82, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 0 [0158.817] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0158.817] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5a0b570, ftCreationTime.dwHighDateTime=0x1d4cfb2, ftLastAccessTime.dwLowDateTime=0xbe9e8390, ftLastAccessTime.dwHighDateTime=0x1d4d501, ftLastWriteTime.dwLowDateTime=0xbe9e8390, ftLastWriteTime.dwHighDateTime=0x1d4d501, nFileSizeHigh=0x0, nFileSizeLow=0x71d0, dwReserved0=0x2dfd10, dwReserved1=0x18f054, cFileName="I3UcJ5DAGcVQN_71.bmp", cAlternateFileName="I3UCJ5~1.BMP")) returned 1 [0158.817] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\I3UcJ5DAGcVQN_71.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\i3ucj5dagcvqn_71.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0158.817] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\I3UcJ5DAGcVQN_71.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\i3ucj5dagcvqn_71.bmp.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0158.818] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x71d0 [0158.818] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0158.818] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0158.903] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x71d0, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x71d0, lpOverlapped=0x0) returned 1 [0158.904] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x71e0, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x71e0, lpOverlapped=0x0) returned 1 [0158.905] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0158.925] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.935] CloseHandle (hObject=0xf4) returned 1 [0158.935] CloseHandle (hObject=0xec) returned 1 [0158.935] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\I3UcJ5DAGcVQN_71.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\i3ucj5dagcvqn_71.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\I3UcJ5DAGcVQN_71.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\i3ucj5dagcvqn_71.bmp.dvodltmf")) returned 0 [0158.936] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\I3UcJ5DAGcVQN_71.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\i3ucj5dagcvqn_71.bmp.dvodltmf")) returned 0x2020 [0158.936] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\I3UcJ5DAGcVQN_71.bmp", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5a0b570, ftCreationTime.dwHighDateTime=0x1d4cfb2, ftLastAccessTime.dwLowDateTime=0xbe9e8390, ftLastAccessTime.dwHighDateTime=0x1d4d501, ftLastWriteTime.dwLowDateTime=0xbe9e8390, ftLastWriteTime.dwHighDateTime=0x1d4d501, nFileSizeHigh=0x0, nFileSizeLow=0x71d0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="I3UcJ5DAGcVQN_71.bmp", cAlternateFileName="I3UCJ5~1.BMP")) returned 0x2e8458 [0158.936] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5a0b570, ftCreationTime.dwHighDateTime=0x1d4cfb2, ftLastAccessTime.dwLowDateTime=0xbe9e8390, ftLastAccessTime.dwHighDateTime=0x1d4d501, ftLastWriteTime.dwLowDateTime=0xbe9e8390, ftLastWriteTime.dwHighDateTime=0x1d4d501, nFileSizeHigh=0x0, nFileSizeLow=0x71d0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="I3UcJ5DAGcVQN_71.bmp", cAlternateFileName="I3UCJ5~1.BMP")) returned 0 [0158.936] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0158.936] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\I3UcJ5DAGcVQN_71.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\i3ucj5dagcvqn_71.bmp")) returned 1 [0158.937] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\I3UcJ5DAGcVQN_71.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\i3ucj5dagcvqn_71.bmp")) returned 0xffffffff [0158.937] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43013930, ftCreationTime.dwHighDateTime=0x1d4cafc, ftLastAccessTime.dwLowDateTime=0x89ccb7c0, ftLastAccessTime.dwHighDateTime=0x1d4d23d, ftLastWriteTime.dwLowDateTime=0x89ccb7c0, ftLastWriteTime.dwHighDateTime=0x1d4d23d, nFileSizeHigh=0x0, nFileSizeLow=0x389a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LH-PYU9ug66rR5cp.rtf", cAlternateFileName="LH-PYU~1.RTF")) returned 1 [0158.937] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LH-PYU9ug66rR5cp.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\lh-pyu9ug66rr5cp.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0158.937] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LH-PYU9ug66rR5cp.rtf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\lh-pyu9ug66rr5cp.rtf.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0158.938] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x389a [0158.938] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0158.938] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0159.021] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x389a, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x389a, lpOverlapped=0x0) returned 1 [0159.022] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x38a0, lpOverlapped=0x0) returned 1 [0159.035] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0159.054] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.063] CloseHandle (hObject=0xec) returned 1 [0159.063] CloseHandle (hObject=0xf4) returned 1 [0159.064] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LH-PYU9ug66rR5cp.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\lh-pyu9ug66rr5cp.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LH-PYU9ug66rR5cp.rtf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\lh-pyu9ug66rr5cp.rtf.dvodltmf")) returned 0 [0159.064] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LH-PYU9ug66rR5cp.rtf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\lh-pyu9ug66rr5cp.rtf.dvodltmf")) returned 0x2020 [0159.064] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LH-PYU9ug66rR5cp.rtf", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43013930, ftCreationTime.dwHighDateTime=0x1d4cafc, ftLastAccessTime.dwLowDateTime=0x89ccb7c0, ftLastAccessTime.dwHighDateTime=0x1d4d23d, ftLastWriteTime.dwLowDateTime=0x89ccb7c0, ftLastWriteTime.dwHighDateTime=0x1d4d23d, nFileSizeHigh=0x0, nFileSizeLow=0x389a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="LH-PYU9ug66rR5cp.rtf", cAlternateFileName="LH-PYU~1.RTF")) returned 0x2e8458 [0159.064] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43013930, ftCreationTime.dwHighDateTime=0x1d4cafc, ftLastAccessTime.dwLowDateTime=0x89ccb7c0, ftLastAccessTime.dwHighDateTime=0x1d4d23d, ftLastWriteTime.dwLowDateTime=0x89ccb7c0, ftLastWriteTime.dwHighDateTime=0x1d4d23d, nFileSizeHigh=0x0, nFileSizeLow=0x389a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="LH-PYU9ug66rR5cp.rtf", cAlternateFileName="LH-PYU~1.RTF")) returned 0 [0159.065] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0159.065] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LH-PYU9ug66rR5cp.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\lh-pyu9ug66rr5cp.rtf")) returned 1 [0159.065] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LH-PYU9ug66rR5cp.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\lh-pyu9ug66rr5cp.rtf")) returned 0xffffffff [0159.066] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a6b29d0, ftCreationTime.dwHighDateTime=0x1d4d0d3, ftLastAccessTime.dwLowDateTime=0xb1a6c90, ftLastAccessTime.dwHighDateTime=0x1d4cf88, ftLastWriteTime.dwLowDateTime=0xb1a6c90, ftLastWriteTime.dwHighDateTime=0x1d4cf88, nFileSizeHigh=0x0, nFileSizeLow=0x68f, dwReserved0=0x0, dwReserved1=0x0, cFileName="m65Y KGi6Ylb.wav", cAlternateFileName="M65YKG~1.WAV")) returned 1 [0159.066] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\m65Y KGi6Ylb.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\m65y kgi6ylb.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0159.066] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\m65Y KGi6Ylb.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\m65y kgi6ylb.wav.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0159.066] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x68f [0159.066] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0159.067] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0159.150] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x68f, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x68f, lpOverlapped=0x0) returned 1 [0159.151] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x690, lpOverlapped=0x0) returned 1 [0159.152] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0159.171] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.181] CloseHandle (hObject=0xf4) returned 1 [0159.181] CloseHandle (hObject=0xec) returned 1 [0159.181] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\m65Y KGi6Ylb.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\m65y kgi6ylb.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\m65Y KGi6Ylb.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\m65y kgi6ylb.wav.dvodltmf")) returned 0 [0159.182] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\m65Y KGi6Ylb.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\m65y kgi6ylb.wav.dvodltmf")) returned 0x2020 [0159.182] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\m65Y KGi6Ylb.wav", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a6b29d0, ftCreationTime.dwHighDateTime=0x1d4d0d3, ftLastAccessTime.dwLowDateTime=0xb1a6c90, ftLastAccessTime.dwHighDateTime=0x1d4cf88, ftLastWriteTime.dwLowDateTime=0xb1a6c90, ftLastWriteTime.dwHighDateTime=0x1d4cf88, nFileSizeHigh=0x0, nFileSizeLow=0x68f, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="m65Y KGi6Ylb.wav", cAlternateFileName="M65YKG~1.WAV")) returned 0x2e8458 [0159.182] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a6b29d0, ftCreationTime.dwHighDateTime=0x1d4d0d3, ftLastAccessTime.dwLowDateTime=0xb1a6c90, ftLastAccessTime.dwHighDateTime=0x1d4cf88, ftLastWriteTime.dwLowDateTime=0xb1a6c90, ftLastWriteTime.dwHighDateTime=0x1d4cf88, nFileSizeHigh=0x0, nFileSizeLow=0x68f, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="m65Y KGi6Ylb.wav", cAlternateFileName="M65YKG~1.WAV")) returned 0 [0159.182] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0159.182] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\m65Y KGi6Ylb.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\m65y kgi6ylb.wav")) returned 1 [0159.183] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\m65Y KGi6Ylb.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\m65y kgi6ylb.wav")) returned 0xffffffff [0159.183] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xebca04c0, ftCreationTime.dwHighDateTime=0x1d4ca1b, ftLastAccessTime.dwLowDateTime=0xecede870, ftLastAccessTime.dwHighDateTime=0x1d4cd96, ftLastWriteTime.dwLowDateTime=0xecede870, ftLastWriteTime.dwHighDateTime=0x1d4cd96, nFileSizeHigh=0x0, nFileSizeLow=0x1308a, dwReserved0=0x2dfd10, dwReserved1=0x18f054, cFileName="Ng30zW6ejCm5H.wav", cAlternateFileName="NG30ZW~1.WAV")) returned 1 [0159.183] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Ng30zW6ejCm5H.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ng30zw6ejcm5h.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0159.183] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Ng30zW6ejCm5H.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ng30zw6ejcm5h.wav.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0159.184] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1308a [0159.184] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0159.184] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0159.268] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1308a, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x1308a, lpOverlapped=0x0) returned 1 [0159.270] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x13090, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x13090, lpOverlapped=0x0) returned 1 [0159.272] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0159.292] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.301] CloseHandle (hObject=0xec) returned 1 [0159.301] CloseHandle (hObject=0xf4) returned 1 [0159.301] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Ng30zW6ejCm5H.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ng30zw6ejcm5h.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Ng30zW6ejCm5H.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ng30zw6ejcm5h.wav.dvodltmf")) returned 0 [0159.302] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Ng30zW6ejCm5H.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ng30zw6ejcm5h.wav.dvodltmf")) returned 0x2020 [0159.302] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Ng30zW6ejCm5H.wav", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xebca04c0, ftCreationTime.dwHighDateTime=0x1d4ca1b, ftLastAccessTime.dwLowDateTime=0xecede870, ftLastAccessTime.dwHighDateTime=0x1d4cd96, ftLastWriteTime.dwLowDateTime=0xecede870, ftLastWriteTime.dwHighDateTime=0x1d4cd96, nFileSizeHigh=0x0, nFileSizeLow=0x1308a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Ng30zW6ejCm5H.wav", cAlternateFileName="NG30ZW~1.WAV")) returned 0x2e8458 [0159.302] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xebca04c0, ftCreationTime.dwHighDateTime=0x1d4ca1b, ftLastAccessTime.dwLowDateTime=0xecede870, ftLastAccessTime.dwHighDateTime=0x1d4cd96, ftLastWriteTime.dwLowDateTime=0xecede870, ftLastWriteTime.dwHighDateTime=0x1d4cd96, nFileSizeHigh=0x0, nFileSizeLow=0x1308a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Ng30zW6ejCm5H.wav", cAlternateFileName="NG30ZW~1.WAV")) returned 0 [0159.302] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0159.302] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Ng30zW6ejCm5H.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ng30zw6ejcm5h.wav")) returned 1 [0159.304] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Ng30zW6ejCm5H.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ng30zw6ejcm5h.wav")) returned 0xffffffff [0159.304] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec9cfb70, ftCreationTime.dwHighDateTime=0x1d4cca8, ftLastAccessTime.dwLowDateTime=0xab31110, ftLastAccessTime.dwHighDateTime=0x1d4c639, ftLastWriteTime.dwLowDateTime=0xab31110, ftLastWriteTime.dwHighDateTime=0x1d4c639, nFileSizeHigh=0x0, nFileSizeLow=0xb666, dwReserved0=0x2dfd10, dwReserved1=0x18f054, cFileName="ny8b0u.bmp", cAlternateFileName="")) returned 1 [0159.304] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ny8b0u.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ny8b0u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0159.304] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ny8b0u.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ny8b0u.bmp.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0159.305] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb666 [0159.305] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0159.305] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0159.393] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb666, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0xb666, lpOverlapped=0x0) returned 1 [0159.394] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb670, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0xb670, lpOverlapped=0x0) returned 1 [0159.396] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0159.415] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.425] CloseHandle (hObject=0xf4) returned 1 [0159.425] CloseHandle (hObject=0xec) returned 1 [0159.425] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ny8b0u.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ny8b0u.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ny8b0u.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ny8b0u.bmp.dvodltmf")) returned 0 [0159.426] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ny8b0u.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ny8b0u.bmp.dvodltmf")) returned 0x2020 [0159.426] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ny8b0u.bmp", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec9cfb70, ftCreationTime.dwHighDateTime=0x1d4cca8, ftLastAccessTime.dwLowDateTime=0xab31110, ftLastAccessTime.dwHighDateTime=0x1d4c639, ftLastWriteTime.dwLowDateTime=0xab31110, ftLastWriteTime.dwHighDateTime=0x1d4c639, nFileSizeHigh=0x0, nFileSizeLow=0xb666, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="ny8b0u.bmp", cAlternateFileName="")) returned 0x2e8458 [0159.426] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec9cfb70, ftCreationTime.dwHighDateTime=0x1d4cca8, ftLastAccessTime.dwLowDateTime=0xab31110, ftLastAccessTime.dwHighDateTime=0x1d4c639, ftLastWriteTime.dwLowDateTime=0xab31110, ftLastWriteTime.dwHighDateTime=0x1d4c639, nFileSizeHigh=0x0, nFileSizeLow=0xb666, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="ny8b0u.bmp", cAlternateFileName="")) returned 0 [0159.427] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0159.427] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ny8b0u.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ny8b0u.bmp")) returned 1 [0159.428] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ny8b0u.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ny8b0u.bmp")) returned 0xffffffff [0159.428] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf42fbf90, ftCreationTime.dwHighDateTime=0x1d4ca63, ftLastAccessTime.dwLowDateTime=0x5c661ae0, ftLastAccessTime.dwHighDateTime=0x1d4d2c6, ftLastWriteTime.dwLowDateTime=0x5c661ae0, ftLastWriteTime.dwHighDateTime=0x1d4d2c6, nFileSizeHigh=0x0, nFileSizeLow=0x124c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="o3yd3.wav", cAlternateFileName="")) returned 1 [0159.428] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\o3yd3.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\o3yd3.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0159.428] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\o3yd3.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\o3yd3.wav.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0159.429] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x124c6 [0159.429] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0159.429] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0159.514] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x124c6, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x124c6, lpOverlapped=0x0) returned 1 [0159.515] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x124d0, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x124d0, lpOverlapped=0x0) returned 1 [0159.517] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0159.537] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.547] CloseHandle (hObject=0xec) returned 1 [0159.547] CloseHandle (hObject=0xf4) returned 1 [0159.547] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\o3yd3.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\o3yd3.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\o3yd3.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\o3yd3.wav.dvodltmf")) returned 0 [0159.548] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\o3yd3.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\o3yd3.wav.dvodltmf")) returned 0x2020 [0159.548] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\o3yd3.wav", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf42fbf90, ftCreationTime.dwHighDateTime=0x1d4ca63, ftLastAccessTime.dwLowDateTime=0x5c661ae0, ftLastAccessTime.dwHighDateTime=0x1d4d2c6, ftLastWriteTime.dwLowDateTime=0x5c661ae0, ftLastWriteTime.dwHighDateTime=0x1d4d2c6, nFileSizeHigh=0x0, nFileSizeLow=0x124c6, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="o3yd3.wav", cAlternateFileName="")) returned 0x2e8458 [0159.548] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf42fbf90, ftCreationTime.dwHighDateTime=0x1d4ca63, ftLastAccessTime.dwLowDateTime=0x5c661ae0, ftLastAccessTime.dwHighDateTime=0x1d4d2c6, ftLastWriteTime.dwLowDateTime=0x5c661ae0, ftLastWriteTime.dwHighDateTime=0x1d4d2c6, nFileSizeHigh=0x0, nFileSizeLow=0x124c6, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="o3yd3.wav", cAlternateFileName="")) returned 0 [0159.548] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0159.548] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\o3yd3.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\o3yd3.wav")) returned 1 [0159.550] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\o3yd3.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\o3yd3.wav")) returned 0xffffffff [0159.550] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x797652b0, ftCreationTime.dwHighDateTime=0x1d4cc29, ftLastAccessTime.dwLowDateTime=0xfd8ef010, ftLastAccessTime.dwHighDateTime=0x1d4c73e, ftLastWriteTime.dwLowDateTime=0xfd8ef010, ftLastWriteTime.dwHighDateTime=0x1d4c73e, nFileSizeHigh=0x0, nFileSizeLow=0x16c5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="P5wN3XKpqQg92Xk1v9sn.mkv", cAlternateFileName="P5WN3X~1.MKV")) returned 1 [0159.550] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\P5wN3XKpqQg92Xk1v9sn.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\p5wn3xkpqqg92xk1v9sn.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0159.550] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\P5wN3XKpqQg92Xk1v9sn.mkv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\p5wn3xkpqqg92xk1v9sn.mkv.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0159.551] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16c5c [0159.551] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0159.551] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0159.637] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x16c5c, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x16c5c, lpOverlapped=0x0) returned 1 [0159.638] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x16c60, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x16c60, lpOverlapped=0x0) returned 1 [0159.641] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0159.660] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.670] CloseHandle (hObject=0xf4) returned 1 [0159.670] CloseHandle (hObject=0xec) returned 1 [0159.670] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\P5wN3XKpqQg92Xk1v9sn.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\p5wn3xkpqqg92xk1v9sn.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\P5wN3XKpqQg92Xk1v9sn.mkv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\p5wn3xkpqqg92xk1v9sn.mkv.dvodltmf")) returned 0 [0159.671] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\P5wN3XKpqQg92Xk1v9sn.mkv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\p5wn3xkpqqg92xk1v9sn.mkv.dvodltmf")) returned 0x2020 [0159.671] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\P5wN3XKpqQg92Xk1v9sn.mkv", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x797652b0, ftCreationTime.dwHighDateTime=0x1d4cc29, ftLastAccessTime.dwLowDateTime=0xfd8ef010, ftLastAccessTime.dwHighDateTime=0x1d4c73e, ftLastWriteTime.dwLowDateTime=0xfd8ef010, ftLastWriteTime.dwHighDateTime=0x1d4c73e, nFileSizeHigh=0x0, nFileSizeLow=0x16c5c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="P5wN3XKpqQg92Xk1v9sn.mkv", cAlternateFileName="P5WN3X~1.MKV")) returned 0x2e8458 [0159.671] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x797652b0, ftCreationTime.dwHighDateTime=0x1d4cc29, ftLastAccessTime.dwLowDateTime=0xfd8ef010, ftLastAccessTime.dwHighDateTime=0x1d4c73e, ftLastWriteTime.dwLowDateTime=0xfd8ef010, ftLastWriteTime.dwHighDateTime=0x1d4c73e, nFileSizeHigh=0x0, nFileSizeLow=0x16c5c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="P5wN3XKpqQg92Xk1v9sn.mkv", cAlternateFileName="P5WN3X~1.MKV")) returned 0 [0159.671] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0159.671] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\P5wN3XKpqQg92Xk1v9sn.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\p5wn3xkpqqg92xk1v9sn.mkv")) returned 1 [0159.672] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\P5wN3XKpqQg92Xk1v9sn.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\p5wn3xkpqqg92xk1v9sn.mkv")) returned 0xffffffff [0159.672] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa6d87d10, ftCreationTime.dwHighDateTime=0x1d4d443, ftLastAccessTime.dwLowDateTime=0xb3991e40, ftLastAccessTime.dwHighDateTime=0x1d4ca5e, ftLastWriteTime.dwLowDateTime=0xb3991e40, ftLastWriteTime.dwHighDateTime=0x1d4ca5e, nFileSizeHigh=0x0, nFileSizeLow=0xd675, dwReserved0=0x0, dwReserved1=0x0, cFileName="P6rnofIHDd.gif", cAlternateFileName="P6RNOF~1.GIF")) returned 1 [0159.672] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\P6rnofIHDd.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\p6rnofihdd.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0159.672] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\P6rnofIHDd.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\p6rnofihdd.gif.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0159.673] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd675 [0159.673] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0159.674] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0159.772] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd675, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0xd675, lpOverlapped=0x0) returned 1 [0159.774] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd680, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0xd680, lpOverlapped=0x0) returned 1 [0159.775] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0159.795] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.805] CloseHandle (hObject=0xec) returned 1 [0159.805] CloseHandle (hObject=0xf4) returned 1 [0159.805] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\P6rnofIHDd.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\p6rnofihdd.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\P6rnofIHDd.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\p6rnofihdd.gif.dvodltmf")) returned 0 [0159.806] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\P6rnofIHDd.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\p6rnofihdd.gif.dvodltmf")) returned 0x2020 [0159.806] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\P6rnofIHDd.gif", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa6d87d10, ftCreationTime.dwHighDateTime=0x1d4d443, ftLastAccessTime.dwLowDateTime=0xb3991e40, ftLastAccessTime.dwHighDateTime=0x1d4ca5e, ftLastWriteTime.dwLowDateTime=0xb3991e40, ftLastWriteTime.dwHighDateTime=0x1d4ca5e, nFileSizeHigh=0x0, nFileSizeLow=0xd675, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="P6rnofIHDd.gif", cAlternateFileName="P6RNOF~1.GIF")) returned 0x2e8458 [0159.806] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa6d87d10, ftCreationTime.dwHighDateTime=0x1d4d443, ftLastAccessTime.dwLowDateTime=0xb3991e40, ftLastAccessTime.dwHighDateTime=0x1d4ca5e, ftLastWriteTime.dwLowDateTime=0xb3991e40, ftLastWriteTime.dwHighDateTime=0x1d4ca5e, nFileSizeHigh=0x0, nFileSizeLow=0xd675, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="P6rnofIHDd.gif", cAlternateFileName="P6RNOF~1.GIF")) returned 0 [0159.806] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0159.806] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\P6rnofIHDd.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\p6rnofihdd.gif")) returned 1 [0159.807] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\P6rnofIHDd.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\p6rnofihdd.gif")) returned 0xffffffff [0159.807] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5456c600, ftCreationTime.dwHighDateTime=0x1d4d506, ftLastAccessTime.dwLowDateTime=0x3b8725b0, ftLastAccessTime.dwHighDateTime=0x1d4d3ae, ftLastWriteTime.dwLowDateTime=0x3b8725b0, ftLastWriteTime.dwHighDateTime=0x1d4d3ae, nFileSizeHigh=0x0, nFileSizeLow=0x69a6, dwReserved0=0x2dfd10, dwReserved1=0x18f054, cFileName="rw5rkrU8dELnxHBpDTJ.m4a", cAlternateFileName="RW5RKR~1.M4A")) returned 1 [0159.807] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rw5rkrU8dELnxHBpDTJ.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\rw5rkru8delnxhbpdtj.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0159.807] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rw5rkrU8dELnxHBpDTJ.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\rw5rkru8delnxhbpdtj.m4a.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0159.808] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x69a6 [0159.808] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0159.809] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0159.894] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x69a6, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x69a6, lpOverlapped=0x0) returned 1 [0159.895] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x69b0, lpOverlapped=0x0) returned 1 [0159.896] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0159.916] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.925] CloseHandle (hObject=0xf4) returned 1 [0159.926] CloseHandle (hObject=0xec) returned 1 [0159.926] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rw5rkrU8dELnxHBpDTJ.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\rw5rkru8delnxhbpdtj.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rw5rkrU8dELnxHBpDTJ.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\rw5rkru8delnxhbpdtj.m4a.dvodltmf")) returned 0 [0159.926] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rw5rkrU8dELnxHBpDTJ.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\rw5rkru8delnxhbpdtj.m4a.dvodltmf")) returned 0x2020 [0159.927] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rw5rkrU8dELnxHBpDTJ.m4a", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5456c600, ftCreationTime.dwHighDateTime=0x1d4d506, ftLastAccessTime.dwLowDateTime=0x3b8725b0, ftLastAccessTime.dwHighDateTime=0x1d4d3ae, ftLastWriteTime.dwLowDateTime=0x3b8725b0, ftLastWriteTime.dwHighDateTime=0x1d4d3ae, nFileSizeHigh=0x0, nFileSizeLow=0x69a6, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="rw5rkrU8dELnxHBpDTJ.m4a", cAlternateFileName="RW5RKR~1.M4A")) returned 0x2e8458 [0159.927] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5456c600, ftCreationTime.dwHighDateTime=0x1d4d506, ftLastAccessTime.dwLowDateTime=0x3b8725b0, ftLastAccessTime.dwHighDateTime=0x1d4d3ae, ftLastWriteTime.dwLowDateTime=0x3b8725b0, ftLastWriteTime.dwHighDateTime=0x1d4d3ae, nFileSizeHigh=0x0, nFileSizeLow=0x69a6, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="rw5rkrU8dELnxHBpDTJ.m4a", cAlternateFileName="RW5RKR~1.M4A")) returned 0 [0159.927] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0159.927] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rw5rkrU8dELnxHBpDTJ.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\rw5rkru8delnxhbpdtj.m4a")) returned 1 [0159.928] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rw5rkrU8dELnxHBpDTJ.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\rw5rkru8delnxhbpdtj.m4a")) returned 0xffffffff [0159.928] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52af59a0, ftCreationTime.dwHighDateTime=0x1d4c7f7, ftLastAccessTime.dwLowDateTime=0x8abf8a00, ftLastAccessTime.dwHighDateTime=0x1d4d17e, ftLastWriteTime.dwLowDateTime=0x8abf8a00, ftLastWriteTime.dwHighDateTime=0x1d4d17e, nFileSizeHigh=0x0, nFileSizeLow=0x15f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="T6ltCPjD.pdf", cAlternateFileName="")) returned 1 [0159.928] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T6ltCPjD.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\t6ltcpjd.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0159.928] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T6ltCPjD.pdf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\t6ltcpjd.pdf.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0159.929] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15f9 [0159.929] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0159.929] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0160.014] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x15f9, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x15f9, lpOverlapped=0x0) returned 1 [0160.015] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x1600, lpOverlapped=0x0) returned 1 [0160.016] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0160.036] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.045] CloseHandle (hObject=0xec) returned 1 [0160.045] CloseHandle (hObject=0xf4) returned 1 [0160.045] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T6ltCPjD.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\t6ltcpjd.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T6ltCPjD.pdf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\t6ltcpjd.pdf.dvodltmf")) returned 0 [0160.046] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T6ltCPjD.pdf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\t6ltcpjd.pdf.dvodltmf")) returned 0x2020 [0160.046] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T6ltCPjD.pdf", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52af59a0, ftCreationTime.dwHighDateTime=0x1d4c7f7, ftLastAccessTime.dwLowDateTime=0x8abf8a00, ftLastAccessTime.dwHighDateTime=0x1d4d17e, ftLastWriteTime.dwLowDateTime=0x8abf8a00, ftLastWriteTime.dwHighDateTime=0x1d4d17e, nFileSizeHigh=0x0, nFileSizeLow=0x15f9, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="T6ltCPjD.pdf", cAlternateFileName="")) returned 0x2e8458 [0160.047] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52af59a0, ftCreationTime.dwHighDateTime=0x1d4c7f7, ftLastAccessTime.dwLowDateTime=0x8abf8a00, ftLastAccessTime.dwHighDateTime=0x1d4d17e, ftLastWriteTime.dwLowDateTime=0x8abf8a00, ftLastWriteTime.dwHighDateTime=0x1d4d17e, nFileSizeHigh=0x0, nFileSizeLow=0x15f9, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="T6ltCPjD.pdf", cAlternateFileName="")) returned 0 [0160.047] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0160.047] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T6ltCPjD.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\t6ltcpjd.pdf")) returned 1 [0160.047] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T6ltCPjD.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\t6ltcpjd.pdf")) returned 0xffffffff [0160.048] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfa299cc0, ftCreationTime.dwHighDateTime=0x1d4caa6, ftLastAccessTime.dwLowDateTime=0x50d86c90, ftLastAccessTime.dwHighDateTime=0x1d4cd22, ftLastWriteTime.dwLowDateTime=0x50d86c90, ftLastWriteTime.dwHighDateTime=0x1d4cd22, nFileSizeHigh=0x0, nFileSizeLow=0xfe8f, dwReserved0=0x2dfd10, dwReserved1=0x18f054, cFileName="t9WfnOLdpgMrlM5W.png", cAlternateFileName="T9WFNO~1.PNG")) returned 1 [0160.048] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t9WfnOLdpgMrlM5W.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\t9wfnoldpgmrlm5w.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0160.048] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t9WfnOLdpgMrlM5W.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\t9wfnoldpgmrlm5w.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0160.049] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfe8f [0160.049] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0160.049] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0160.134] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xfe8f, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0xfe8f, lpOverlapped=0x0) returned 1 [0160.136] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xfe90, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0xfe90, lpOverlapped=0x0) returned 1 [0160.138] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0160.157] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.166] CloseHandle (hObject=0xf4) returned 1 [0160.166] CloseHandle (hObject=0xec) returned 1 [0160.166] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t9WfnOLdpgMrlM5W.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\t9wfnoldpgmrlm5w.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t9WfnOLdpgMrlM5W.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\t9wfnoldpgmrlm5w.png.dvodltmf")) returned 0 [0160.167] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t9WfnOLdpgMrlM5W.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\t9wfnoldpgmrlm5w.png.dvodltmf")) returned 0x2020 [0160.167] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t9WfnOLdpgMrlM5W.png", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfa299cc0, ftCreationTime.dwHighDateTime=0x1d4caa6, ftLastAccessTime.dwLowDateTime=0x50d86c90, ftLastAccessTime.dwHighDateTime=0x1d4cd22, ftLastWriteTime.dwLowDateTime=0x50d86c90, ftLastWriteTime.dwHighDateTime=0x1d4cd22, nFileSizeHigh=0x0, nFileSizeLow=0xfe8f, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="t9WfnOLdpgMrlM5W.png", cAlternateFileName="T9WFNO~1.PNG")) returned 0x2e8458 [0160.167] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfa299cc0, ftCreationTime.dwHighDateTime=0x1d4caa6, ftLastAccessTime.dwLowDateTime=0x50d86c90, ftLastAccessTime.dwHighDateTime=0x1d4cd22, ftLastWriteTime.dwLowDateTime=0x50d86c90, ftLastWriteTime.dwHighDateTime=0x1d4cd22, nFileSizeHigh=0x0, nFileSizeLow=0xfe8f, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="t9WfnOLdpgMrlM5W.png", cAlternateFileName="T9WFNO~1.PNG")) returned 0 [0160.167] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0160.167] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t9WfnOLdpgMrlM5W.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\t9wfnoldpgmrlm5w.png")) returned 1 [0160.168] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t9WfnOLdpgMrlM5W.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\t9wfnoldpgmrlm5w.png")) returned 0xffffffff [0160.168] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0160.168] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0160.169] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0160.170] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8a, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1 [0160.170] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x35004d, dwReserved1=0x2e0057, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0160.170] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x35004d, dwReserved1=0x2e0057, cFileName="..", cAlternateFileName="")) returned 1 [0160.170] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x35004d, dwReserved1=0x2e0057, cFileName="03J4UQW0", cAlternateFileName="")) returned 1 [0160.170] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0160.171] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0160.171] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0160.171] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\03j4uqw0\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0160.171] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\03j4uqw0\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0160.171] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0160.171] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0160.172] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0160.252] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x43, lpOverlapped=0x0) returned 1 [0160.254] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x50, lpOverlapped=0x0) returned 1 [0160.254] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0160.273] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.282] CloseHandle (hObject=0xf0) returned 1 [0160.282] CloseHandle (hObject=0xe4) returned 1 [0160.283] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\03j4uqw0\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\03j4uqw0\\desktop.ini.dvodltmf")) returned 0 [0160.283] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\03j4uqw0\\desktop.ini.dvodltmf")) returned 0x2020 [0160.283] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8518 [0160.283] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0160.283] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0160.283] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\03j4uqw0\\desktop.ini")) returned 1 [0160.284] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\03j4uqw0\\desktop.ini")) returned 0xffffffff [0160.284] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0160.284] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0160.284] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x35004d, dwReserved1=0x2e0057, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0160.284] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.285] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0160.287] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0160.287] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0160.287] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0160.373] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x43, lpOverlapped=0x0) returned 1 [0160.373] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x50, lpOverlapped=0x0) returned 1 [0160.374] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0160.393] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.402] CloseHandle (hObject=0xdc) returned 1 [0160.402] CloseHandle (hObject=0xe4) returned 1 [0160.402] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\desktop.ini.dvodltmf")) returned 0 [0160.403] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\desktop.ini.dvodltmf")) returned 0x2020 [0160.403] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e84d8 [0160.403] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0160.403] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0160.403] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\desktop.ini")) returned 1 [0160.404] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\desktop.ini")) returned 0xffffffff [0160.404] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2dfd10, dwReserved1=0x18eb84, cFileName="index.dat", cAlternateFileName="")) returned 1 [0160.404] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0160.404] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\index.dat.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0160.404] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8000 [0160.405] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0160.405] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0160.492] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x8000, lpOverlapped=0x0) returned 1 [0160.494] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x8010, lpOverlapped=0x0) returned 1 [0160.495] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0160.515] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.524] CloseHandle (hObject=0xe4) returned 1 [0160.524] CloseHandle (hObject=0xdc) returned 1 [0160.524] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\index.dat.dvodltmf")) returned 0 [0160.525] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\index.dat.dvodltmf")) returned 0x2020 [0160.525] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0x2e84d8 [0160.525] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0 [0160.525] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0160.525] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\index.dat")) returned 1 [0160.526] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\index.dat")) returned 0xffffffff [0160.526] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dfd10, dwReserved1=0x18eb84, cFileName="KETAJP6D", cAlternateFileName="")) returned 1 [0160.526] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0160.526] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0160.527] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0xbe, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0160.527] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\ketajp6d\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0160.527] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\ketajp6d\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0160.527] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0160.527] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0160.528] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0160.610] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x43, lpOverlapped=0x0) returned 1 [0160.611] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x50, lpOverlapped=0x0) returned 1 [0160.612] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0160.632] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.644] CloseHandle (hObject=0xe4) returned 1 [0160.644] CloseHandle (hObject=0xf0) returned 1 [0160.644] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\ketajp6d\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\ketajp6d\\desktop.ini.dvodltmf")) returned 0 [0160.645] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\ketajp6d\\desktop.ini.dvodltmf")) returned 0x2020 [0160.645] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8518 [0160.645] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0160.645] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0160.645] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\ketajp6d\\desktop.ini")) returned 1 [0160.646] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\ketajp6d\\desktop.ini")) returned 0xffffffff [0160.646] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0xbe, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0160.646] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0160.646] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dfd10, dwReserved1=0x18eb84, cFileName="VB18B0KB", cAlternateFileName="")) returned 1 [0160.646] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dfd10, dwReserved1=0x18e91c, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0160.646] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dfd10, dwReserved1=0x18e91c, cFileName="..", cAlternateFileName="")) returned 1 [0160.647] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2dfd10, dwReserved1=0x18e91c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0160.647] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\vb18b0kb\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0160.647] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\vb18b0kb\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0160.647] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0160.647] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0160.648] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0160.741] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x43, lpOverlapped=0x0) returned 1 [0160.742] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x50, lpOverlapped=0x0) returned 1 [0160.743] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0160.766] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.777] CloseHandle (hObject=0xf0) returned 1 [0160.777] CloseHandle (hObject=0xe4) returned 1 [0160.777] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\vb18b0kb\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\vb18b0kb\\desktop.ini.dvodltmf")) returned 0 [0160.778] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\vb18b0kb\\desktop.ini.dvodltmf")) returned 0x2020 [0160.778] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8518 [0160.778] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0160.778] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0160.778] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\vb18b0kb\\desktop.ini")) returned 1 [0160.779] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\vb18b0kb\\desktop.ini")) returned 0xffffffff [0160.779] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2dfd10, dwReserved1=0x18e91c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0160.779] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0160.779] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dfd10, dwReserved1=0x18eb84, cFileName="XT1RPYG9", cAlternateFileName="")) returned 1 [0160.779] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dfd10, dwReserved1=0x18e91c, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0160.780] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dfd10, dwReserved1=0x18e91c, cFileName="..", cAlternateFileName="")) returned 1 [0160.780] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2dfd10, dwReserved1=0x18e91c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0160.780] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\xt1rpyg9\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0160.780] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\xt1rpyg9\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0160.780] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0160.780] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0160.781] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0160.865] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x43, lpOverlapped=0x0) returned 1 [0160.866] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x50, lpOverlapped=0x0) returned 1 [0160.866] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0160.886] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.896] CloseHandle (hObject=0xe4) returned 1 [0160.896] CloseHandle (hObject=0xf0) returned 1 [0160.896] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\xt1rpyg9\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\xt1rpyg9\\desktop.ini.dvodltmf")) returned 0 [0160.897] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\xt1rpyg9\\desktop.ini.dvodltmf")) returned 0x2020 [0160.897] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8518 [0160.897] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0160.897] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0160.897] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\xt1rpyg9\\desktop.ini")) returned 1 [0160.898] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\xt1rpyg9\\desktop.ini")) returned 0xffffffff [0160.898] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2dfd10, dwReserved1=0x18e91c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0160.898] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0160.898] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dfd10, dwReserved1=0x18eb84, cFileName="XT1RPYG9", cAlternateFileName="")) returned 0 [0160.898] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0160.898] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8a, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 0 [0160.898] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0160.898] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x99b70480, ftCreationTime.dwHighDateTime=0x1d4cb1f, ftLastAccessTime.dwLowDateTime=0x32060ec0, ftLastAccessTime.dwHighDateTime=0x1d4cf53, ftLastWriteTime.dwLowDateTime=0x32060ec0, ftLastWriteTime.dwHighDateTime=0x1d4cf53, nFileSizeHigh=0x0, nFileSizeLow=0x11e24, dwReserved0=0x0, dwReserved1=0x0, cFileName="TGYL3r.gif", cAlternateFileName="")) returned 1 [0160.898] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TGYL3r.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tgyl3r.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0160.899] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TGYL3r.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tgyl3r.gif.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0160.899] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11e24 [0160.899] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0160.900] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0160.985] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x11e24, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x11e24, lpOverlapped=0x0) returned 1 [0160.986] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x11e30, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x11e30, lpOverlapped=0x0) returned 1 [0160.988] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0161.008] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.018] CloseHandle (hObject=0xec) returned 1 [0161.018] CloseHandle (hObject=0xf4) returned 1 [0161.018] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TGYL3r.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tgyl3r.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TGYL3r.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tgyl3r.gif.dvodltmf")) returned 0 [0161.019] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TGYL3r.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tgyl3r.gif.dvodltmf")) returned 0x2020 [0161.019] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TGYL3r.gif", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x99b70480, ftCreationTime.dwHighDateTime=0x1d4cb1f, ftLastAccessTime.dwLowDateTime=0x32060ec0, ftLastAccessTime.dwHighDateTime=0x1d4cf53, ftLastWriteTime.dwLowDateTime=0x32060ec0, ftLastWriteTime.dwHighDateTime=0x1d4cf53, nFileSizeHigh=0x0, nFileSizeLow=0x11e24, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="TGYL3r.gif", cAlternateFileName="")) returned 0x2e8458 [0161.019] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x99b70480, ftCreationTime.dwHighDateTime=0x1d4cb1f, ftLastAccessTime.dwLowDateTime=0x32060ec0, ftLastAccessTime.dwHighDateTime=0x1d4cf53, ftLastWriteTime.dwLowDateTime=0x32060ec0, ftLastWriteTime.dwHighDateTime=0x1d4cf53, nFileSizeHigh=0x0, nFileSizeLow=0x11e24, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="TGYL3r.gif", cAlternateFileName="")) returned 0 [0161.019] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0161.019] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TGYL3r.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tgyl3r.gif")) returned 1 [0161.021] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TGYL3r.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tgyl3r.gif")) returned 0xffffffff [0161.021] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7ce0b50, ftCreationTime.dwHighDateTime=0x1d4d2e3, ftLastAccessTime.dwLowDateTime=0x259f21a0, ftLastAccessTime.dwHighDateTime=0x1d4ce48, ftLastWriteTime.dwLowDateTime=0x259f21a0, ftLastWriteTime.dwHighDateTime=0x1d4ce48, nFileSizeHigh=0x0, nFileSizeLow=0x12d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="THy50k29Pvlxp9eR7sa.mp3", cAlternateFileName="THY50K~1.MP3")) returned 1 [0161.021] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\THy50k29Pvlxp9eR7sa.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\thy50k29pvlxp9er7sa.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0161.021] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\THy50k29Pvlxp9eR7sa.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\thy50k29pvlxp9er7sa.mp3.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0161.021] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12d9 [0161.022] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0161.022] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0161.107] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x12d9, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x12d9, lpOverlapped=0x0) returned 1 [0161.108] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x12e0, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x12e0, lpOverlapped=0x0) returned 1 [0161.109] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0161.129] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.138] CloseHandle (hObject=0xf4) returned 1 [0161.138] CloseHandle (hObject=0xec) returned 1 [0161.138] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\THy50k29Pvlxp9eR7sa.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\thy50k29pvlxp9er7sa.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\THy50k29Pvlxp9eR7sa.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\thy50k29pvlxp9er7sa.mp3.dvodltmf")) returned 0 [0161.139] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\THy50k29Pvlxp9eR7sa.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\thy50k29pvlxp9er7sa.mp3.dvodltmf")) returned 0x2020 [0161.139] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\THy50k29Pvlxp9eR7sa.mp3", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7ce0b50, ftCreationTime.dwHighDateTime=0x1d4d2e3, ftLastAccessTime.dwLowDateTime=0x259f21a0, ftLastAccessTime.dwHighDateTime=0x1d4ce48, ftLastWriteTime.dwLowDateTime=0x259f21a0, ftLastWriteTime.dwHighDateTime=0x1d4ce48, nFileSizeHigh=0x0, nFileSizeLow=0x12d9, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="THy50k29Pvlxp9eR7sa.mp3", cAlternateFileName="THY50K~1.MP3")) returned 0x2e8458 [0161.139] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7ce0b50, ftCreationTime.dwHighDateTime=0x1d4d2e3, ftLastAccessTime.dwLowDateTime=0x259f21a0, ftLastAccessTime.dwHighDateTime=0x1d4ce48, ftLastWriteTime.dwLowDateTime=0x259f21a0, ftLastWriteTime.dwHighDateTime=0x1d4ce48, nFileSizeHigh=0x0, nFileSizeLow=0x12d9, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="THy50k29Pvlxp9eR7sa.mp3", cAlternateFileName="THY50K~1.MP3")) returned 0 [0161.139] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0161.139] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\THy50k29Pvlxp9eR7sa.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\thy50k29pvlxp9er7sa.mp3")) returned 1 [0161.140] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\THy50k29Pvlxp9eR7sa.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\thy50k29pvlxp9er7sa.mp3")) returned 0xffffffff [0161.140] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2719f240, ftCreationTime.dwHighDateTime=0x1d4d360, ftLastAccessTime.dwLowDateTime=0x7f4fd840, ftLastAccessTime.dwHighDateTime=0x1d4c72a, ftLastWriteTime.dwLowDateTime=0x7f4fd840, ftLastWriteTime.dwHighDateTime=0x1d4c72a, nFileSizeHigh=0x0, nFileSizeLow=0xd824, dwReserved0=0x0, dwReserved1=0x0, cFileName="toKw7P1l_ DJ.png", cAlternateFileName="TOKW7P~1.PNG")) returned 1 [0161.140] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\toKw7P1l_ DJ.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tokw7p1l_ dj.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0161.140] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\toKw7P1l_ DJ.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tokw7p1l_ dj.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0161.141] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd824 [0161.141] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0161.141] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0161.226] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd824, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0xd824, lpOverlapped=0x0) returned 1 [0161.227] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd830, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0xd830, lpOverlapped=0x0) returned 1 [0161.229] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0161.248] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.258] CloseHandle (hObject=0xec) returned 1 [0161.258] CloseHandle (hObject=0xf4) returned 1 [0161.258] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\toKw7P1l_ DJ.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tokw7p1l_ dj.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\toKw7P1l_ DJ.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tokw7p1l_ dj.png.dvodltmf")) returned 0 [0161.259] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\toKw7P1l_ DJ.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tokw7p1l_ dj.png.dvodltmf")) returned 0x2020 [0161.259] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\toKw7P1l_ DJ.png", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2719f240, ftCreationTime.dwHighDateTime=0x1d4d360, ftLastAccessTime.dwLowDateTime=0x7f4fd840, ftLastAccessTime.dwHighDateTime=0x1d4c72a, ftLastWriteTime.dwLowDateTime=0x7f4fd840, ftLastWriteTime.dwHighDateTime=0x1d4c72a, nFileSizeHigh=0x0, nFileSizeLow=0xd824, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="toKw7P1l_ DJ.png", cAlternateFileName="TOKW7P~1.PNG")) returned 0x2e8458 [0161.259] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2719f240, ftCreationTime.dwHighDateTime=0x1d4d360, ftLastAccessTime.dwLowDateTime=0x7f4fd840, ftLastAccessTime.dwHighDateTime=0x1d4c72a, ftLastWriteTime.dwLowDateTime=0x7f4fd840, ftLastWriteTime.dwHighDateTime=0x1d4c72a, nFileSizeHigh=0x0, nFileSizeLow=0xd824, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="toKw7P1l_ DJ.png", cAlternateFileName="TOKW7P~1.PNG")) returned 0 [0161.259] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0161.259] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\toKw7P1l_ DJ.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tokw7p1l_ dj.png")) returned 1 [0161.260] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\toKw7P1l_ DJ.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tokw7p1l_ dj.png")) returned 0xffffffff [0161.261] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x374d4f50, ftCreationTime.dwHighDateTime=0x1d4ca68, ftLastAccessTime.dwLowDateTime=0x2160a200, ftLastAccessTime.dwHighDateTime=0x1d4cf63, ftLastWriteTime.dwLowDateTime=0x2160a200, ftLastWriteTime.dwHighDateTime=0x1d4cf63, nFileSizeHigh=0x0, nFileSizeLow=0x126b2, dwReserved0=0x2dfd10, dwReserved1=0x18f054, cFileName="U4ZTRkK.m4a", cAlternateFileName="")) returned 1 [0161.261] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\U4ZTRkK.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\u4ztrkk.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0161.261] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\U4ZTRkK.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\u4ztrkk.m4a.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0161.261] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x126b2 [0161.261] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0161.262] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0161.346] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x126b2, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x126b2, lpOverlapped=0x0) returned 1 [0161.348] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x126c0, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x126c0, lpOverlapped=0x0) returned 1 [0161.350] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0161.465] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.475] CloseHandle (hObject=0xf4) returned 1 [0161.475] CloseHandle (hObject=0xec) returned 1 [0161.475] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\U4ZTRkK.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\u4ztrkk.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\U4ZTRkK.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\u4ztrkk.m4a.dvodltmf")) returned 0 [0161.476] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\U4ZTRkK.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\u4ztrkk.m4a.dvodltmf")) returned 0x2020 [0161.476] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\U4ZTRkK.m4a", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x374d4f50, ftCreationTime.dwHighDateTime=0x1d4ca68, ftLastAccessTime.dwLowDateTime=0x2160a200, ftLastAccessTime.dwHighDateTime=0x1d4cf63, ftLastWriteTime.dwLowDateTime=0x2160a200, ftLastWriteTime.dwHighDateTime=0x1d4cf63, nFileSizeHigh=0x0, nFileSizeLow=0x126b2, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="U4ZTRkK.m4a", cAlternateFileName="")) returned 0x2e8458 [0161.477] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x374d4f50, ftCreationTime.dwHighDateTime=0x1d4ca68, ftLastAccessTime.dwLowDateTime=0x2160a200, ftLastAccessTime.dwHighDateTime=0x1d4cf63, ftLastWriteTime.dwLowDateTime=0x2160a200, ftLastWriteTime.dwHighDateTime=0x1d4cf63, nFileSizeHigh=0x0, nFileSizeLow=0x126b2, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="U4ZTRkK.m4a", cAlternateFileName="")) returned 0 [0161.477] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0161.477] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\U4ZTRkK.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\u4ztrkk.m4a")) returned 1 [0161.478] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\U4ZTRkK.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\u4ztrkk.m4a")) returned 0xffffffff [0161.478] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7008ca00, ftCreationTime.dwHighDateTime=0x1d4ce40, ftLastAccessTime.dwLowDateTime=0x62232380, ftLastAccessTime.dwHighDateTime=0x1d4cb71, ftLastWriteTime.dwLowDateTime=0x62232380, ftLastWriteTime.dwHighDateTime=0x1d4cb71, nFileSizeHigh=0x0, nFileSizeLow=0x15ea0, dwReserved0=0x2dfd10, dwReserved1=0x18f054, cFileName="vaO_Fdz8deFnciKeJR.flv", cAlternateFileName="VAO_FD~1.FLV")) returned 1 [0161.478] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vaO_Fdz8deFnciKeJR.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\vao_fdz8defncikejr.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0161.478] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vaO_Fdz8deFnciKeJR.flv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\vao_fdz8defncikejr.flv.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0161.479] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15ea0 [0161.479] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0161.479] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0161.623] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x15ea0, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x15ea0, lpOverlapped=0x0) returned 1 [0161.634] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x15eb0, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x15eb0, lpOverlapped=0x0) returned 1 [0161.638] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0161.661] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.670] CloseHandle (hObject=0xec) returned 1 [0161.671] CloseHandle (hObject=0xf4) returned 1 [0161.671] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vaO_Fdz8deFnciKeJR.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\vao_fdz8defncikejr.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vaO_Fdz8deFnciKeJR.flv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\vao_fdz8defncikejr.flv.dvodltmf")) returned 0 [0161.672] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vaO_Fdz8deFnciKeJR.flv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\vao_fdz8defncikejr.flv.dvodltmf")) returned 0x2020 [0161.674] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vaO_Fdz8deFnciKeJR.flv", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7008ca00, ftCreationTime.dwHighDateTime=0x1d4ce40, ftLastAccessTime.dwLowDateTime=0x62232380, ftLastAccessTime.dwHighDateTime=0x1d4cb71, ftLastWriteTime.dwLowDateTime=0x62232380, ftLastWriteTime.dwHighDateTime=0x1d4cb71, nFileSizeHigh=0x0, nFileSizeLow=0x15ea0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="vaO_Fdz8deFnciKeJR.flv", cAlternateFileName="VAO_FD~1.FLV")) returned 0x2e8458 [0161.675] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7008ca00, ftCreationTime.dwHighDateTime=0x1d4ce40, ftLastAccessTime.dwLowDateTime=0x62232380, ftLastAccessTime.dwHighDateTime=0x1d4cb71, ftLastWriteTime.dwLowDateTime=0x62232380, ftLastWriteTime.dwHighDateTime=0x1d4cb71, nFileSizeHigh=0x0, nFileSizeLow=0x15ea0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="vaO_Fdz8deFnciKeJR.flv", cAlternateFileName="VAO_FD~1.FLV")) returned 0 [0161.675] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0161.675] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vaO_Fdz8deFnciKeJR.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\vao_fdz8defncikejr.flv")) returned 1 [0161.677] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vaO_Fdz8deFnciKeJR.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\vao_fdz8defncikejr.flv")) returned 0xffffffff [0161.677] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874c95a0, ftCreationTime.dwHighDateTime=0x1d4d5ae, ftLastAccessTime.dwLowDateTime=0x874c95a0, ftLastAccessTime.dwHighDateTime=0x1d4d5ae, ftLastWriteTime.dwLowDateTime=0x874c95a0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPDNSE", cAlternateFileName="")) returned 1 [0161.677] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874c95a0, ftCreationTime.dwHighDateTime=0x1d4d5ae, ftLastAccessTime.dwLowDateTime=0x874c95a0, ftLastAccessTime.dwHighDateTime=0x1d4d5ae, ftLastWriteTime.dwLowDateTime=0x874c95a0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0161.678] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874c95a0, ftCreationTime.dwHighDateTime=0x1d4d5ae, ftLastAccessTime.dwLowDateTime=0x874c95a0, ftLastAccessTime.dwHighDateTime=0x1d4d5ae, ftLastWriteTime.dwLowDateTime=0x874c95a0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0161.678] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874c95a0, ftCreationTime.dwHighDateTime=0x1d4d5ae, ftLastAccessTime.dwLowDateTime=0x874c95a0, ftLastAccessTime.dwHighDateTime=0x1d4d5ae, ftLastWriteTime.dwLowDateTime=0x874c95a0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0161.678] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0161.678] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x155fa6c0, ftCreationTime.dwHighDateTime=0x1d4ca33, ftLastAccessTime.dwLowDateTime=0x454f7a90, ftLastAccessTime.dwHighDateTime=0x1d4d181, ftLastWriteTime.dwLowDateTime=0x454f7a90, ftLastWriteTime.dwHighDateTime=0x1d4d181, nFileSizeHigh=0x0, nFileSizeLow=0x4b09, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xz2NR6p.png", cAlternateFileName="")) returned 1 [0161.678] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Xz2NR6p.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\xz2nr6p.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0161.678] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Xz2NR6p.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\xz2nr6p.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0161.679] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4b09 [0161.679] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0161.679] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0161.788] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4b09, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x4b09, lpOverlapped=0x0) returned 1 [0161.789] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4b10, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x4b10, lpOverlapped=0x0) returned 1 [0161.791] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0161.810] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.820] CloseHandle (hObject=0xf4) returned 1 [0161.820] CloseHandle (hObject=0xec) returned 1 [0161.820] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Xz2NR6p.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\xz2nr6p.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Xz2NR6p.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\xz2nr6p.png.dvodltmf")) returned 0 [0161.821] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Xz2NR6p.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\xz2nr6p.png.dvodltmf")) returned 0x2020 [0161.821] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Xz2NR6p.png", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x155fa6c0, ftCreationTime.dwHighDateTime=0x1d4ca33, ftLastAccessTime.dwLowDateTime=0x454f7a90, ftLastAccessTime.dwHighDateTime=0x1d4d181, ftLastWriteTime.dwLowDateTime=0x454f7a90, ftLastWriteTime.dwHighDateTime=0x1d4d181, nFileSizeHigh=0x0, nFileSizeLow=0x4b09, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Xz2NR6p.png", cAlternateFileName="")) returned 0x2e8458 [0161.821] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x155fa6c0, ftCreationTime.dwHighDateTime=0x1d4ca33, ftLastAccessTime.dwLowDateTime=0x454f7a90, ftLastAccessTime.dwHighDateTime=0x1d4d181, ftLastWriteTime.dwLowDateTime=0x454f7a90, ftLastWriteTime.dwHighDateTime=0x1d4d181, nFileSizeHigh=0x0, nFileSizeLow=0x4b09, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Xz2NR6p.png", cAlternateFileName="")) returned 0 [0161.821] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0161.822] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Xz2NR6p.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\xz2nr6p.png")) returned 1 [0161.822] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Xz2NR6p.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\xz2nr6p.png")) returned 0xffffffff [0161.822] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x92d96a70, ftCreationTime.dwHighDateTime=0x1d4c991, ftLastAccessTime.dwLowDateTime=0x8444cb20, ftLastAccessTime.dwHighDateTime=0x1d4cca8, ftLastWriteTime.dwLowDateTime=0x8444cb20, ftLastWriteTime.dwHighDateTime=0x1d4cca8, nFileSizeHigh=0x0, nFileSizeLow=0xfb10, dwReserved0=0x2dfd10, dwReserved1=0x18f054, cFileName="YfEX5COXdfx.gif", cAlternateFileName="YFEX5C~1.GIF")) returned 1 [0161.823] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\YfEX5COXdfx.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\yfex5coxdfx.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0161.823] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\YfEX5COXdfx.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\yfex5coxdfx.gif.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0161.823] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfb10 [0161.823] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0161.824] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0161.909] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xfb10, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0xfb10, lpOverlapped=0x0) returned 1 [0161.911] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xfb20, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0xfb20, lpOverlapped=0x0) returned 1 [0161.912] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0161.932] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.942] CloseHandle (hObject=0xec) returned 1 [0161.942] CloseHandle (hObject=0xf4) returned 1 [0161.942] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\YfEX5COXdfx.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\yfex5coxdfx.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\YfEX5COXdfx.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\yfex5coxdfx.gif.dvodltmf")) returned 0 [0161.943] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\YfEX5COXdfx.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\yfex5coxdfx.gif.dvodltmf")) returned 0x2020 [0161.943] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\YfEX5COXdfx.gif", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x92d96a70, ftCreationTime.dwHighDateTime=0x1d4c991, ftLastAccessTime.dwLowDateTime=0x8444cb20, ftLastAccessTime.dwHighDateTime=0x1d4cca8, ftLastWriteTime.dwLowDateTime=0x8444cb20, ftLastWriteTime.dwHighDateTime=0x1d4cca8, nFileSizeHigh=0x0, nFileSizeLow=0xfb10, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="YfEX5COXdfx.gif", cAlternateFileName="YFEX5C~1.GIF")) returned 0x2e8458 [0161.943] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x92d96a70, ftCreationTime.dwHighDateTime=0x1d4c991, ftLastAccessTime.dwLowDateTime=0x8444cb20, ftLastAccessTime.dwHighDateTime=0x1d4cca8, ftLastWriteTime.dwLowDateTime=0x8444cb20, ftLastWriteTime.dwHighDateTime=0x1d4cca8, nFileSizeHigh=0x0, nFileSizeLow=0xfb10, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="YfEX5COXdfx.gif", cAlternateFileName="YFEX5C~1.GIF")) returned 0 [0161.944] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0161.944] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\YfEX5COXdfx.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\yfex5coxdfx.gif")) returned 1 [0161.945] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\YfEX5COXdfx.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\yfex5coxdfx.gif")) returned 0xffffffff [0161.945] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe2586270, ftCreationTime.dwHighDateTime=0x1d4d019, ftLastAccessTime.dwLowDateTime=0xe8e1ac00, ftLastAccessTime.dwHighDateTime=0x1d4d028, ftLastWriteTime.dwLowDateTime=0xe8e1ac00, ftLastWriteTime.dwHighDateTime=0x1d4d028, nFileSizeHigh=0x0, nFileSizeLow=0x24e1, dwReserved0=0x2dfd10, dwReserved1=0x18f054, cFileName="yisLnw2nhwVoji.mp3", cAlternateFileName="YISLNW~1.MP3")) returned 1 [0161.945] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yisLnw2nhwVoji.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\yislnw2nhwvoji.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0161.945] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yisLnw2nhwVoji.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\yislnw2nhwvoji.mp3.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0161.946] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x24e1 [0161.946] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0161.946] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0162.030] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x24e1, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x24e1, lpOverlapped=0x0) returned 1 [0162.031] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x24f0, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x24f0, lpOverlapped=0x0) returned 1 [0162.032] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0162.052] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.062] CloseHandle (hObject=0xf4) returned 1 [0162.062] CloseHandle (hObject=0xec) returned 1 [0162.062] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yisLnw2nhwVoji.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\yislnw2nhwvoji.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yisLnw2nhwVoji.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\yislnw2nhwvoji.mp3.dvodltmf")) returned 0 [0162.063] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yisLnw2nhwVoji.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\yislnw2nhwvoji.mp3.dvodltmf")) returned 0x2020 [0162.063] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yisLnw2nhwVoji.mp3", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe2586270, ftCreationTime.dwHighDateTime=0x1d4d019, ftLastAccessTime.dwLowDateTime=0xe8e1ac00, ftLastAccessTime.dwHighDateTime=0x1d4d028, ftLastWriteTime.dwLowDateTime=0xe8e1ac00, ftLastWriteTime.dwHighDateTime=0x1d4d028, nFileSizeHigh=0x0, nFileSizeLow=0x24e1, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="yisLnw2nhwVoji.mp3", cAlternateFileName="YISLNW~1.MP3")) returned 0x2e8458 [0162.063] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe2586270, ftCreationTime.dwHighDateTime=0x1d4d019, ftLastAccessTime.dwLowDateTime=0xe8e1ac00, ftLastAccessTime.dwHighDateTime=0x1d4d028, ftLastWriteTime.dwLowDateTime=0xe8e1ac00, ftLastWriteTime.dwHighDateTime=0x1d4d028, nFileSizeHigh=0x0, nFileSizeLow=0x24e1, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="yisLnw2nhwVoji.mp3", cAlternateFileName="YISLNW~1.MP3")) returned 0 [0162.063] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0162.063] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yisLnw2nhwVoji.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\yislnw2nhwvoji.mp3")) returned 1 [0162.064] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yisLnw2nhwVoji.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\yislnw2nhwvoji.mp3")) returned 0xffffffff [0162.064] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbeadfc30, ftCreationTime.dwHighDateTime=0x1d4c935, ftLastAccessTime.dwLowDateTime=0xc2688080, ftLastAccessTime.dwHighDateTime=0x1d4cff6, ftLastWriteTime.dwLowDateTime=0xc2688080, ftLastWriteTime.dwHighDateTime=0x1d4cff6, nFileSizeHigh=0x0, nFileSizeLow=0xaae1, dwReserved0=0x2dfd10, dwReserved1=0x18f054, cFileName="z4fQhi.flv", cAlternateFileName="")) returned 1 [0162.064] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\z4fQhi.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\z4fqhi.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0162.064] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\z4fQhi.flv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\z4fqhi.flv.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0162.065] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaae1 [0162.065] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0162.065] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0162.151] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xaae1, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0xaae1, lpOverlapped=0x0) returned 1 [0162.152] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xaaf0, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0xaaf0, lpOverlapped=0x0) returned 1 [0162.153] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0162.173] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.182] CloseHandle (hObject=0xec) returned 1 [0162.182] CloseHandle (hObject=0xf4) returned 1 [0162.183] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\z4fQhi.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\z4fqhi.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\z4fQhi.flv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\z4fqhi.flv.dvodltmf")) returned 0 [0162.183] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\z4fQhi.flv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\z4fqhi.flv.dvodltmf")) returned 0x2020 [0162.183] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\z4fQhi.flv", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbeadfc30, ftCreationTime.dwHighDateTime=0x1d4c935, ftLastAccessTime.dwLowDateTime=0xc2688080, ftLastAccessTime.dwHighDateTime=0x1d4cff6, ftLastWriteTime.dwLowDateTime=0xc2688080, ftLastWriteTime.dwHighDateTime=0x1d4cff6, nFileSizeHigh=0x0, nFileSizeLow=0xaae1, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="z4fQhi.flv", cAlternateFileName="")) returned 0x2e8458 [0162.184] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbeadfc30, ftCreationTime.dwHighDateTime=0x1d4c935, ftLastAccessTime.dwLowDateTime=0xc2688080, ftLastAccessTime.dwHighDateTime=0x1d4cff6, ftLastWriteTime.dwLowDateTime=0xc2688080, ftLastWriteTime.dwHighDateTime=0x1d4cff6, nFileSizeHigh=0x0, nFileSizeLow=0xaae1, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="z4fQhi.flv", cAlternateFileName="")) returned 0 [0162.184] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0162.184] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\z4fQhi.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\z4fqhi.flv")) returned 1 [0162.185] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\z4fQhi.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\z4fqhi.flv")) returned 0xffffffff [0162.185] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc94d5450, ftCreationTime.dwHighDateTime=0x1d4d336, ftLastAccessTime.dwLowDateTime=0x8e865f70, ftLastAccessTime.dwHighDateTime=0x1d4d583, ftLastWriteTime.dwLowDateTime=0x8e865f70, ftLastWriteTime.dwHighDateTime=0x1d4d583, nFileSizeHigh=0x0, nFileSizeLow=0x1834a, dwReserved0=0x0, dwReserved1=0x0, cFileName="_RGjB2jUhCJm91tcnD.pptx", cAlternateFileName="_RGJB2~1.PPT")) returned 1 [0162.185] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_RGjB2jUhCJm91tcnD.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\_rgjb2juhcjm91tcnd.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0162.185] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_RGjB2jUhCJm91tcnD.pptx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\_rgjb2juhcjm91tcnd.pptx.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0162.186] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1834a [0162.186] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0162.186] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0162.283] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1834a, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x1834a, lpOverlapped=0x0) returned 1 [0162.285] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x18350, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x18350, lpOverlapped=0x0) returned 1 [0162.287] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0162.307] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.316] CloseHandle (hObject=0xf4) returned 1 [0162.316] CloseHandle (hObject=0xec) returned 1 [0162.317] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_RGjB2jUhCJm91tcnD.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\_rgjb2juhcjm91tcnd.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_RGjB2jUhCJm91tcnD.pptx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\_rgjb2juhcjm91tcnd.pptx.dvodltmf")) returned 0 [0162.317] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_RGjB2jUhCJm91tcnD.pptx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\_rgjb2juhcjm91tcnd.pptx.dvodltmf")) returned 0x2020 [0162.318] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_RGjB2jUhCJm91tcnD.pptx", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc94d5450, ftCreationTime.dwHighDateTime=0x1d4d336, ftLastAccessTime.dwLowDateTime=0x8e865f70, ftLastAccessTime.dwHighDateTime=0x1d4d583, ftLastWriteTime.dwLowDateTime=0x8e865f70, ftLastWriteTime.dwHighDateTime=0x1d4d583, nFileSizeHigh=0x0, nFileSizeLow=0x1834a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="_RGjB2jUhCJm91tcnD.pptx", cAlternateFileName="_RGJB2~1.PPT")) returned 0x2e8458 [0162.318] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc94d5450, ftCreationTime.dwHighDateTime=0x1d4d336, ftLastAccessTime.dwLowDateTime=0x8e865f70, ftLastAccessTime.dwHighDateTime=0x1d4d583, ftLastWriteTime.dwLowDateTime=0x8e865f70, ftLastWriteTime.dwHighDateTime=0x1d4d583, nFileSizeHigh=0x0, nFileSizeLow=0x1834a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="_RGjB2jUhCJm91tcnD.pptx", cAlternateFileName="_RGJB2~1.PPT")) returned 0 [0162.318] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0162.318] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_RGjB2jUhCJm91tcnD.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\_rgjb2juhcjm91tcnd.pptx")) returned 1 [0162.319] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_RGjB2jUhCJm91tcnD.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\_rgjb2juhcjm91tcnd.pptx")) returned 0xffffffff [0162.319] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc94d5450, ftCreationTime.dwHighDateTime=0x1d4d336, ftLastAccessTime.dwLowDateTime=0x8e865f70, ftLastAccessTime.dwHighDateTime=0x1d4d583, ftLastWriteTime.dwLowDateTime=0x8e865f70, ftLastWriteTime.dwHighDateTime=0x1d4d583, nFileSizeHigh=0x0, nFileSizeLow=0x1834a, dwReserved0=0x0, dwReserved1=0x0, cFileName="_RGjB2jUhCJm91tcnD.pptx", cAlternateFileName="_RGJB2~1.PPT")) returned 0 [0162.319] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0162.319] FindNextFileA (in: hFindFile=0x2dcc48, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e446e63, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0162.320] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc94d5450, ftCreationTime.dwHighDateTime=0x1d4d336, ftLastAccessTime.dwLowDateTime=0x8e865f70, ftLastAccessTime.dwHighDateTime=0x1d4d583, ftLastWriteTime.dwLowDateTime=0x8e865f70, ftLastWriteTime.dwHighDateTime=0x1d4d583, nFileSizeHigh=0x0, nFileSizeLow=0x1834a, dwReserved0=0x0, dwReserved1=0x0, cFileName="_RGjB2jUhCJm91tcnD.pptx", cAlternateFileName="HÌ-")) returned 0xffffffff [0162.320] FindNextFileA (in: hFindFile=0x2dcc48, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e446e63, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 1 [0162.320] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0162.320] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.320] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0162.320] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0162.321] FindNextFileA (in: hFindFile=0x2dcc48, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e446e63, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 0 [0162.321] FindClose (in: hFindFile=0x2dcc48 | out: hFindFile=0x2dcc48) returned 1 [0162.321] FindNextFileA (in: hFindFile=0x2dab40, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72657465, dwReserved1=0x2074656e, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0162.321] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e446e63, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0162.321] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e446e63, cFileName="..", cAlternateFileName="")) returned 1 [0162.321] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e446e63, cFileName="Adobe", cAlternateFileName="")) returned 1 [0162.321] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0162.322] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.322] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0162.322] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0162.322] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.322] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0162.322] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0162.324] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.324] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd9b6a040, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9b6a040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xde963ca0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0xa5ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="rdrmessage.zip", cAlternateFileName="RDRMES~1.ZIP")) returned 1 [0162.324] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.325] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0162.326] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa5ff [0162.326] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0162.326] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0162.420] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa5ff, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xa5ff, lpOverlapped=0x0) returned 1 [0162.423] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa600, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xa600, lpOverlapped=0x0) returned 1 [0162.424] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0162.444] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.453] CloseHandle (hObject=0xdc) returned 1 [0162.453] CloseHandle (hObject=0xf0) returned 1 [0162.454] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip.dvodltmf")) returned 0 [0162.454] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip.dvodltmf")) returned 0x2020 [0162.455] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd9b6a040, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9b6a040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xde963ca0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0xa5ff, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="rdrmessage.zip", cAlternateFileName="RDRMES~1.ZIP")) returned 0x2e8518 [0162.455] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd9b6a040, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9b6a040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xde963ca0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0xa5ff, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="rdrmessage.zip", cAlternateFileName="RDRMES~1.ZIP")) returned 0 [0162.455] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0162.455] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip")) returned 1 [0162.456] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip")) returned 0xffffffff [0162.456] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce824760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce824760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe5ab8070, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="ReaderMessages", cAlternateFileName="READER~1")) returned 1 [0162.456] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Search", cAlternateFileName="")) returned 1 [0162.456] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0162.457] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.457] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0162.457] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0162.457] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Search", cAlternateFileName="")) returned 0 [0162.457] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0162.457] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0 [0162.457] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0162.457] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0162.457] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736567, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0162.457] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736567, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.457] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736567, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 1 [0162.457] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0162.458] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="..", cAlternateFileName="")) returned 1 [0162.459] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Adobe Custom Dictionary", cAlternateFileName="ADOBEC~1")) returned 1 [0162.459] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0162.460] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.460] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="all", cAlternateFileName="")) returned 1 [0162.460] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0162.460] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.460] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0162.460] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0162.460] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="brt", cAlternateFileName="")) returned 1 [0162.460] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0162.461] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.461] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0162.461] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0162.461] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="brz", cAlternateFileName="")) returned 1 [0162.461] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0162.462] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.462] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0162.462] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0162.462] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dan", cAlternateFileName="")) returned 1 [0162.462] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0162.462] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.462] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0162.463] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0162.463] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dut", cAlternateFileName="")) returned 1 [0162.463] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0162.463] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.463] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0162.463] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0162.463] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eng", cAlternateFileName="")) returned 1 [0162.463] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0162.463] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.463] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0162.463] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0162.463] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="frn", cAlternateFileName="")) returned 1 [0162.463] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0162.463] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.463] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0162.464] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0162.464] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="grm", cAlternateFileName="")) returned 1 [0162.464] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0162.464] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.464] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0162.464] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0162.464] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="itl", cAlternateFileName="")) returned 1 [0162.464] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0162.464] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.464] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0162.464] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0162.464] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nrw", cAlternateFileName="")) returned 1 [0162.464] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0162.465] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.465] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0162.465] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0162.465] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="prt", cAlternateFileName="")) returned 1 [0162.465] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0162.465] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.465] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0162.465] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0162.465] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="spn", cAlternateFileName="")) returned 1 [0162.465] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0162.465] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.465] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0162.465] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0162.465] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="swd", cAlternateFileName="")) returned 1 [0162.465] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0162.466] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.466] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0162.466] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0162.466] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="swd", cAlternateFileName="")) returned 0 [0162.466] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0162.466] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Adobe Custom Dictionary", cAlternateFileName="ADOBEC~1")) returned 0 [0162.466] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0162.466] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736567, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 0 [0162.466] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0162.467] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 0 [0162.467] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0162.467] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e446e63, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0162.467] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0162.468] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.468] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73, dwReserved1=0x0, cFileName="CryptnetUrlCache", cAlternateFileName="CRYPTN~1")) returned 1 [0162.468] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6944206d, dwReserved1=0x6f697463, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0162.468] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6944206d, dwReserved1=0x6f697463, cFileName="..", cAlternateFileName="")) returned 1 [0162.468] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6944206d, dwReserved1=0x6f697463, cFileName="Content", cAlternateFileName="")) returned 1 [0162.468] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0162.468] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.468] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf9eaad0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf9eaad0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf9eaad0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", cAlternateFileName="024823~1")) returned 1 [0162.468] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bd8410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bd8410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe98d390, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x561, dwReserved0=0x0, dwReserved1=0x0, cFileName="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", cAlternateFileName="0F1583~1")) returned 1 [0162.469] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf952550, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf952550, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf952550, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", cAlternateFileName="1BB09B~1")) returned 1 [0162.469] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x4c00edb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4c00edb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4c00edb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xf1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="1DAF2884EC4DFA96BA4A58D4DBC9C406", cAlternateFileName="1DAF28~1")) returned 1 [0162.469] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x580eb5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x580eb5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaedd4300, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x145, dwReserved0=0x0, dwReserved1=0x0, cFileName="23B523C9E7746F715D33C6527C18EB9D", cAlternateFileName="23B523~1")) returned 1 [0162.469] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc3791460, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc3791460, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc3791460, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x209, dwReserved0=0x0, dwReserved1=0x0, cFileName="3130B1871A126520A8C47861EFE3ED4D", cAlternateFileName="3130B1~1")) returned 1 [0162.469] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53fdc930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53fdc930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf16fc70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x58b, dwReserved0=0x0, dwReserved1=0x0, cFileName="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", cAlternateFileName="3388EC~1")) returned 1 [0162.469] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53b19d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b19d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54583d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", cAlternateFileName="40E450~1")) returned 1 [0162.469] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54537ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54537ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae76e7e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", cAlternateFileName="4C8F84~1")) returned 1 [0162.469] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x7295ee20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7295ee20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xadfb2060, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x680, dwReserved0=0x0, dwReserved1=0x0, cFileName="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", cAlternateFileName="4DD397~1")) returned 1 [0162.469] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf8b9fd0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf8b9fd0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf8b9fd0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", cAlternateFileName="5080DC~2")) returned 1 [0162.469] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf86dd10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf86dd10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf86dd10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", cAlternateFileName="5080DC~1")) returned 1 [0162.469] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7af630, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", cAlternateFileName="5457A8~1")) returned 1 [0162.469] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xed9b0820, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xed9b0820, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xed9b0820, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x0, dwReserved1=0x0, cFileName="696F3DE637E6DE85B458996D49D759AD", cAlternateFileName="696F3D~1")) returned 1 [0162.469] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf763370, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", cAlternateFileName="705A76~1")) returned 1 [0162.469] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedb2d5e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedb2d5e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedb2d5e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x0, cFileName="7396C420A8E1BC1DA97F1AF0D10BAD21", cAlternateFileName="7396C4~1")) returned 1 [0162.469] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x312640, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", cAlternateFileName="7423F8~1")) returned 1 [0162.469] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd0e4c510, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 1 [0162.469] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b2324c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b2324c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b2324c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x67c, dwReserved0=0x0, dwReserved1=0x0, cFileName="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", cAlternateFileName="7B8944~1")) returned 1 [0162.469] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b199f40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b199f40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b199f40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", cAlternateFileName="7D266D~2")) returned 1 [0162.469] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefaf7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefaf7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaec313e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", cAlternateFileName="7D266D~1")) returned 1 [0162.469] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6056b480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6056b480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1ef687a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", cAlternateFileName="8059E9~3")) returned 1 [0162.469] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61210960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61210960, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaecc9960, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", cAlternateFileName="80273C~1")) returned 1 [0162.469] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58e24200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58e24200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9f5f40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", cAlternateFileName="8059E9~2")) returned 1 [0162.469] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61236ac0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61236ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3b0b01a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", cAlternateFileName="809279~1")) returned 1 [0162.469] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58394060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58394060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f739c0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", cAlternateFileName="8059E9~1")) returned 1 [0162.469] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x62378a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62378a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9a9c80, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", cAlternateFileName="80E4BE~1")) returned 1 [0162.469] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x613675c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x613675c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69bba4a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", cAlternateFileName="803B9E~1")) returned 1 [0162.469] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x63c50fe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63c50fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb100bf40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", cAlternateFileName="803D37~1")) returned 1 [0162.470] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61021780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61021780, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1058200, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", cAlternateFileName="8059E9~4")) returned 1 [0162.470] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x636a9ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x636a9ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb139e040, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", cAlternateFileName="800D31~1")) returned 1 [0162.470] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x581f7ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x581f7ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f4d860, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0x0, dwReserved1=0x0, cFileName="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", cAlternateFileName="828298~1")) returned 1 [0162.470] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xec3c5340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec3c5340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xb16257a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", cAlternateFileName="8828F3~1")) returned 1 [0162.470] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x8064ac00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8064ac00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80670d60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", cAlternateFileName="8828F3~2")) returned 1 [0162.470] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6aa2c0a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6aa2c0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xadf19ae0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", cAlternateFileName="8E4E51~1")) returned 1 [0162.470] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbddd270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xd2da, dwReserved0=0x0, dwReserved1=0x0, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 1 [0162.470] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6a83cec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a83cec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaebe5120, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x5e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", cAlternateFileName="955CAB~1")) returned 1 [0162.470] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf3f73d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf3f73d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf3f73d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", cAlternateFileName="9BC2FF~1")) returned 1 [0162.470] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe06277d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe06277d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xb15d94e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x0, dwReserved1=0x0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", cAlternateFileName="9C888B~1")) returned 1 [0162.470] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe07ca6f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe07ca6f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x965accc0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x0, dwReserved1=0x0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", cAlternateFileName="9C888B~2")) returned 1 [0162.470] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54bc3730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54bc3730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb11d4fc0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", cAlternateFileName="A9E4F7~1")) returned 1 [0162.470] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bfe570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bfe570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", cAlternateFileName="ACF244~1")) returned 1 [0162.470] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe04aaa10, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe04aaa10, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xae4e7080, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x0, dwReserved1=0x0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", cAlternateFileName="B3BB9C~2")) returned 1 [0162.470] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefc01b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefc01b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaa4ee1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x0, dwReserved1=0x0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8", cAlternateFileName="B3BB9C~1")) returned 1 [0162.470] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54322770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54322770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", cAlternateFileName="BC570E~2")) returned 1 [0162.470] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", cAlternateFileName="BC570E~1")) returned 1 [0162.470] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x56bb3b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x56bb3b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaeca3800, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", cAlternateFileName="C46E7B~2")) returned 1 [0162.470] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x682fbd00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x682fbd00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae0bca00, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", cAlternateFileName="C46E7B~3")) returned 1 [0162.470] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5461c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5461c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf67eb30, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", cAlternateFileName="C46E7B~1")) returned 1 [0162.470] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x728c68a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x728c68a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xae63dce0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x5ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", cAlternateFileName="D47DBD~2")) returned 1 [0162.470] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x545f6190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x545f6190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69b6e1e0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x5ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", cAlternateFileName="D47DBD~1")) returned 1 [0162.470] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x808d4a70, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x808d4a70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x808d4a70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x663, dwReserved0=0x0, dwReserved1=0x0, cFileName="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", cAlternateFileName="D52C56~1")) returned 1 [0162.470] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x683e0540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x683e0540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f015a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x64b, dwReserved0=0x0, dwReserved1=0x0, cFileName="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", cAlternateFileName="EA6180~1")) returned 1 [0162.470] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf312b90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf312b90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf312b90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0x0, dwReserved1=0x0, cFileName="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1", cAlternateFileName="F293AE~1")) returned 1 [0162.470] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x0, dwReserved1=0x0, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 1 [0162.470] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x0, dwReserved1=0x0, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 0 [0162.470] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0162.470] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="MetaData", cAlternateFileName="")) returned 1 [0162.471] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0162.471] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.471] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf9eaad0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf9eaad0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf9eaad0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x0, dwReserved1=0x0, cFileName="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", cAlternateFileName="024823~1")) returned 1 [0162.471] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bd8410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bd8410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe98d390, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x166, dwReserved0=0x0, dwReserved1=0x0, cFileName="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", cAlternateFileName="0F1583~1")) returned 1 [0162.471] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf952550, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf952550, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf952550, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x0, cFileName="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", cAlternateFileName="1BB09B~1")) returned 1 [0162.471] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x4c00edb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4c00edb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4c00edb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x0, dwReserved1=0x0, cFileName="1DAF2884EC4DFA96BA4A58D4DBC9C406", cAlternateFileName="1DAF28~1")) returned 1 [0162.471] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x580eb5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x580eb5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaedd4300, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0x0, dwReserved1=0x0, cFileName="23B523C9E7746F715D33C6527C18EB9D", cAlternateFileName="23B523~1")) returned 1 [0162.471] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc3791460, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc3791460, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc3791460, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="3130B1871A126520A8C47861EFE3ED4D", cAlternateFileName="3130B1~1")) returned 1 [0162.471] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53fdc930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53fdc930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf16fc70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18a, dwReserved0=0x0, dwReserved1=0x0, cFileName="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", cAlternateFileName="3388EC~1")) returned 1 [0162.471] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53b19d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b19d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54583d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x0, dwReserved1=0x0, cFileName="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", cAlternateFileName="40E450~1")) returned 1 [0162.471] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54537ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54537ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae76e7e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", cAlternateFileName="4C8F84~1")) returned 1 [0162.471] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x7295ee20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7295ee20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xadfb2060, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x0, cFileName="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", cAlternateFileName="4DD397~1")) returned 1 [0162.471] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf8b9fd0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf8b9fd0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf8b9fd0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x0, cFileName="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", cAlternateFileName="5080DC~2")) returned 1 [0162.471] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf86dd10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf86dd10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf86dd10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x0, dwReserved1=0x0, cFileName="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", cAlternateFileName="5080DC~1")) returned 1 [0162.471] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7af630, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x0, dwReserved1=0x0, cFileName="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", cAlternateFileName="5457A8~1")) returned 1 [0162.471] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xed9b0820, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xed9b0820, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xed9b0820, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0xf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="696F3DE637E6DE85B458996D49D759AD", cAlternateFileName="696F3D~1")) returned 1 [0162.471] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf763370, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x0, dwReserved1=0x0, cFileName="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", cAlternateFileName="705A76~1")) returned 1 [0162.471] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedb2d5e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedb2d5e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedb2d5e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x0, cFileName="7396C420A8E1BC1DA97F1AF0D10BAD21", cAlternateFileName="7396C4~1")) returned 1 [0162.471] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x312640, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", cAlternateFileName="7423F8~1")) returned 1 [0162.471] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd48e2bf0, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 1 [0162.471] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b2324c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b2324c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b2324c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x0, cFileName="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", cAlternateFileName="7B8944~1")) returned 1 [0162.471] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b199f40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b199f40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b199f40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", cAlternateFileName="7D266D~2")) returned 1 [0162.472] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefaf7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefaf7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaec313e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", cAlternateFileName="7D266D~1")) returned 1 [0162.472] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6056b480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6056b480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1ef687a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", cAlternateFileName="8059E9~3")) returned 1 [0162.472] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x611ea800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x611ea800, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaecc9960, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", cAlternateFileName="80273C~1")) returned 1 [0162.472] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58e24200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58e24200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9f5f40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", cAlternateFileName="8059E9~2")) returned 1 [0162.472] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61236ac0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61236ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3b0b01a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", cAlternateFileName="809279~1")) returned 1 [0162.472] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5836df00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5836df00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f739c0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", cAlternateFileName="8059E9~1")) returned 1 [0162.472] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x62378a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62378a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9a9c80, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", cAlternateFileName="80E4BE~1")) returned 1 [0162.472] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x613675c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x613675c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69bba4a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", cAlternateFileName="803B9E~1")) returned 1 [0162.472] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x63c50fe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63c50fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb100bf40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", cAlternateFileName="803D37~1")) returned 1 [0162.472] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61021780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61021780, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1058200, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", cAlternateFileName="8059E9~4")) returned 1 [0162.472] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x636a9ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x636a9ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb139e040, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", cAlternateFileName="800D31~1")) returned 1 [0162.472] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x581f7ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x581f7ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f4d860, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", cAlternateFileName="828298~1")) returned 1 [0162.472] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xec3c5340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec3c5340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xb16257a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", cAlternateFileName="8828F3~1")) returned 1 [0162.472] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x8064ac00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8064ac00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80670d60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", cAlternateFileName="8828F3~2")) returned 1 [0162.472] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6aa2c0a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6aa2c0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xadf19ae0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x196, dwReserved0=0x0, dwReserved1=0x0, cFileName="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", cAlternateFileName="8E4E51~1")) returned 1 [0162.472] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbf0dd70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x0, dwReserved1=0x0, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 1 [0162.472] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6a83cec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a83cec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaebe5120, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x0, cFileName="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", cAlternateFileName="955CAB~1")) returned 1 [0162.472] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf3f73d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf3f73d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf3f73d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", cAlternateFileName="9BC2FF~1")) returned 1 [0162.472] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe06277d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe06277d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xb15d94e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", cAlternateFileName="9C888B~1")) returned 1 [0162.472] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe07ca6f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe07ca6f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x965accc0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", cAlternateFileName="9C888B~2")) returned 1 [0162.472] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54bc3730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54bc3730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb11d4fc0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", cAlternateFileName="A9E4F7~1")) returned 1 [0162.472] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bfe570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bfe570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", cAlternateFileName="ACF244~1")) returned 1 [0162.472] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe04aaa10, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe04aaa10, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xae4e7080, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", cAlternateFileName="B3BB9C~2")) returned 1 [0162.472] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefc01b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefc01b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaa4ee1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8", cAlternateFileName="B3BB9C~1")) returned 1 [0162.472] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54322770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54322770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0x0, dwReserved1=0x0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", cAlternateFileName="BC570E~2")) returned 1 [0162.472] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0x0, dwReserved1=0x0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", cAlternateFileName="BC570E~1")) returned 1 [0162.472] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x56bb3b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x56bb3b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaeca3800, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", cAlternateFileName="C46E7B~2")) returned 1 [0162.472] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x682fbd00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x682fbd00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae0bca00, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", cAlternateFileName="C46E7B~3")) returned 1 [0162.473] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5461c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5461c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf67eb30, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", cAlternateFileName="C46E7B~1")) returned 1 [0162.473] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x728c68a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x728c68a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xae63dce0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", cAlternateFileName="D47DBD~2")) returned 1 [0162.473] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x545f6190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x545f6190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69b6e1e0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", cAlternateFileName="D47DBD~1")) returned 1 [0162.473] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x808d4a70, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x808d4a70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x808d4a70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", cAlternateFileName="D52C56~1")) returned 1 [0162.473] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x683e0540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x683e0540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f015a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x0, dwReserved1=0x0, cFileName="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", cAlternateFileName="EA6180~1")) returned 1 [0162.473] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf312b90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf312b90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf312b90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1", cAlternateFileName="F293AE~1")) returned 1 [0162.473] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 1 [0162.473] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 0 [0162.473] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0162.473] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="MetaData", cAlternateFileName="")) returned 0 [0162.473] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0162.473] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73, dwReserved1=0x0, cFileName="IME12", cAlternateFileName="")) returned 1 [0162.473] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0162.474] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="..", cAlternateFileName="")) returned 1 [0162.474] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="..", cAlternateFileName="")) returned 0 [0162.474] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0162.474] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73, dwReserved1=0x0, cFileName="IMJP12", cAlternateFileName="")) returned 1 [0162.474] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0162.474] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="..", cAlternateFileName="")) returned 1 [0162.474] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="..", cAlternateFileName="")) returned 0 [0162.474] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0162.474] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73, dwReserved1=0x0, cFileName="IMJP8_1", cAlternateFileName="")) returned 1 [0162.474] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0162.474] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="..", cAlternateFileName="")) returned 1 [0162.475] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="..", cAlternateFileName="")) returned 0 [0162.475] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0162.475] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73, dwReserved1=0x0, cFileName="IMJP9_0", cAlternateFileName="")) returned 1 [0162.475] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0162.475] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="..", cAlternateFileName="")) returned 1 [0162.475] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="..", cAlternateFileName="")) returned 0 [0162.475] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0162.475] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0162.475] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0162.475] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="..", cAlternateFileName="")) returned 1 [0162.475] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="DOMStore", cAlternateFileName="")) returned 1 [0162.475] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0162.475] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.476] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="36USA68T", cAlternateFileName="")) returned 1 [0162.476] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0162.476] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.476] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b05050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="imagesrv.adition[1].xml", cAlternateFileName="IMAGES~1.XML")) returned 1 [0162.476] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\imagesrv.adition[1].xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.476] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\imagesrv.adition[1].xml.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0162.477] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd [0162.477] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0162.477] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0162.562] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0xd, lpOverlapped=0x0) returned 1 [0162.563] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x10, lpOverlapped=0x0) returned 1 [0162.564] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0162.584] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.593] CloseHandle (hObject=0xdc) returned 1 [0162.593] CloseHandle (hObject=0xe4) returned 1 [0162.593] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\imagesrv.adition[1].xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\imagesrv.adition[1].xml.dvodltmf")) returned 0 [0162.594] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\imagesrv.adition[1].xml.dvodltmf")) returned 0x2020 [0162.594] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b05050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="imagesrv.adition[1].xml", cAlternateFileName="IMAGES~1.XML")) returned 0x2e8558 [0162.594] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b05050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="imagesrv.adition[1].xml", cAlternateFileName="IMAGES~1.XML")) returned 0 [0162.594] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0162.594] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\imagesrv.adition[1].xml")) returned 1 [0162.595] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\imagesrv.adition[1].xml")) returned 0xffffffff [0162.595] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b05050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="imagesrv.adition[1].xml", cAlternateFileName="IMAGES~1.XML")) returned 0 [0162.595] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0162.595] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605dd8a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f697469, dwReserved1=0x5d315b6e, cFileName="3O75JDME", cAlternateFileName="")) returned 1 [0162.595] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605dd8a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0162.596] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605dd8a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="..", cAlternateFileName="")) returned 1 [0162.596] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605dd8a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x696aec80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="www.google[1].xml", cAlternateFileName="WWWGOO~1.XML")) returned 1 [0162.596] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\www.google[1].xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0162.597] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\www.google[1].xml.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.598] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd [0162.598] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0162.598] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0162.684] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0xd, lpOverlapped=0x0) returned 1 [0162.685] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x10, lpOverlapped=0x0) returned 1 [0162.686] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0162.706] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.715] CloseHandle (hObject=0xe4) returned 1 [0162.715] CloseHandle (hObject=0xdc) returned 1 [0162.715] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\www.google[1].xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\www.google[1].xml.dvodltmf")) returned 0 [0162.716] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\www.google[1].xml.dvodltmf")) returned 0x2020 [0162.716] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605dd8a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x696aec80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="www.google[1].xml", cAlternateFileName="WWWGOO~1.XML")) returned 0x2e8558 [0162.716] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605dd8a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x696aec80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="www.google[1].xml", cAlternateFileName="WWWGOO~1.XML")) returned 0 [0162.716] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0162.716] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\www.google[1].xml")) returned 1 [0162.717] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\www.google[1].xml")) returned 0xffffffff [0162.717] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605dd8a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x696aec80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="www.google[1].xml", cAlternateFileName="WWWGOO~1.XML")) returned 0 [0162.717] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0162.717] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x782e5d31, dwReserved1=0x5d316c6d, cFileName="index.dat", cAlternateFileName="")) returned 1 [0162.717] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0162.718] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\index.dat.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.720] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8000 [0162.720] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0162.720] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0162.816] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x8000, lpOverlapped=0x0) returned 1 [0162.818] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x8010, lpOverlapped=0x0) returned 1 [0162.820] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0162.840] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.850] CloseHandle (hObject=0xf0) returned 1 [0162.850] CloseHandle (hObject=0xdc) returned 1 [0162.850] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\index.dat.dvodltmf")) returned 0 [0162.851] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\index.dat.dvodltmf")) returned 0x2020 [0162.851] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0x2e8518 [0162.851] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0 [0162.851] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0162.851] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\index.dat")) returned 1 [0162.852] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\index.dat")) returned 0xffffffff [0162.852] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="UV0DUWVB", cAlternateFileName="")) returned 1 [0162.852] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xba, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0162.853] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xba, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.853] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xba, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0162.853] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0162.853] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="VGMTOI09", cAlternateFileName="")) returned 1 [0162.853] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xba, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0162.853] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xba, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.853] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x344, dwReserved0=0xba, dwReserved1=0x0, cFileName="www.msn[1].xml", cAlternateFileName="WWWMSN~1.XML")) returned 1 [0162.853] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\www.msn[1].xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0162.853] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\www.msn[1].xml.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0162.854] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x344 [0162.854] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0162.854] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0162.951] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x344, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x344, lpOverlapped=0x0) returned 1 [0162.953] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x350, lpOverlapped=0x0) returned 1 [0162.954] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0162.974] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.983] CloseHandle (hObject=0xf0) returned 1 [0162.983] CloseHandle (hObject=0xe4) returned 1 [0162.983] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\www.msn[1].xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\www.msn[1].xml.dvodltmf")) returned 0 [0162.984] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\www.msn[1].xml.dvodltmf")) returned 0x2020 [0162.984] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x344, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="www.msn[1].xml", cAlternateFileName="WWWMSN~1.XML")) returned 0x2e8558 [0162.985] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x344, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="www.msn[1].xml", cAlternateFileName="WWWMSN~1.XML")) returned 0 [0162.985] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0162.985] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\www.msn[1].xml")) returned 1 [0162.986] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\www.msn[1].xml")) returned 0xffffffff [0162.986] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x344, dwReserved0=0xba, dwReserved1=0x0, cFileName="www.msn[1].xml", cAlternateFileName="WWWMSN~1.XML")) returned 0 [0162.986] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0162.986] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="VGMTOI09", cAlternateFileName="")) returned 0 [0162.986] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0162.986] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="Services", cAlternateFileName="")) returned 1 [0162.986] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6d78, dwReserved1=0x18eb84, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0162.986] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6d78, dwReserved1=0x18eb84, cFileName="..", cAlternateFileName="")) returned 1 [0162.986] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6d78, dwReserved1=0x18eb84, cFileName="..", cAlternateFileName="")) returned 0 [0162.986] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0162.986] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="Services", cAlternateFileName="")) returned 0 [0162.986] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0162.986] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 0 [0162.986] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0162.986] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x726f6c70, dwReserved1=0x2e447265, cFileName="Sun", cAlternateFileName="")) returned 1 [0162.986] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0162.987] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.987] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0162.987] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0162.988] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="..", cAlternateFileName="")) returned 1 [0162.988] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7eea3160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="AU", cAlternateFileName="")) returned 1 [0162.988] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7eea3160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0162.988] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7eea3160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.988] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8e062, dwReserved0=0x0, dwReserved1=0x0, cFileName="au.cab", cAlternateFileName="")) returned 1 [0162.988] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0162.989] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.cab.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0162.990] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8e062 [0162.990] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0162.990] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0163.074] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x8e062, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x8e062, lpOverlapped=0x0) returned 1 [0163.227] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x8e070, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x8e070, lpOverlapped=0x0) returned 1 [0163.247] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0163.268] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.277] CloseHandle (hObject=0xdc) returned 1 [0163.277] CloseHandle (hObject=0xe4) returned 1 [0163.277] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.cab"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.cab.dvodltmf")) returned 0 [0163.278] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.cab.dvodltmf")) returned 0x2020 [0163.278] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8e062, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="au.cab", cAlternateFileName="")) returned 0x2e8518 [0163.278] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8e062, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="au.cab", cAlternateFileName="")) returned 0 [0163.278] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0163.278] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.cab")) returned 1 [0163.284] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.cab")) returned 0xffffffff [0163.284] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2d400, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="au.msi", cAlternateFileName="")) returned 1 [0163.284] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0163.284] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.msi.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.285] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d400 [0163.285] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0163.285] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0163.376] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2d400, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x2d400, lpOverlapped=0x0) returned 1 [0163.416] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2d410, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x2d410, lpOverlapped=0x0) returned 1 [0163.419] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0163.439] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.448] CloseHandle (hObject=0xe4) returned 1 [0163.448] CloseHandle (hObject=0xdc) returned 1 [0163.449] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.msi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.msi.dvodltmf")) returned 0 [0163.449] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.msi.dvodltmf")) returned 0x2020 [0163.449] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2d400, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="au.msi", cAlternateFileName="")) returned 0x2e8518 [0163.450] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2d400, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="au.msi", cAlternateFileName="")) returned 0 [0163.450] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0163.450] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.msi")) returned 1 [0163.452] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.msi")) returned 0xffffffff [0163.452] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2d400, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="au.msi", cAlternateFileName="")) returned 0 [0163.452] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0163.452] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1ea6db0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1 [0163.452] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1ea6db0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0163.453] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1ea6db0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="..", cAlternateFileName="")) returned 1 [0163.453] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa1ea6db0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xfec5c570, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="deployment.properties", cAlternateFileName="DEPLOY~1.PRO")) returned 1 [0163.453] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\deployment.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.453] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\deployment.properties.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0163.602] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2cf [0163.602] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0163.602] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0163.691] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2cf, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x2cf, lpOverlapped=0x0) returned 1 [0163.693] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x2d0, lpOverlapped=0x0) returned 1 [0163.694] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0163.714] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.724] CloseHandle (hObject=0xdc) returned 1 [0163.724] CloseHandle (hObject=0xe4) returned 1 [0163.744] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\deployment.properties"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\deployment.properties.dvodltmf")) returned 0 [0163.745] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\deployment.properties.dvodltmf")) returned 0x2020 [0163.745] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa1ea6db0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xfec5c570, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="deployment.properties", cAlternateFileName="DEPLOY~1.PRO")) returned 0x2e8518 [0163.745] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa1ea6db0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xfec5c570, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="deployment.properties", cAlternateFileName="DEPLOY~1.PRO")) returned 0 [0163.745] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0163.745] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\deployment.properties")) returned 1 [0163.746] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\deployment.properties")) returned 0xffffffff [0163.746] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="security", cAlternateFileName="")) returned 1 [0163.746] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0163.746] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.746] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0163.746] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0163.746] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="tmp", cAlternateFileName="")) returned 1 [0163.746] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0163.747] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.747] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfaeead90, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb0, dwReserved1=0x0, cFileName="si", cAlternateFileName="")) returned 1 [0163.747] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfeca8830, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70006f, dwReserved1=0x720065, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0163.747] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfeca8830, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70006f, dwReserved1=0x720065, cFileName="..", cAlternateFileName="")) returned 1 [0163.747] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfeca8830, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70006f, dwReserved1=0x720065, cFileName="..", cAlternateFileName="")) returned 0 [0163.747] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0163.747] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfaeead90, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb0, dwReserved1=0x0, cFileName="si", cAlternateFileName="")) returned 0 [0163.747] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0163.747] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="tmp", cAlternateFileName="")) returned 0 [0163.747] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0163.747] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706f7270, dwReserved1=0x69747265, cFileName="jre1.7.0_45", cAlternateFileName="JRE17~1.0_4")) returned 1 [0163.747] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0163.748] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="..", cAlternateFileName="")) returned 1 [0163.748] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x182ac2a, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Data1.cab", cAlternateFileName="")) returned 1 [0163.748] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\data1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0163.758] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\data1.cab.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0163.759] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x182ac2a [0163.759] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0163.759] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0163.856] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x500000, lpOverlapped=0x0) returned 1 [0164.091] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x500000, lpOverlapped=0x0) returned 1 [0164.217] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x500000, lpOverlapped=0x0) returned 1 [0164.336] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x500000, lpOverlapped=0x0) returned 1 [0164.443] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x500000, lpOverlapped=0x0) returned 1 [0164.563] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x500000, lpOverlapped=0x0) returned 1 [0164.675] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x500000, lpOverlapped=0x0) returned 1 [0164.778] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x500000, lpOverlapped=0x0) returned 1 [0164.889] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x42ac2a, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x42ac2a, lpOverlapped=0x0) returned 1 [0164.966] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x42ac30, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x42ac30, lpOverlapped=0x0) returned 1 [0165.061] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0165.081] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.090] CloseHandle (hObject=0xe4) returned 1 [0165.090] CloseHandle (hObject=0xdc) returned 1 [0165.090] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\data1.cab"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\data1.cab.dvodltmf")) returned 0 [0165.091] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\data1.cab.dvodltmf")) returned 0x2020 [0165.091] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x182ac2a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Data1.cab", cAlternateFileName="")) returned 0x2e8518 [0165.091] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x182ac2a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Data1.cab", cAlternateFileName="")) returned 0 [0165.092] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0165.092] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\data1.cab")) returned 1 [0165.095] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\data1.cab")) returned 0xffffffff [0165.095] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68d26e60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xdd600, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="jre1.7.0_45.msi", cAlternateFileName="JRE170~1.MSI")) returned 1 [0165.096] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\jre1.7.0_45.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0165.096] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\jre1.7.0_45.msi.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0165.103] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd600 [0165.103] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0165.103] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0165.188] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xdd600, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xdd600, lpOverlapped=0x0) returned 1 [0165.202] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xdd610, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xdd610, lpOverlapped=0x0) returned 1 [0165.229] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0165.249] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.258] CloseHandle (hObject=0xdc) returned 1 [0165.258] CloseHandle (hObject=0xe4) returned 1 [0165.258] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\jre1.7.0_45.msi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\jre1.7.0_45.msi.dvodltmf")) returned 0 [0165.259] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\jre1.7.0_45.msi.dvodltmf")) returned 0x2020 [0165.259] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68d26e60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xdd600, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="jre1.7.0_45.msi", cAlternateFileName="JRE170~1.MSI")) returned 0x2e8518 [0165.259] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68d26e60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xdd600, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="jre1.7.0_45.msi", cAlternateFileName="JRE170~1.MSI")) returned 0 [0165.259] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0165.259] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\jre1.7.0_45.msi")) returned 1 [0165.267] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\jre1.7.0_45.msi")) returned 0xffffffff [0165.267] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68d26e60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xdd600, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="jre1.7.0_45.msi", cAlternateFileName="JRE170~1.MSI")) returned 0 [0165.267] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0165.267] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706f7270, dwReserved1=0x69747265, cFileName="jre1.7.0_45", cAlternateFileName="JRE17~1.0_4")) returned 0 [0165.267] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0165.267] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 0 [0165.267] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0165.268] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x726f6c70, dwReserved1=0x2e447265, cFileName="Sun", cAlternateFileName="")) returned 0 [0165.268] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0165.268] FindNextFileA (in: hFindFile=0x2dab40, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7298d080, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7298d080, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72657465, dwReserved1=0x2074656e, cFileName="Roaming", cAlternateFileName="")) returned 1 [0165.268] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7298d080, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7298d080, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x726f6c70, dwReserved1=0x2e447265, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0165.268] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7298d080, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7298d080, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x726f6c70, dwReserved1=0x2e447265, cFileName="..", cAlternateFileName="")) returned 1 [0165.268] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8867e080, ftCreationTime.dwHighDateTime=0x1d4cfe0, ftLastAccessTime.dwLowDateTime=0xdb0f5cf0, ftLastAccessTime.dwHighDateTime=0x1d4cefa, ftLastWriteTime.dwLowDateTime=0xdb0f5cf0, ftLastWriteTime.dwHighDateTime=0x1d4cefa, nFileSizeHigh=0x0, nFileSizeLow=0xced1, dwReserved0=0x726f6c70, dwReserved1=0x2e447265, cFileName="-zZW1PdGOLj1oWJZ.swf", cAlternateFileName="-ZZW1P~1.SWF")) returned 1 [0165.268] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\-zZW1PdGOLj1oWJZ.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\-zzw1pdgolj1owjz.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0165.268] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\-zZW1PdGOLj1oWJZ.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\-zzw1pdgolj1owjz.swf.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0165.269] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xced1 [0165.269] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0165.269] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0165.353] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xced1, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0xced1, lpOverlapped=0x0) returned 1 [0165.360] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xcee0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0xcee0, lpOverlapped=0x0) returned 1 [0165.361] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0165.381] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.391] CloseHandle (hObject=0xd8) returned 1 [0165.391] CloseHandle (hObject=0xec) returned 1 [0165.391] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\-zZW1PdGOLj1oWJZ.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\-zzw1pdgolj1owjz.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\-zZW1PdGOLj1oWJZ.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\-zzw1pdgolj1owjz.swf.dvodltmf")) returned 0 [0165.392] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\-zZW1PdGOLj1oWJZ.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\-zzw1pdgolj1owjz.swf.dvodltmf")) returned 0x2020 [0165.392] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\-zZW1PdGOLj1oWJZ.swf", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8867e080, ftCreationTime.dwHighDateTime=0x1d4cfe0, ftLastAccessTime.dwLowDateTime=0xdb0f5cf0, ftLastAccessTime.dwHighDateTime=0x1d4cefa, ftLastWriteTime.dwLowDateTime=0xdb0f5cf0, ftLastWriteTime.dwHighDateTime=0x1d4cefa, nFileSizeHigh=0x0, nFileSizeLow=0xced1, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="-zZW1PdGOLj1oWJZ.swf", cAlternateFileName="-ZZW1P~1.SWF")) returned 0x2e8458 [0165.392] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8867e080, ftCreationTime.dwHighDateTime=0x1d4cfe0, ftLastAccessTime.dwLowDateTime=0xdb0f5cf0, ftLastAccessTime.dwHighDateTime=0x1d4cefa, ftLastWriteTime.dwLowDateTime=0xdb0f5cf0, ftLastWriteTime.dwHighDateTime=0x1d4cefa, nFileSizeHigh=0x0, nFileSizeLow=0xced1, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="-zZW1PdGOLj1oWJZ.swf", cAlternateFileName="-ZZW1P~1.SWF")) returned 0 [0165.392] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0165.392] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\-zZW1PdGOLj1oWJZ.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\-zzw1pdgolj1owjz.swf")) returned 1 [0165.393] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\-zZW1PdGOLj1oWJZ.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\-zzw1pdgolj1owjz.swf")) returned 0xffffffff [0165.394] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4246e110, ftCreationTime.dwHighDateTime=0x1d4cb84, ftLastAccessTime.dwLowDateTime=0xf5410400, ftLastAccessTime.dwHighDateTime=0x1d4d0af, ftLastWriteTime.dwLowDateTime=0xf5410400, ftLastWriteTime.dwHighDateTime=0x1d4d0af, nFileSizeHigh=0x0, nFileSizeLow=0x10c1f, dwReserved0=0x2dcc40, dwReserved1=0x18f2bc, cFileName="2sBSYC.avi", cAlternateFileName="")) returned 1 [0165.394] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2sBSYC.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2sbsyc.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0165.394] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2sBSYC.avi.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2sbsyc.avi.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0165.394] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10c1f [0165.394] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0165.395] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0165.487] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x10c1f, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x10c1f, lpOverlapped=0x0) returned 1 [0165.489] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10c20, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x10c20, lpOverlapped=0x0) returned 1 [0165.490] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0165.510] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.520] CloseHandle (hObject=0xec) returned 1 [0165.520] CloseHandle (hObject=0xd8) returned 1 [0165.520] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2sBSYC.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2sbsyc.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2sBSYC.avi.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2sbsyc.avi.dvodltmf")) returned 0 [0165.520] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2sBSYC.avi.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2sbsyc.avi.dvodltmf")) returned 0x2020 [0165.521] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2sBSYC.avi", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4246e110, ftCreationTime.dwHighDateTime=0x1d4cb84, ftLastAccessTime.dwLowDateTime=0xf5410400, ftLastAccessTime.dwHighDateTime=0x1d4d0af, ftLastWriteTime.dwLowDateTime=0xf5410400, ftLastWriteTime.dwHighDateTime=0x1d4d0af, nFileSizeHigh=0x0, nFileSizeLow=0x10c1f, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="2sBSYC.avi", cAlternateFileName="")) returned 0x2e8458 [0165.521] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4246e110, ftCreationTime.dwHighDateTime=0x1d4cb84, ftLastAccessTime.dwLowDateTime=0xf5410400, ftLastAccessTime.dwHighDateTime=0x1d4d0af, ftLastWriteTime.dwLowDateTime=0xf5410400, ftLastWriteTime.dwHighDateTime=0x1d4d0af, nFileSizeHigh=0x0, nFileSizeLow=0x10c1f, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="2sBSYC.avi", cAlternateFileName="")) returned 0 [0165.521] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0165.521] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2sBSYC.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2sbsyc.avi")) returned 1 [0165.522] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2sBSYC.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2sbsyc.avi")) returned 0xffffffff [0165.522] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc1584dd0, ftCreationTime.dwHighDateTime=0x1d4c847, ftLastAccessTime.dwLowDateTime=0xfe7a9cd0, ftLastAccessTime.dwHighDateTime=0x1d4c834, ftLastWriteTime.dwLowDateTime=0xfe7a9cd0, ftLastWriteTime.dwHighDateTime=0x1d4c834, nFileSizeHigh=0x0, nFileSizeLow=0x13424, dwReserved0=0x0, dwReserved1=0x0, cFileName="2tgA2Js0c zzO3sM H.mp3", cAlternateFileName="2TGA2J~1.MP3")) returned 1 [0165.522] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2tgA2Js0c zzO3sM H.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2tga2js0c zzo3sm h.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0165.522] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2tgA2Js0c zzO3sM H.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2tga2js0c zzo3sm h.mp3.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0165.524] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13424 [0165.524] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0165.524] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0165.609] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x13424, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x13424, lpOverlapped=0x0) returned 1 [0165.611] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x13430, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x13430, lpOverlapped=0x0) returned 1 [0165.613] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0165.634] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.644] CloseHandle (hObject=0xd8) returned 1 [0165.644] CloseHandle (hObject=0xec) returned 1 [0165.644] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2tgA2Js0c zzO3sM H.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2tga2js0c zzo3sm h.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2tgA2Js0c zzO3sM H.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2tga2js0c zzo3sm h.mp3.dvodltmf")) returned 0 [0165.645] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2tgA2Js0c zzO3sM H.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2tga2js0c zzo3sm h.mp3.dvodltmf")) returned 0x2020 [0165.645] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2tgA2Js0c zzO3sM H.mp3", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc1584dd0, ftCreationTime.dwHighDateTime=0x1d4c847, ftLastAccessTime.dwLowDateTime=0xfe7a9cd0, ftLastAccessTime.dwHighDateTime=0x1d4c834, ftLastWriteTime.dwLowDateTime=0xfe7a9cd0, ftLastWriteTime.dwHighDateTime=0x1d4c834, nFileSizeHigh=0x0, nFileSizeLow=0x13424, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="2tgA2Js0c zzO3sM H.mp3", cAlternateFileName="2TGA2J~1.MP3")) returned 0x2e8458 [0165.645] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc1584dd0, ftCreationTime.dwHighDateTime=0x1d4c847, ftLastAccessTime.dwLowDateTime=0xfe7a9cd0, ftLastAccessTime.dwHighDateTime=0x1d4c834, ftLastWriteTime.dwLowDateTime=0xfe7a9cd0, ftLastWriteTime.dwHighDateTime=0x1d4c834, nFileSizeHigh=0x0, nFileSizeLow=0x13424, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="2tgA2Js0c zzO3sM H.mp3", cAlternateFileName="2TGA2J~1.MP3")) returned 0 [0165.645] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0165.645] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2tgA2Js0c zzO3sM H.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2tga2js0c zzo3sm h.mp3")) returned 1 [0165.646] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2tgA2Js0c zzO3sM H.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2tga2js0c zzo3sm h.mp3")) returned 0xffffffff [0165.646] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64ebecb0, ftCreationTime.dwHighDateTime=0x1d4cf30, ftLastAccessTime.dwLowDateTime=0xc02f6290, ftLastAccessTime.dwHighDateTime=0x1d4c5f4, ftLastWriteTime.dwLowDateTime=0xc02f6290, ftLastWriteTime.dwHighDateTime=0x1d4c5f4, nFileSizeHigh=0x0, nFileSizeLow=0x6b27, dwReserved0=0x0, dwReserved1=0x0, cFileName="4-sCPOyLC2t3Si.jpg", cAlternateFileName="4-SCPO~1.JPG")) returned 1 [0165.646] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\4-sCPOyLC2t3Si.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\4-scpoylc2t3si.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0165.646] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\4-sCPOyLC2t3Si.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\4-scpoylc2t3si.jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0165.647] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6b27 [0165.647] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0165.648] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0165.733] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x6b27, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x6b27, lpOverlapped=0x0) returned 1 [0165.734] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x6b30, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x6b30, lpOverlapped=0x0) returned 1 [0165.735] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0165.755] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.765] CloseHandle (hObject=0xec) returned 1 [0165.765] CloseHandle (hObject=0xd8) returned 1 [0165.765] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\4-sCPOyLC2t3Si.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\4-scpoylc2t3si.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\4-sCPOyLC2t3Si.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\4-scpoylc2t3si.jpg.dvodltmf")) returned 0 [0165.766] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\4-sCPOyLC2t3Si.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\4-scpoylc2t3si.jpg.dvodltmf")) returned 0x2020 [0165.766] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\4-sCPOyLC2t3Si.jpg", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64ebecb0, ftCreationTime.dwHighDateTime=0x1d4cf30, ftLastAccessTime.dwLowDateTime=0xc02f6290, ftLastAccessTime.dwHighDateTime=0x1d4c5f4, ftLastWriteTime.dwLowDateTime=0xc02f6290, ftLastWriteTime.dwHighDateTime=0x1d4c5f4, nFileSizeHigh=0x0, nFileSizeLow=0x6b27, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="4-sCPOyLC2t3Si.jpg", cAlternateFileName="4-SCPO~1.JPG")) returned 0x2e8458 [0165.766] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64ebecb0, ftCreationTime.dwHighDateTime=0x1d4cf30, ftLastAccessTime.dwLowDateTime=0xc02f6290, ftLastAccessTime.dwHighDateTime=0x1d4c5f4, ftLastWriteTime.dwLowDateTime=0xc02f6290, ftLastWriteTime.dwHighDateTime=0x1d4c5f4, nFileSizeHigh=0x0, nFileSizeLow=0x6b27, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="4-sCPOyLC2t3Si.jpg", cAlternateFileName="4-SCPO~1.JPG")) returned 0 [0165.766] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0165.766] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\4-sCPOyLC2t3Si.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\4-scpoylc2t3si.jpg")) returned 1 [0165.843] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\4-sCPOyLC2t3Si.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\4-scpoylc2t3si.jpg")) returned 0xffffffff [0165.843] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55e17bc0, ftCreationTime.dwHighDateTime=0x1d4d4a5, ftLastAccessTime.dwLowDateTime=0x43dabe0, ftLastAccessTime.dwHighDateTime=0x1d4d126, ftLastWriteTime.dwLowDateTime=0x43dabe0, ftLastWriteTime.dwHighDateTime=0x1d4d126, nFileSizeHigh=0x0, nFileSizeLow=0xe76b, dwReserved0=0x2dcc40, dwReserved1=0x18f2bc, cFileName="65sXBan.mp4", cAlternateFileName="")) returned 1 [0165.843] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\65sXBan.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\65sxban.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0165.844] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\65sXBan.mp4.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\65sxban.mp4.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0165.845] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe76b [0165.845] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0165.845] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0165.930] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe76b, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0xe76b, lpOverlapped=0x0) returned 1 [0165.931] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe770, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0xe770, lpOverlapped=0x0) returned 1 [0165.933] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0165.952] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.962] CloseHandle (hObject=0xd8) returned 1 [0165.962] CloseHandle (hObject=0xec) returned 1 [0165.962] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\65sXBan.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\65sxban.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\65sXBan.mp4.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\65sxban.mp4.dvodltmf")) returned 0 [0165.963] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\65sXBan.mp4.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\65sxban.mp4.dvodltmf")) returned 0x2020 [0165.963] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\65sXBan.mp4", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55e17bc0, ftCreationTime.dwHighDateTime=0x1d4d4a5, ftLastAccessTime.dwLowDateTime=0x43dabe0, ftLastAccessTime.dwHighDateTime=0x1d4d126, ftLastWriteTime.dwLowDateTime=0x43dabe0, ftLastWriteTime.dwHighDateTime=0x1d4d126, nFileSizeHigh=0x0, nFileSizeLow=0xe76b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="65sXBan.mp4", cAlternateFileName="")) returned 0x2e8458 [0165.963] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55e17bc0, ftCreationTime.dwHighDateTime=0x1d4d4a5, ftLastAccessTime.dwLowDateTime=0x43dabe0, ftLastAccessTime.dwHighDateTime=0x1d4d126, ftLastWriteTime.dwLowDateTime=0x43dabe0, ftLastWriteTime.dwHighDateTime=0x1d4d126, nFileSizeHigh=0x0, nFileSizeLow=0xe76b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="65sXBan.mp4", cAlternateFileName="")) returned 0 [0165.964] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0165.964] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\65sXBan.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\65sxban.mp4")) returned 1 [0165.965] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\65sXBan.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\65sxban.mp4")) returned 0xffffffff [0165.965] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9e8acc0, ftCreationTime.dwHighDateTime=0x1d4d2a2, ftLastAccessTime.dwLowDateTime=0x58b5faf0, ftLastAccessTime.dwHighDateTime=0x1d4c56f, ftLastWriteTime.dwLowDateTime=0x58b5faf0, ftLastWriteTime.dwHighDateTime=0x1d4c56f, nFileSizeHigh=0x0, nFileSizeLow=0xd2b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="6P bohmxBBg95UnDmJX9.mp3", cAlternateFileName="6PBOHM~1.MP3")) returned 1 [0165.965] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6P bohmxBBg95UnDmJX9.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\6p bohmxbbg95undmjx9.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0165.965] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6P bohmxBBg95UnDmJX9.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\6p bohmxbbg95undmjx9.mp3.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0165.966] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd2b8 [0165.966] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0165.966] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0166.052] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd2b8, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0xd2b8, lpOverlapped=0x0) returned 1 [0166.053] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd2c0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0xd2c0, lpOverlapped=0x0) returned 1 [0166.055] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0166.075] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.085] CloseHandle (hObject=0xec) returned 1 [0166.085] CloseHandle (hObject=0xd8) returned 1 [0166.085] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6P bohmxBBg95UnDmJX9.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\6p bohmxbbg95undmjx9.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6P bohmxBBg95UnDmJX9.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\6p bohmxbbg95undmjx9.mp3.dvodltmf")) returned 0 [0166.086] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6P bohmxBBg95UnDmJX9.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\6p bohmxbbg95undmjx9.mp3.dvodltmf")) returned 0x2020 [0166.086] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6P bohmxBBg95UnDmJX9.mp3", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9e8acc0, ftCreationTime.dwHighDateTime=0x1d4d2a2, ftLastAccessTime.dwLowDateTime=0x58b5faf0, ftLastAccessTime.dwHighDateTime=0x1d4c56f, ftLastWriteTime.dwLowDateTime=0x58b5faf0, ftLastWriteTime.dwHighDateTime=0x1d4c56f, nFileSizeHigh=0x0, nFileSizeLow=0xd2b8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="6P bohmxBBg95UnDmJX9.mp3", cAlternateFileName="6PBOHM~1.MP3")) returned 0x2e8458 [0166.086] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9e8acc0, ftCreationTime.dwHighDateTime=0x1d4d2a2, ftLastAccessTime.dwLowDateTime=0x58b5faf0, ftLastAccessTime.dwHighDateTime=0x1d4c56f, ftLastWriteTime.dwLowDateTime=0x58b5faf0, ftLastWriteTime.dwHighDateTime=0x1d4c56f, nFileSizeHigh=0x0, nFileSizeLow=0xd2b8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="6P bohmxBBg95UnDmJX9.mp3", cAlternateFileName="6PBOHM~1.MP3")) returned 0 [0166.086] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0166.086] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6P bohmxBBg95UnDmJX9.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\6p bohmxbbg95undmjx9.mp3")) returned 1 [0166.088] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6P bohmxBBg95UnDmJX9.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\6p bohmxbbg95undmjx9.mp3")) returned 0xffffffff [0166.088] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x694f0af0, ftCreationTime.dwHighDateTime=0x1d4d51e, ftLastAccessTime.dwLowDateTime=0xacd19850, ftLastAccessTime.dwHighDateTime=0x1d4cfe3, ftLastWriteTime.dwLowDateTime=0xacd19850, ftLastWriteTime.dwHighDateTime=0x1d4cfe3, nFileSizeHigh=0x0, nFileSizeLow=0x6cfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="8T8s9jBtANTygPB.bmp", cAlternateFileName="8T8S9J~1.BMP")) returned 1 [0166.088] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8T8s9jBtANTygPB.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\8t8s9jbtantygpb.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0166.088] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8T8s9jBtANTygPB.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\8t8s9jbtantygpb.bmp.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0166.089] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6cfc [0166.089] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0166.089] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0166.174] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x6cfc, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x6cfc, lpOverlapped=0x0) returned 1 [0166.175] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x6d00, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x6d00, lpOverlapped=0x0) returned 1 [0166.176] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0166.198] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.207] CloseHandle (hObject=0xd8) returned 1 [0166.207] CloseHandle (hObject=0xec) returned 1 [0166.207] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8T8s9jBtANTygPB.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\8t8s9jbtantygpb.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8T8s9jBtANTygPB.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\8t8s9jbtantygpb.bmp.dvodltmf")) returned 0 [0166.208] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8T8s9jBtANTygPB.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\8t8s9jbtantygpb.bmp.dvodltmf")) returned 0x2020 [0166.208] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8T8s9jBtANTygPB.bmp", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x694f0af0, ftCreationTime.dwHighDateTime=0x1d4d51e, ftLastAccessTime.dwLowDateTime=0xacd19850, ftLastAccessTime.dwHighDateTime=0x1d4cfe3, ftLastWriteTime.dwLowDateTime=0xacd19850, ftLastWriteTime.dwHighDateTime=0x1d4cfe3, nFileSizeHigh=0x0, nFileSizeLow=0x6cfc, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="8T8s9jBtANTygPB.bmp", cAlternateFileName="8T8S9J~1.BMP")) returned 0x2e8458 [0166.209] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x694f0af0, ftCreationTime.dwHighDateTime=0x1d4d51e, ftLastAccessTime.dwLowDateTime=0xacd19850, ftLastAccessTime.dwHighDateTime=0x1d4cfe3, ftLastWriteTime.dwLowDateTime=0xacd19850, ftLastWriteTime.dwHighDateTime=0x1d4cfe3, nFileSizeHigh=0x0, nFileSizeLow=0x6cfc, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="8T8s9jBtANTygPB.bmp", cAlternateFileName="8T8S9J~1.BMP")) returned 0 [0166.209] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0166.209] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8T8s9jBtANTygPB.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\8t8s9jbtantygpb.bmp")) returned 1 [0166.210] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8T8s9jBtANTygPB.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\8t8s9jbtantygpb.bmp")) returned 0xffffffff [0166.210] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9cfaba00, ftCreationTime.dwHighDateTime=0x1d4d2c3, ftLastAccessTime.dwLowDateTime=0x34f33a90, ftLastAccessTime.dwHighDateTime=0x1d4c6b6, ftLastWriteTime.dwLowDateTime=0x34f33a90, ftLastWriteTime.dwHighDateTime=0x1d4c6b6, nFileSizeHigh=0x0, nFileSizeLow=0x17ad3, dwReserved0=0x2dcc40, dwReserved1=0x18f2bc, cFileName="92cQxQtAMLs.gif", cAlternateFileName="92CQXQ~1.GIF")) returned 1 [0166.210] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\92cQxQtAMLs.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\92cqxqtamls.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0166.210] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\92cQxQtAMLs.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\92cqxqtamls.gif.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0166.211] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17ad3 [0166.211] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0166.211] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0166.296] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x17ad3, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x17ad3, lpOverlapped=0x0) returned 1 [0166.298] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x17ae0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x17ae0, lpOverlapped=0x0) returned 1 [0166.300] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0166.320] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.329] CloseHandle (hObject=0xec) returned 1 [0166.329] CloseHandle (hObject=0xd8) returned 1 [0166.329] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\92cQxQtAMLs.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\92cqxqtamls.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\92cQxQtAMLs.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\92cqxqtamls.gif.dvodltmf")) returned 0 [0166.330] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\92cQxQtAMLs.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\92cqxqtamls.gif.dvodltmf")) returned 0x2020 [0166.330] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\92cQxQtAMLs.gif", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9cfaba00, ftCreationTime.dwHighDateTime=0x1d4d2c3, ftLastAccessTime.dwLowDateTime=0x34f33a90, ftLastAccessTime.dwHighDateTime=0x1d4c6b6, ftLastWriteTime.dwLowDateTime=0x34f33a90, ftLastWriteTime.dwHighDateTime=0x1d4c6b6, nFileSizeHigh=0x0, nFileSizeLow=0x17ad3, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="92cQxQtAMLs.gif", cAlternateFileName="92CQXQ~1.GIF")) returned 0x2e8458 [0166.330] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9cfaba00, ftCreationTime.dwHighDateTime=0x1d4d2c3, ftLastAccessTime.dwLowDateTime=0x34f33a90, ftLastAccessTime.dwHighDateTime=0x1d4c6b6, ftLastWriteTime.dwLowDateTime=0x34f33a90, ftLastWriteTime.dwHighDateTime=0x1d4c6b6, nFileSizeHigh=0x0, nFileSizeLow=0x17ad3, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="92cQxQtAMLs.gif", cAlternateFileName="92CQXQ~1.GIF")) returned 0 [0166.330] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0166.331] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\92cQxQtAMLs.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\92cqxqtamls.gif")) returned 1 [0166.332] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\92cQxQtAMLs.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\92cqxqtamls.gif")) returned 0xffffffff [0166.332] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18f2bc, cFileName="Adobe", cAlternateFileName="")) returned 1 [0166.333] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0166.334] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.334] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7a, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0166.334] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x660069, dwReserved1=0x62002e, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0166.335] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x660069, dwReserved1=0x62002e, cFileName="..", cAlternateFileName="")) returned 1 [0166.335] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x660069, dwReserved1=0x62002e, cFileName="10.0", cAlternateFileName="")) returned 1 [0166.335] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0166.335] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.335] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Collab", cAlternateFileName="")) returned 1 [0166.335] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0166.335] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.335] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0166.335] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0166.335] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Forms", cAlternateFileName="")) returned 1 [0166.335] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0166.336] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.336] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0166.336] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0166.336] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JavaScripts", cAlternateFileName="JAVASC~1")) returned 1 [0166.336] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0166.336] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.336] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="glob.js", cAlternateFileName="")) returned 1 [0166.336] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0166.336] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0166.337] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0166.337] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0166.338] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0166.424] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x10, lpOverlapped=0x0) returned 1 [0166.425] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0166.445] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.454] CloseHandle (hObject=0xdc) returned 1 [0166.454] CloseHandle (hObject=0xf0) returned 1 [0166.454] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.js.dvodltmf")) returned 0 [0166.455] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.js.dvodltmf")) returned 0x2020 [0166.455] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="glob.js", cAlternateFileName="")) returned 0x2e8558 [0166.455] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="glob.js", cAlternateFileName="")) returned 0 [0166.456] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0166.456] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.js")) returned 1 [0166.456] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.js")) returned 0xffffffff [0166.456] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="glob.settings.js", cAlternateFileName="GLOBSE~1.JS")) returned 1 [0166.456] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.settings.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0166.456] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.settings.js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0166.460] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa [0166.460] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0166.461] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0166.557] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0xa, lpOverlapped=0x0) returned 1 [0166.558] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x10, lpOverlapped=0x0) returned 1 [0166.559] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0166.579] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.589] CloseHandle (hObject=0xf0) returned 1 [0166.589] CloseHandle (hObject=0xdc) returned 1 [0166.589] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.settings.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.settings.js.dvodltmf")) returned 0 [0166.590] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.settings.js.dvodltmf")) returned 0x2020 [0166.590] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="glob.settings.js", cAlternateFileName="GLOBSE~1.JS")) returned 0x2e8558 [0166.590] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="glob.settings.js", cAlternateFileName="GLOBSE~1.JS")) returned 0 [0166.590] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0166.590] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.settings.js")) returned 1 [0166.591] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.settings.js")) returned 0xffffffff [0166.591] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="glob.settings.js", cAlternateFileName="GLOBSE~1.JS")) returned 0 [0166.591] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0166.591] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6a2e7367, dwReserved1=0x73, cFileName="Security", cAlternateFileName="")) returned 1 [0166.592] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0166.592] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="..", cAlternateFileName="")) returned 1 [0166.592] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda8cdc00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8f3d60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x1517, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="addressbook.acrodata", cAlternateFileName="ADDRES~1.ACR")) returned 1 [0166.592] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\addressbook.acrodata"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0166.593] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\addressbook.acrodata.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0166.593] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1517 [0166.593] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0166.594] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0166.679] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1517, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x1517, lpOverlapped=0x0) returned 1 [0166.681] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x1520, lpOverlapped=0x0) returned 1 [0166.682] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0166.702] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.711] CloseHandle (hObject=0xdc) returned 1 [0166.711] CloseHandle (hObject=0xf0) returned 1 [0166.712] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\addressbook.acrodata"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\addressbook.acrodata.dvodltmf")) returned 0 [0166.712] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\addressbook.acrodata.dvodltmf")) returned 0x2020 [0166.713] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda8cdc00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8f3d60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x1517, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="addressbook.acrodata", cAlternateFileName="ADDRES~1.ACR")) returned 0x2e8558 [0166.713] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda8cdc00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8f3d60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x1517, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="addressbook.acrodata", cAlternateFileName="ADDRES~1.ACR")) returned 0 [0166.713] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0166.713] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\addressbook.acrodata")) returned 1 [0166.714] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\addressbook.acrodata")) returned 0xffffffff [0166.714] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="CRLCache", cAlternateFileName="")) returned 1 [0166.714] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0166.714] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.714] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda5adf20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xdefc97c0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x3a5, dwReserved0=0xbc, dwReserved1=0x0, cFileName="48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", cAlternateFileName="48B764~1.CRL")) returned 1 [0166.714] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\48b76449f3d5fefa1133aa805e420f0fca643651.crl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0166.714] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\48b76449f3d5fefa1133aa805e420f0fca643651.crl.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0166.717] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a5 [0166.717] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0166.717] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0166.811] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3a5, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x3a5, lpOverlapped=0x0) returned 1 [0166.813] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x3b0, lpOverlapped=0x0) returned 1 [0166.814] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0166.833] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.843] CloseHandle (hObject=0xdc) returned 1 [0166.843] CloseHandle (hObject=0xe8) returned 1 [0166.843] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\48b76449f3d5fefa1133aa805e420f0fca643651.crl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\48b76449f3d5fefa1133aa805e420f0fca643651.crl.dvodltmf")) returned 0 [0166.844] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\48b76449f3d5fefa1133aa805e420f0fca643651.crl.dvodltmf")) returned 0x2020 [0166.844] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda5adf20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xdefc97c0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x3a5, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", cAlternateFileName="48B764~1.CRL")) returned 0x2e8598 [0166.844] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda5adf20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xdefc97c0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x3a5, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", cAlternateFileName="48B764~1.CRL")) returned 0 [0166.844] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0166.845] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\48b76449f3d5fefa1133aa805e420f0fca643651.crl")) returned 1 [0166.845] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\48b76449f3d5fefa1133aa805e420f0fca643651.crl")) returned 0xffffffff [0166.845] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda3e4ea0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda3e4ea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xdefa3660, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x9347, dwReserved0=0x2dcc40, dwReserved1=0x18e6b4, cFileName="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", cAlternateFileName="A9B821~1.CRL")) returned 1 [0166.846] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\a9b8213768adc68af64fcc6409e8be414726687f.crl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0166.846] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\a9b8213768adc68af64fcc6409e8be414726687f.crl.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0166.846] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9347 [0166.846] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0166.847] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0166.930] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x9347, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x9347, lpOverlapped=0x0) returned 1 [0166.932] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x9350, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x9350, lpOverlapped=0x0) returned 1 [0166.934] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0166.953] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.963] CloseHandle (hObject=0xe8) returned 1 [0166.963] CloseHandle (hObject=0xdc) returned 1 [0166.963] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\a9b8213768adc68af64fcc6409e8be414726687f.crl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\a9b8213768adc68af64fcc6409e8be414726687f.crl.dvodltmf")) returned 0 [0166.964] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\a9b8213768adc68af64fcc6409e8be414726687f.crl.dvodltmf")) returned 0x2020 [0166.964] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda3e4ea0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda3e4ea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xdefa3660, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x9347, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", cAlternateFileName="A9B821~1.CRL")) returned 0x2e8598 [0166.964] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda3e4ea0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda3e4ea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xdefa3660, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x9347, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", cAlternateFileName="A9B821~1.CRL")) returned 0 [0166.964] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0166.964] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\a9b8213768adc68af64fcc6409e8be414726687f.crl")) returned 1 [0166.965] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\a9b8213768adc68af64fcc6409e8be414726687f.crl")) returned 0xffffffff [0166.965] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda3e4ea0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda3e4ea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xdefa3660, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x9347, dwReserved0=0x2dcc40, dwReserved1=0x18e6b4, cFileName="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", cAlternateFileName="A9B821~1.CRL")) returned 0 [0166.965] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0166.965] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="CRLCache", cAlternateFileName="")) returned 0 [0166.965] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0166.965] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6a2e7367, dwReserved1=0x73, cFileName="Security", cAlternateFileName="")) returned 0 [0166.965] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0166.965] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x660069, dwReserved1=0x62002e, cFileName="10.0", cAlternateFileName="")) returned 0 [0166.966] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0166.966] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7a, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0166.966] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x660069, dwReserved1=0x62002e, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0166.969] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x660069, dwReserved1=0x62002e, cFileName="..", cAlternateFileName="")) returned 1 [0166.969] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x660069, dwReserved1=0x62002e, cFileName="AssetCache", cAlternateFileName="ASSETC~1")) returned 1 [0166.969] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7263612e, dwReserved1=0x7461646f, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0166.969] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7263612e, dwReserved1=0x7461646f, cFileName="..", cAlternateFileName="")) returned 1 [0166.969] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7263612e, dwReserved1=0x7461646f, cFileName="D5NTRC6R", cAlternateFileName="")) returned 1 [0166.969] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0166.970] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.970] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0166.970] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0166.970] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7263612e, dwReserved1=0x7461646f, cFileName="D5NTRC6R", cAlternateFileName="")) returned 0 [0166.970] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0166.970] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x660069, dwReserved1=0x62002e, cFileName="AssetCache", cAlternateFileName="ASSETC~1")) returned 0 [0166.970] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0166.970] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7a, dwReserved1=0x0, cFileName="Headlights", cAlternateFileName="HEADLI~1")) returned 1 [0166.970] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x660069, dwReserved1=0x62002e, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0166.971] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x660069, dwReserved1=0x62002e, cFileName="..", cAlternateFileName="")) returned 1 [0166.971] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x660069, dwReserved1=0x62002e, cFileName="..", cAlternateFileName="")) returned 0 [0166.971] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0166.971] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7a, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0166.971] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x660069, dwReserved1=0x62002e, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0166.971] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x660069, dwReserved1=0x62002e, cFileName="..", cAlternateFileName="")) returned 1 [0166.971] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x660069, dwReserved1=0x62002e, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 1 [0166.971] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7263612e, dwReserved1=0x7461646f, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0166.971] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7263612e, dwReserved1=0x7461646f, cFileName="..", cAlternateFileName="")) returned 1 [0166.971] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7263612e, dwReserved1=0x7461646f, cFileName="..", cAlternateFileName="")) returned 0 [0166.971] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0166.972] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x660069, dwReserved1=0x62002e, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 0 [0166.972] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0166.972] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73, dwReserved1=0x0, cFileName="LogTransport2", cAlternateFileName="LOGTRA~1")) returned 1 [0166.972] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x660069, dwReserved1=0x62002e, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0166.972] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x660069, dwReserved1=0x62002e, cFileName="..", cAlternateFileName="")) returned 1 [0166.972] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x660069, dwReserved1=0x62002e, cFileName="..", cAlternateFileName="")) returned 0 [0166.972] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0166.972] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73, dwReserved1=0x0, cFileName="LogTransport2", cAlternateFileName="LOGTRA~1")) returned 0 [0166.972] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0166.972] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf0a4b80, ftCreationTime.dwHighDateTime=0x1d4ccc8, ftLastAccessTime.dwLowDateTime=0xaea26310, ftLastAccessTime.dwHighDateTime=0x1d4d4f9, ftLastWriteTime.dwLowDateTime=0xaea26310, ftLastWriteTime.dwHighDateTime=0x1d4d4f9, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x2d3274, dwReserved1=0x18f2bc, cFileName="AGBA-zKjPiPeL.wav", cAlternateFileName="AGBA-Z~1.WAV")) returned 1 [0166.972] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\AGBA-zKjPiPeL.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\agba-zkjpipel.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0166.972] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\AGBA-zKjPiPeL.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\agba-zkjpipel.wav.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0166.973] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10a82 [0166.973] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0166.973] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0167.056] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x10a82, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x10a82, lpOverlapped=0x0) returned 1 [0167.058] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10a90, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x10a90, lpOverlapped=0x0) returned 1 [0167.060] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0167.079] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.091] CloseHandle (hObject=0xd8) returned 1 [0167.091] CloseHandle (hObject=0xec) returned 1 [0167.091] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\AGBA-zKjPiPeL.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\agba-zkjpipel.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\AGBA-zKjPiPeL.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\agba-zkjpipel.wav.dvodltmf")) returned 0 [0167.092] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\AGBA-zKjPiPeL.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\agba-zkjpipel.wav.dvodltmf")) returned 0x2020 [0167.092] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\AGBA-zKjPiPeL.wav", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf0a4b80, ftCreationTime.dwHighDateTime=0x1d4ccc8, ftLastAccessTime.dwLowDateTime=0xaea26310, ftLastAccessTime.dwHighDateTime=0x1d4d4f9, ftLastWriteTime.dwLowDateTime=0xaea26310, ftLastWriteTime.dwHighDateTime=0x1d4d4f9, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AGBA-zKjPiPeL.wav", cAlternateFileName="AGBA-Z~1.WAV")) returned 0x2e8458 [0167.092] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf0a4b80, ftCreationTime.dwHighDateTime=0x1d4ccc8, ftLastAccessTime.dwLowDateTime=0xaea26310, ftLastAccessTime.dwHighDateTime=0x1d4d4f9, ftLastWriteTime.dwLowDateTime=0xaea26310, ftLastWriteTime.dwHighDateTime=0x1d4d4f9, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AGBA-zKjPiPeL.wav", cAlternateFileName="AGBA-Z~1.WAV")) returned 0 [0167.092] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0167.092] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\AGBA-zKjPiPeL.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\agba-zkjpipel.wav")) returned 1 [0167.094] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\AGBA-zKjPiPeL.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\agba-zkjpipel.wav")) returned 0xffffffff [0167.094] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42f17100, ftCreationTime.dwHighDateTime=0x1d4d26b, ftLastAccessTime.dwLowDateTime=0x6cac54d0, ftLastAccessTime.dwHighDateTime=0x1d4cdcd, ftLastWriteTime.dwLowDateTime=0x6cac54d0, ftLastWriteTime.dwHighDateTime=0x1d4cdcd, nFileSizeHigh=0x0, nFileSizeLow=0x89e, dwReserved0=0x2dcc40, dwReserved1=0x18f2bc, cFileName="BaeJOAr8APa.xls", cAlternateFileName="BAEJOA~1.XLS")) returned 1 [0167.094] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\BaeJOAr8APa.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\baejoar8apa.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0167.094] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\BaeJOAr8APa.xls.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\baejoar8apa.xls.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0167.095] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x89e [0167.095] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0167.095] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0167.180] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x89e, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x89e, lpOverlapped=0x0) returned 1 [0167.180] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x8a0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x8a0, lpOverlapped=0x0) returned 1 [0167.181] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0167.201] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.210] CloseHandle (hObject=0xec) returned 1 [0167.210] CloseHandle (hObject=0xd8) returned 1 [0167.210] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\BaeJOAr8APa.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\baejoar8apa.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\BaeJOAr8APa.xls.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\baejoar8apa.xls.dvodltmf")) returned 0 [0167.211] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\BaeJOAr8APa.xls.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\baejoar8apa.xls.dvodltmf")) returned 0x2020 [0167.211] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\BaeJOAr8APa.xls", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42f17100, ftCreationTime.dwHighDateTime=0x1d4d26b, ftLastAccessTime.dwLowDateTime=0x6cac54d0, ftLastAccessTime.dwHighDateTime=0x1d4cdcd, ftLastWriteTime.dwLowDateTime=0x6cac54d0, ftLastWriteTime.dwHighDateTime=0x1d4cdcd, nFileSizeHigh=0x0, nFileSizeLow=0x89e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BaeJOAr8APa.xls", cAlternateFileName="BAEJOA~1.XLS")) returned 0x2e8458 [0167.212] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42f17100, ftCreationTime.dwHighDateTime=0x1d4d26b, ftLastAccessTime.dwLowDateTime=0x6cac54d0, ftLastAccessTime.dwHighDateTime=0x1d4cdcd, ftLastWriteTime.dwLowDateTime=0x6cac54d0, ftLastWriteTime.dwHighDateTime=0x1d4cdcd, nFileSizeHigh=0x0, nFileSizeLow=0x89e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="BaeJOAr8APa.xls", cAlternateFileName="BAEJOA~1.XLS")) returned 0 [0167.212] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0167.212] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\BaeJOAr8APa.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\baejoar8apa.xls")) returned 1 [0167.213] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\BaeJOAr8APa.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\baejoar8apa.xls")) returned 0xffffffff [0167.213] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61315a90, ftCreationTime.dwHighDateTime=0x1d4ce10, ftLastAccessTime.dwLowDateTime=0x5f86d5d0, ftLastAccessTime.dwHighDateTime=0x1d4c7e4, ftLastWriteTime.dwLowDateTime=0x5f86d5d0, ftLastWriteTime.dwHighDateTime=0x1d4c7e4, nFileSizeHigh=0x0, nFileSizeLow=0x1176d, dwReserved0=0x2dcc40, dwReserved1=0x18f2bc, cFileName="DobdDZxx8w_EmcHDxq3.ppt", cAlternateFileName="DOBDDZ~1.PPT")) returned 1 [0167.213] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DobdDZxx8w_EmcHDxq3.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dobddzxx8w_emchdxq3.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0167.213] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DobdDZxx8w_EmcHDxq3.ppt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dobddzxx8w_emchdxq3.ppt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0167.214] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1176d [0167.214] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0167.215] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0167.300] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1176d, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x1176d, lpOverlapped=0x0) returned 1 [0167.301] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x11770, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x11770, lpOverlapped=0x0) returned 1 [0167.303] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0167.323] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.333] CloseHandle (hObject=0xd8) returned 1 [0167.333] CloseHandle (hObject=0xec) returned 1 [0167.333] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DobdDZxx8w_EmcHDxq3.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dobddzxx8w_emchdxq3.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DobdDZxx8w_EmcHDxq3.ppt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dobddzxx8w_emchdxq3.ppt.dvodltmf")) returned 0 [0167.334] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DobdDZxx8w_EmcHDxq3.ppt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dobddzxx8w_emchdxq3.ppt.dvodltmf")) returned 0x2020 [0167.334] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DobdDZxx8w_EmcHDxq3.ppt", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61315a90, ftCreationTime.dwHighDateTime=0x1d4ce10, ftLastAccessTime.dwLowDateTime=0x5f86d5d0, ftLastAccessTime.dwHighDateTime=0x1d4c7e4, ftLastWriteTime.dwLowDateTime=0x5f86d5d0, ftLastWriteTime.dwHighDateTime=0x1d4c7e4, nFileSizeHigh=0x0, nFileSizeLow=0x1176d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="DobdDZxx8w_EmcHDxq3.ppt", cAlternateFileName="DOBDDZ~1.PPT")) returned 0x2e8458 [0167.334] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61315a90, ftCreationTime.dwHighDateTime=0x1d4ce10, ftLastAccessTime.dwLowDateTime=0x5f86d5d0, ftLastAccessTime.dwHighDateTime=0x1d4c7e4, ftLastWriteTime.dwLowDateTime=0x5f86d5d0, ftLastWriteTime.dwHighDateTime=0x1d4c7e4, nFileSizeHigh=0x0, nFileSizeLow=0x1176d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="DobdDZxx8w_EmcHDxq3.ppt", cAlternateFileName="DOBDDZ~1.PPT")) returned 0 [0167.334] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0167.334] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DobdDZxx8w_EmcHDxq3.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dobddzxx8w_emchdxq3.ppt")) returned 1 [0167.336] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DobdDZxx8w_EmcHDxq3.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dobddzxx8w_emchdxq3.ppt")) returned 0xffffffff [0167.336] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xded47ec0, ftCreationTime.dwHighDateTime=0x1d4d27d, ftLastAccessTime.dwLowDateTime=0x1b2cd010, ftLastAccessTime.dwHighDateTime=0x1d4cc62, ftLastWriteTime.dwLowDateTime=0x1b2cd010, ftLastWriteTime.dwHighDateTime=0x1d4cc62, nFileSizeHigh=0x0, nFileSizeLow=0x1258e, dwReserved0=0x0, dwReserved1=0x0, cFileName="e_UF.wav", cAlternateFileName="")) returned 1 [0167.336] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\e_UF.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\e_uf.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0167.336] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\e_UF.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\e_uf.wav.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0167.337] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1258e [0167.337] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0167.337] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0167.426] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1258e, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x1258e, lpOverlapped=0x0) returned 1 [0167.428] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x12590, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x12590, lpOverlapped=0x0) returned 1 [0167.430] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0167.450] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.459] CloseHandle (hObject=0xec) returned 1 [0167.459] CloseHandle (hObject=0xd8) returned 1 [0167.459] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\e_UF.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\e_uf.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\e_UF.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\e_uf.wav.dvodltmf")) returned 0 [0167.460] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\e_UF.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\e_uf.wav.dvodltmf")) returned 0x2020 [0167.460] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\e_UF.wav", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xded47ec0, ftCreationTime.dwHighDateTime=0x1d4d27d, ftLastAccessTime.dwLowDateTime=0x1b2cd010, ftLastAccessTime.dwHighDateTime=0x1d4cc62, ftLastWriteTime.dwLowDateTime=0x1b2cd010, ftLastWriteTime.dwHighDateTime=0x1d4cc62, nFileSizeHigh=0x0, nFileSizeLow=0x1258e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="e_UF.wav", cAlternateFileName="")) returned 0x2e8458 [0167.461] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xded47ec0, ftCreationTime.dwHighDateTime=0x1d4d27d, ftLastAccessTime.dwLowDateTime=0x1b2cd010, ftLastAccessTime.dwHighDateTime=0x1d4cc62, ftLastWriteTime.dwLowDateTime=0x1b2cd010, ftLastWriteTime.dwHighDateTime=0x1d4cc62, nFileSizeHigh=0x0, nFileSizeLow=0x1258e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="e_UF.wav", cAlternateFileName="")) returned 0 [0167.461] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0167.461] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\e_UF.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\e_uf.wav")) returned 1 [0167.462] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\e_UF.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\e_uf.wav")) returned 0xffffffff [0167.462] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2e43a410, ftCreationTime.dwHighDateTime=0x1d4cc28, ftLastAccessTime.dwLowDateTime=0xc742bbd0, ftLastAccessTime.dwHighDateTime=0x1d4ce97, ftLastWriteTime.dwLowDateTime=0xc742bbd0, ftLastWriteTime.dwHighDateTime=0x1d4ce97, nFileSizeHigh=0x0, nFileSizeLow=0xba66, dwReserved0=0x2dcc40, dwReserved1=0x18f2bc, cFileName="F_tFBwHbMGp.jpg", cAlternateFileName="F_TFBW~1.JPG")) returned 1 [0167.462] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\F_tFBwHbMGp.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\f_tfbwhbmgp.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0167.462] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\F_tFBwHbMGp.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\f_tfbwhbmgp.jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0167.463] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xba66 [0167.463] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0167.463] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0167.547] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xba66, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0xba66, lpOverlapped=0x0) returned 1 [0167.549] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xba70, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0xba70, lpOverlapped=0x0) returned 1 [0167.550] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0167.570] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.579] CloseHandle (hObject=0xd8) returned 1 [0167.579] CloseHandle (hObject=0xec) returned 1 [0167.580] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\F_tFBwHbMGp.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\f_tfbwhbmgp.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\F_tFBwHbMGp.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\f_tfbwhbmgp.jpg.dvodltmf")) returned 0 [0167.580] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\F_tFBwHbMGp.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\f_tfbwhbmgp.jpg.dvodltmf")) returned 0x2020 [0167.580] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\F_tFBwHbMGp.jpg", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2e43a410, ftCreationTime.dwHighDateTime=0x1d4cc28, ftLastAccessTime.dwLowDateTime=0xc742bbd0, ftLastAccessTime.dwHighDateTime=0x1d4ce97, ftLastWriteTime.dwLowDateTime=0xc742bbd0, ftLastWriteTime.dwHighDateTime=0x1d4ce97, nFileSizeHigh=0x0, nFileSizeLow=0xba66, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="F_tFBwHbMGp.jpg", cAlternateFileName="F_TFBW~1.JPG")) returned 0x2e8458 [0167.581] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2e43a410, ftCreationTime.dwHighDateTime=0x1d4cc28, ftLastAccessTime.dwLowDateTime=0xc742bbd0, ftLastAccessTime.dwHighDateTime=0x1d4ce97, ftLastWriteTime.dwLowDateTime=0xc742bbd0, ftLastWriteTime.dwHighDateTime=0x1d4ce97, nFileSizeHigh=0x0, nFileSizeLow=0xba66, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="F_tFBwHbMGp.jpg", cAlternateFileName="F_TFBW~1.JPG")) returned 0 [0167.581] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0167.581] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\F_tFBwHbMGp.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\f_tfbwhbmgp.jpg")) returned 1 [0167.582] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\F_tFBwHbMGp.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\f_tfbwhbmgp.jpg")) returned 0xffffffff [0167.582] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68333720, ftCreationTime.dwHighDateTime=0x1d4d4d0, ftLastAccessTime.dwLowDateTime=0xf638d930, ftLastAccessTime.dwHighDateTime=0x1d4cf49, ftLastWriteTime.dwLowDateTime=0xf638d930, ftLastWriteTime.dwHighDateTime=0x1d4cf49, nFileSizeHigh=0x0, nFileSizeLow=0xdc3c, dwReserved0=0x2dcc40, dwReserved1=0x18f2bc, cFileName="G7YhK0.flv", cAlternateFileName="")) returned 1 [0167.582] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\G7YhK0.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\g7yhk0.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0167.583] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\G7YhK0.flv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\g7yhk0.flv.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0167.583] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdc3c [0167.583] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0167.584] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0167.669] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xdc3c, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0xdc3c, lpOverlapped=0x0) returned 1 [0167.670] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xdc40, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0xdc40, lpOverlapped=0x0) returned 1 [0167.672] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0167.692] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.701] CloseHandle (hObject=0xec) returned 1 [0167.701] CloseHandle (hObject=0xd8) returned 1 [0167.701] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\G7YhK0.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\g7yhk0.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\G7YhK0.flv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\g7yhk0.flv.dvodltmf")) returned 0 [0167.702] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\G7YhK0.flv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\g7yhk0.flv.dvodltmf")) returned 0x2020 [0167.702] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\G7YhK0.flv", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68333720, ftCreationTime.dwHighDateTime=0x1d4d4d0, ftLastAccessTime.dwLowDateTime=0xf638d930, ftLastAccessTime.dwHighDateTime=0x1d4cf49, ftLastWriteTime.dwLowDateTime=0xf638d930, ftLastWriteTime.dwHighDateTime=0x1d4cf49, nFileSizeHigh=0x0, nFileSizeLow=0xdc3c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="G7YhK0.flv", cAlternateFileName="")) returned 0x2e8458 [0167.702] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68333720, ftCreationTime.dwHighDateTime=0x1d4d4d0, ftLastAccessTime.dwLowDateTime=0xf638d930, ftLastAccessTime.dwHighDateTime=0x1d4cf49, ftLastWriteTime.dwLowDateTime=0xf638d930, ftLastWriteTime.dwHighDateTime=0x1d4cf49, nFileSizeHigh=0x0, nFileSizeLow=0xdc3c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="G7YhK0.flv", cAlternateFileName="")) returned 0 [0167.702] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0167.702] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\G7YhK0.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\g7yhk0.flv")) returned 1 [0167.704] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\G7YhK0.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\g7yhk0.flv")) returned 0xffffffff [0167.704] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7519bfb0, ftCreationTime.dwHighDateTime=0x1d4c6e1, ftLastAccessTime.dwLowDateTime=0x9bf8e5b0, ftLastAccessTime.dwHighDateTime=0x1d4c994, ftLastWriteTime.dwLowDateTime=0x9bf8e5b0, ftLastWriteTime.dwHighDateTime=0x1d4c994, nFileSizeHigh=0x0, nFileSizeLow=0xc6b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GfDzp92iXD6WQ.wav", cAlternateFileName="GFDZP9~1.WAV")) returned 1 [0167.704] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GfDzp92iXD6WQ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\gfdzp92ixd6wq.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0167.704] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GfDzp92iXD6WQ.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\gfdzp92ixd6wq.wav.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0167.705] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc6b0 [0167.705] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0167.705] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0167.854] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xc6b0, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0xc6b0, lpOverlapped=0x0) returned 1 [0167.856] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc6c0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0xc6c0, lpOverlapped=0x0) returned 1 [0167.857] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0167.877] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.886] CloseHandle (hObject=0xd8) returned 1 [0167.886] CloseHandle (hObject=0xec) returned 1 [0167.887] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GfDzp92iXD6WQ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\gfdzp92ixd6wq.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GfDzp92iXD6WQ.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\gfdzp92ixd6wq.wav.dvodltmf")) returned 0 [0167.888] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GfDzp92iXD6WQ.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\gfdzp92ixd6wq.wav.dvodltmf")) returned 0x2020 [0167.888] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GfDzp92iXD6WQ.wav", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7519bfb0, ftCreationTime.dwHighDateTime=0x1d4c6e1, ftLastAccessTime.dwLowDateTime=0x9bf8e5b0, ftLastAccessTime.dwHighDateTime=0x1d4c994, ftLastWriteTime.dwLowDateTime=0x9bf8e5b0, ftLastWriteTime.dwHighDateTime=0x1d4c994, nFileSizeHigh=0x0, nFileSizeLow=0xc6b0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="GfDzp92iXD6WQ.wav", cAlternateFileName="GFDZP9~1.WAV")) returned 0x2e8458 [0167.888] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7519bfb0, ftCreationTime.dwHighDateTime=0x1d4c6e1, ftLastAccessTime.dwLowDateTime=0x9bf8e5b0, ftLastAccessTime.dwHighDateTime=0x1d4c994, ftLastWriteTime.dwLowDateTime=0x9bf8e5b0, ftLastWriteTime.dwHighDateTime=0x1d4c994, nFileSizeHigh=0x0, nFileSizeLow=0xc6b0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="GfDzp92iXD6WQ.wav", cAlternateFileName="GFDZP9~1.WAV")) returned 0 [0167.888] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0167.888] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GfDzp92iXD6WQ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\gfdzp92ixd6wq.wav")) returned 1 [0167.889] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GfDzp92iXD6WQ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\gfdzp92ixd6wq.wav")) returned 0xffffffff [0167.889] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7be92d60, ftCreationTime.dwHighDateTime=0x1d4d3fe, ftLastAccessTime.dwLowDateTime=0xaf7b55c0, ftLastAccessTime.dwHighDateTime=0x1d4cb68, ftLastWriteTime.dwLowDateTime=0xaf7b55c0, ftLastWriteTime.dwHighDateTime=0x1d4cb68, nFileSizeHigh=0x0, nFileSizeLow=0x15632, dwReserved0=0x2dcc40, dwReserved1=0x18f2bc, cFileName="GRi2f2B.png", cAlternateFileName="")) returned 1 [0167.889] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GRi2f2B.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\gri2f2b.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0167.889] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GRi2f2B.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\gri2f2b.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0167.890] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15632 [0167.890] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0167.890] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0167.975] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x15632, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x15632, lpOverlapped=0x0) returned 1 [0167.977] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x15640, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x15640, lpOverlapped=0x0) returned 1 [0167.979] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0167.998] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.008] CloseHandle (hObject=0xec) returned 1 [0168.008] CloseHandle (hObject=0xd8) returned 1 [0168.008] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GRi2f2B.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\gri2f2b.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GRi2f2B.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\gri2f2b.png.dvodltmf")) returned 0 [0168.009] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GRi2f2B.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\gri2f2b.png.dvodltmf")) returned 0x2020 [0168.009] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GRi2f2B.png", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7be92d60, ftCreationTime.dwHighDateTime=0x1d4d3fe, ftLastAccessTime.dwLowDateTime=0xaf7b55c0, ftLastAccessTime.dwHighDateTime=0x1d4cb68, ftLastWriteTime.dwLowDateTime=0xaf7b55c0, ftLastWriteTime.dwHighDateTime=0x1d4cb68, nFileSizeHigh=0x0, nFileSizeLow=0x15632, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="GRi2f2B.png", cAlternateFileName="")) returned 0x2e8458 [0168.009] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7be92d60, ftCreationTime.dwHighDateTime=0x1d4d3fe, ftLastAccessTime.dwLowDateTime=0xaf7b55c0, ftLastAccessTime.dwHighDateTime=0x1d4cb68, ftLastWriteTime.dwLowDateTime=0xaf7b55c0, ftLastWriteTime.dwHighDateTime=0x1d4cb68, nFileSizeHigh=0x0, nFileSizeLow=0x15632, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="GRi2f2B.png", cAlternateFileName="")) returned 0 [0168.009] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0168.009] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GRi2f2B.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\gri2f2b.png")) returned 1 [0168.011] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GRi2f2B.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\gri2f2b.png")) returned 0xffffffff [0168.011] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd415420, ftCreationTime.dwHighDateTime=0x1d4ced8, ftLastAccessTime.dwLowDateTime=0x7f3768b0, ftLastAccessTime.dwHighDateTime=0x1d4d327, ftLastWriteTime.dwLowDateTime=0x7f3768b0, ftLastWriteTime.dwHighDateTime=0x1d4d327, nFileSizeHigh=0x0, nFileSizeLow=0x112db, dwReserved0=0x0, dwReserved1=0x0, cFileName="H-oJwzS7skFLNMo2rf6.swf", cAlternateFileName="H-OJWZ~1.SWF")) returned 1 [0168.011] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\H-oJwzS7skFLNMo2rf6.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\h-ojwzs7skflnmo2rf6.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0168.011] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\H-oJwzS7skFLNMo2rf6.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\h-ojwzs7skflnmo2rf6.swf.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0168.012] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x112db [0168.012] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0168.012] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0168.098] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x112db, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x112db, lpOverlapped=0x0) returned 1 [0168.099] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x112e0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x112e0, lpOverlapped=0x0) returned 1 [0168.101] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0168.121] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.130] CloseHandle (hObject=0xd8) returned 1 [0168.130] CloseHandle (hObject=0xec) returned 1 [0168.131] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\H-oJwzS7skFLNMo2rf6.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\h-ojwzs7skflnmo2rf6.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\H-oJwzS7skFLNMo2rf6.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\h-ojwzs7skflnmo2rf6.swf.dvodltmf")) returned 0 [0168.132] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\H-oJwzS7skFLNMo2rf6.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\h-ojwzs7skflnmo2rf6.swf.dvodltmf")) returned 0x2020 [0168.132] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\H-oJwzS7skFLNMo2rf6.swf", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd415420, ftCreationTime.dwHighDateTime=0x1d4ced8, ftLastAccessTime.dwLowDateTime=0x7f3768b0, ftLastAccessTime.dwHighDateTime=0x1d4d327, ftLastWriteTime.dwLowDateTime=0x7f3768b0, ftLastWriteTime.dwHighDateTime=0x1d4d327, nFileSizeHigh=0x0, nFileSizeLow=0x112db, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="H-oJwzS7skFLNMo2rf6.swf", cAlternateFileName="H-OJWZ~1.SWF")) returned 0x2e8458 [0168.132] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd415420, ftCreationTime.dwHighDateTime=0x1d4ced8, ftLastAccessTime.dwLowDateTime=0x7f3768b0, ftLastAccessTime.dwHighDateTime=0x1d4d327, ftLastWriteTime.dwLowDateTime=0x7f3768b0, ftLastWriteTime.dwHighDateTime=0x1d4d327, nFileSizeHigh=0x0, nFileSizeLow=0x112db, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="H-oJwzS7skFLNMo2rf6.swf", cAlternateFileName="H-OJWZ~1.SWF")) returned 0 [0168.132] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0168.132] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\H-oJwzS7skFLNMo2rf6.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\h-ojwzs7skflnmo2rf6.swf")) returned 1 [0168.133] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\H-oJwzS7skFLNMo2rf6.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\h-ojwzs7skflnmo2rf6.swf")) returned 0xffffffff [0168.133] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc69f1670, ftCreationTime.dwHighDateTime=0x1d4d3f5, ftLastAccessTime.dwLowDateTime=0x2b53e4f0, ftLastAccessTime.dwHighDateTime=0x1d4cdda, ftLastWriteTime.dwLowDateTime=0x2b53e4f0, ftLastWriteTime.dwHighDateTime=0x1d4cdda, nFileSizeHigh=0x0, nFileSizeLow=0x4598, dwReserved0=0x0, dwReserved1=0x0, cFileName="hc-KXgJw2Et2pub.mp3", cAlternateFileName="HC-KXG~1.MP3")) returned 1 [0168.133] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hc-KXgJw2Et2pub.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hc-kxgjw2et2pub.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0168.133] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hc-KXgJw2Et2pub.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hc-kxgjw2et2pub.mp3.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0168.134] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4598 [0168.134] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0168.135] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0168.219] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4598, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x4598, lpOverlapped=0x0) returned 1 [0168.220] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x45a0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x45a0, lpOverlapped=0x0) returned 1 [0168.221] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0168.242] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.251] CloseHandle (hObject=0xec) returned 1 [0168.251] CloseHandle (hObject=0xd8) returned 1 [0168.252] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hc-KXgJw2Et2pub.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hc-kxgjw2et2pub.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hc-KXgJw2Et2pub.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hc-kxgjw2et2pub.mp3.dvodltmf")) returned 0 [0168.252] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hc-KXgJw2Et2pub.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hc-kxgjw2et2pub.mp3.dvodltmf")) returned 0x2020 [0168.252] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hc-KXgJw2Et2pub.mp3", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc69f1670, ftCreationTime.dwHighDateTime=0x1d4d3f5, ftLastAccessTime.dwLowDateTime=0x2b53e4f0, ftLastAccessTime.dwHighDateTime=0x1d4cdda, ftLastWriteTime.dwLowDateTime=0x2b53e4f0, ftLastWriteTime.dwHighDateTime=0x1d4cdda, nFileSizeHigh=0x0, nFileSizeLow=0x4598, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="hc-KXgJw2Et2pub.mp3", cAlternateFileName="HC-KXG~1.MP3")) returned 0x2e8458 [0168.253] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc69f1670, ftCreationTime.dwHighDateTime=0x1d4d3f5, ftLastAccessTime.dwLowDateTime=0x2b53e4f0, ftLastAccessTime.dwHighDateTime=0x1d4cdda, ftLastWriteTime.dwLowDateTime=0x2b53e4f0, ftLastWriteTime.dwHighDateTime=0x1d4cdda, nFileSizeHigh=0x0, nFileSizeLow=0x4598, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="hc-KXgJw2Et2pub.mp3", cAlternateFileName="HC-KXG~1.MP3")) returned 0 [0168.253] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0168.253] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hc-KXgJw2Et2pub.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hc-kxgjw2et2pub.mp3")) returned 1 [0168.254] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hc-KXgJw2Et2pub.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hc-kxgjw2et2pub.mp3")) returned 0xffffffff [0168.254] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18f2bc, cFileName="Identities", cAlternateFileName="IDENTI~1")) returned 1 [0168.254] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x82, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0168.254] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x82, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.254] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x82, dwReserved1=0x0, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 1 [0168.254] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x620075, dwReserved1=0x6d002e, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0168.255] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x620075, dwReserved1=0x6d002e, cFileName="..", cAlternateFileName="")) returned 1 [0168.255] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x620075, dwReserved1=0x6d002e, cFileName="..", cAlternateFileName="")) returned 0 [0168.255] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0168.255] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x82, dwReserved1=0x0, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 0 [0168.255] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0168.255] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6b37d50, ftCreationTime.dwHighDateTime=0x1d4c77b, ftLastAccessTime.dwLowDateTime=0x71d8e120, ftLastAccessTime.dwHighDateTime=0x1d4c7d4, ftLastWriteTime.dwLowDateTime=0x71d8e120, ftLastWriteTime.dwHighDateTime=0x1d4c7d4, nFileSizeHigh=0x0, nFileSizeLow=0x81a3, dwReserved0=0x2d333244, dwReserved1=0x45434334, cFileName="JFK7jllt9PurimGs.avi", cAlternateFileName="JFK7JL~1.AVI")) returned 1 [0168.255] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JFK7jllt9PurimGs.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jfk7jllt9purimgs.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0168.255] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JFK7jllt9PurimGs.avi.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jfk7jllt9purimgs.avi.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0168.256] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x81a3 [0168.256] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0168.256] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0168.344] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x81a3, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x81a3, lpOverlapped=0x0) returned 1 [0168.345] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x81b0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x81b0, lpOverlapped=0x0) returned 1 [0168.347] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0168.371] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.381] CloseHandle (hObject=0xd8) returned 1 [0168.381] CloseHandle (hObject=0xec) returned 1 [0168.381] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JFK7jllt9PurimGs.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jfk7jllt9purimgs.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JFK7jllt9PurimGs.avi.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jfk7jllt9purimgs.avi.dvodltmf")) returned 0 [0168.382] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JFK7jllt9PurimGs.avi.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jfk7jllt9purimgs.avi.dvodltmf")) returned 0x2020 [0168.382] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JFK7jllt9PurimGs.avi", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6b37d50, ftCreationTime.dwHighDateTime=0x1d4c77b, ftLastAccessTime.dwLowDateTime=0x71d8e120, ftLastAccessTime.dwHighDateTime=0x1d4c7d4, ftLastWriteTime.dwLowDateTime=0x71d8e120, ftLastWriteTime.dwHighDateTime=0x1d4c7d4, nFileSizeHigh=0x0, nFileSizeLow=0x81a3, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="JFK7jllt9PurimGs.avi", cAlternateFileName="JFK7JL~1.AVI")) returned 0x2e8458 [0168.382] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6b37d50, ftCreationTime.dwHighDateTime=0x1d4c77b, ftLastAccessTime.dwLowDateTime=0x71d8e120, ftLastAccessTime.dwHighDateTime=0x1d4c7d4, ftLastWriteTime.dwLowDateTime=0x71d8e120, ftLastWriteTime.dwHighDateTime=0x1d4c7d4, nFileSizeHigh=0x0, nFileSizeLow=0x81a3, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="JFK7jllt9PurimGs.avi", cAlternateFileName="JFK7JL~1.AVI")) returned 0 [0168.382] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0168.383] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JFK7jllt9PurimGs.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jfk7jllt9purimgs.avi")) returned 1 [0168.384] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JFK7jllt9PurimGs.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jfk7jllt9purimgs.avi")) returned 0xffffffff [0168.384] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf9a1010, ftCreationTime.dwHighDateTime=0x1d4c9dc, ftLastAccessTime.dwLowDateTime=0x5ecefdb0, ftLastAccessTime.dwHighDateTime=0x1d4c7c7, ftLastWriteTime.dwLowDateTime=0x5ecefdb0, ftLastWriteTime.dwHighDateTime=0x1d4c7c7, nFileSizeHigh=0x0, nFileSizeLow=0x17f1d, dwReserved0=0x2dcc40, dwReserved1=0x18f2bc, cFileName="JgRzD.wav", cAlternateFileName="")) returned 1 [0168.384] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JgRzD.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jgrzd.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0168.384] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JgRzD.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jgrzd.wav.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0168.385] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17f1d [0168.385] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0168.385] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0168.473] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x17f1d, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x17f1d, lpOverlapped=0x0) returned 1 [0168.475] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x17f20, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x17f20, lpOverlapped=0x0) returned 1 [0168.478] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0168.497] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.507] CloseHandle (hObject=0xec) returned 1 [0168.507] CloseHandle (hObject=0xd8) returned 1 [0168.507] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JgRzD.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jgrzd.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JgRzD.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jgrzd.wav.dvodltmf")) returned 0 [0168.508] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JgRzD.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jgrzd.wav.dvodltmf")) returned 0x2020 [0168.508] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JgRzD.wav", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf9a1010, ftCreationTime.dwHighDateTime=0x1d4c9dc, ftLastAccessTime.dwLowDateTime=0x5ecefdb0, ftLastAccessTime.dwHighDateTime=0x1d4c7c7, ftLastWriteTime.dwLowDateTime=0x5ecefdb0, ftLastWriteTime.dwHighDateTime=0x1d4c7c7, nFileSizeHigh=0x0, nFileSizeLow=0x17f1d, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="JgRzD.wav", cAlternateFileName="")) returned 0x2e8458 [0168.508] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf9a1010, ftCreationTime.dwHighDateTime=0x1d4c9dc, ftLastAccessTime.dwLowDateTime=0x5ecefdb0, ftLastAccessTime.dwHighDateTime=0x1d4c7c7, ftLastWriteTime.dwLowDateTime=0x5ecefdb0, ftLastWriteTime.dwHighDateTime=0x1d4c7c7, nFileSizeHigh=0x0, nFileSizeLow=0x17f1d, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="JgRzD.wav", cAlternateFileName="")) returned 0 [0168.508] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0168.508] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JgRzD.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jgrzd.wav")) returned 1 [0168.510] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JgRzD.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jgrzd.wav")) returned 0xffffffff [0168.510] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc44a82f0, ftCreationTime.dwHighDateTime=0x1d4cdb1, ftLastAccessTime.dwLowDateTime=0x24a9a610, ftLastAccessTime.dwHighDateTime=0x1d4d2d2, ftLastWriteTime.dwLowDateTime=0x24a9a610, ftLastWriteTime.dwHighDateTime=0x1d4d2d2, nFileSizeHigh=0x0, nFileSizeLow=0x17fdd, dwReserved0=0x2dcc40, dwReserved1=0x18f2bc, cFileName="JIna1kc.wav", cAlternateFileName="")) returned 1 [0168.510] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JIna1kc.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jina1kc.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0168.510] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JIna1kc.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jina1kc.wav.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0168.511] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17fdd [0168.511] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0168.511] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0168.595] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x17fdd, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x17fdd, lpOverlapped=0x0) returned 1 [0168.597] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x17fe0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x17fe0, lpOverlapped=0x0) returned 1 [0168.599] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0168.619] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.629] CloseHandle (hObject=0xd8) returned 1 [0168.630] CloseHandle (hObject=0xec) returned 1 [0168.630] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JIna1kc.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jina1kc.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JIna1kc.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jina1kc.wav.dvodltmf")) returned 0 [0168.631] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JIna1kc.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jina1kc.wav.dvodltmf")) returned 0x2020 [0168.631] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JIna1kc.wav", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc44a82f0, ftCreationTime.dwHighDateTime=0x1d4cdb1, ftLastAccessTime.dwLowDateTime=0x24a9a610, ftLastAccessTime.dwHighDateTime=0x1d4d2d2, ftLastWriteTime.dwLowDateTime=0x24a9a610, ftLastWriteTime.dwHighDateTime=0x1d4d2d2, nFileSizeHigh=0x0, nFileSizeLow=0x17fdd, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="JIna1kc.wav", cAlternateFileName="")) returned 0x2e8458 [0168.631] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc44a82f0, ftCreationTime.dwHighDateTime=0x1d4cdb1, ftLastAccessTime.dwLowDateTime=0x24a9a610, ftLastAccessTime.dwHighDateTime=0x1d4d2d2, ftLastWriteTime.dwLowDateTime=0x24a9a610, ftLastWriteTime.dwHighDateTime=0x1d4d2d2, nFileSizeHigh=0x0, nFileSizeLow=0x17fdd, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="JIna1kc.wav", cAlternateFileName="")) returned 0 [0168.631] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0168.631] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JIna1kc.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jina1kc.wav")) returned 1 [0168.632] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JIna1kc.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jina1kc.wav")) returned 0xffffffff [0168.633] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87c41b0, ftCreationTime.dwHighDateTime=0x1d4cccd, ftLastAccessTime.dwLowDateTime=0x679981e0, ftLastAccessTime.dwHighDateTime=0x1d4c5ab, ftLastWriteTime.dwLowDateTime=0x679981e0, ftLastWriteTime.dwHighDateTime=0x1d4c5ab, nFileSizeHigh=0x0, nFileSizeLow=0x70fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="kK MhRV-olEoIQ-ANip.mkv", cAlternateFileName="KKMHRV~1.MKV")) returned 1 [0168.633] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kK MhRV-olEoIQ-ANip.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kk mhrv-oleoiq-anip.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0168.633] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kK MhRV-olEoIQ-ANip.mkv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kk mhrv-oleoiq-anip.mkv.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0168.634] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x70fc [0168.634] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0168.634] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0168.718] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x70fc, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x70fc, lpOverlapped=0x0) returned 1 [0168.719] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x7100, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x7100, lpOverlapped=0x0) returned 1 [0168.720] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0168.740] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.749] CloseHandle (hObject=0xec) returned 1 [0168.750] CloseHandle (hObject=0xd8) returned 1 [0168.750] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kK MhRV-olEoIQ-ANip.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kk mhrv-oleoiq-anip.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kK MhRV-olEoIQ-ANip.mkv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kk mhrv-oleoiq-anip.mkv.dvodltmf")) returned 0 [0168.750] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kK MhRV-olEoIQ-ANip.mkv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kk mhrv-oleoiq-anip.mkv.dvodltmf")) returned 0x2020 [0168.751] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kK MhRV-olEoIQ-ANip.mkv", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87c41b0, ftCreationTime.dwHighDateTime=0x1d4cccd, ftLastAccessTime.dwLowDateTime=0x679981e0, ftLastAccessTime.dwHighDateTime=0x1d4c5ab, ftLastWriteTime.dwLowDateTime=0x679981e0, ftLastWriteTime.dwHighDateTime=0x1d4c5ab, nFileSizeHigh=0x0, nFileSizeLow=0x70fc, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="kK MhRV-olEoIQ-ANip.mkv", cAlternateFileName="KKMHRV~1.MKV")) returned 0x2e8458 [0168.751] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87c41b0, ftCreationTime.dwHighDateTime=0x1d4cccd, ftLastAccessTime.dwLowDateTime=0x679981e0, ftLastAccessTime.dwHighDateTime=0x1d4c5ab, ftLastWriteTime.dwLowDateTime=0x679981e0, ftLastWriteTime.dwHighDateTime=0x1d4c5ab, nFileSizeHigh=0x0, nFileSizeLow=0x70fc, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="kK MhRV-olEoIQ-ANip.mkv", cAlternateFileName="KKMHRV~1.MKV")) returned 0 [0168.751] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0168.751] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kK MhRV-olEoIQ-ANip.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kk mhrv-oleoiq-anip.mkv")) returned 1 [0168.752] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kK MhRV-olEoIQ-ANip.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kk mhrv-oleoiq-anip.mkv")) returned 0xffffffff [0168.752] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf20a55f0, ftCreationTime.dwHighDateTime=0x1d4c94f, ftLastAccessTime.dwLowDateTime=0xbda13360, ftLastAccessTime.dwHighDateTime=0x1d4ce54, ftLastWriteTime.dwLowDateTime=0xbda13360, ftLastWriteTime.dwHighDateTime=0x1d4ce54, nFileSizeHigh=0x0, nFileSizeLow=0x7a15, dwReserved0=0x0, dwReserved1=0x0, cFileName="KyrvrhyccyQpbgNDeD.swf", cAlternateFileName="KYRVRH~1.SWF")) returned 1 [0168.752] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KyrvrhyccyQpbgNDeD.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kyrvrhyccyqpbgnded.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0168.752] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KyrvrhyccyQpbgNDeD.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kyrvrhyccyqpbgnded.swf.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0168.753] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7a15 [0168.753] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0168.753] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0168.846] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x7a15, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x7a15, lpOverlapped=0x0) returned 1 [0168.847] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x7a20, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x7a20, lpOverlapped=0x0) returned 1 [0168.849] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0168.869] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.879] CloseHandle (hObject=0xd8) returned 1 [0168.879] CloseHandle (hObject=0xec) returned 1 [0168.879] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KyrvrhyccyQpbgNDeD.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kyrvrhyccyqpbgnded.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KyrvrhyccyQpbgNDeD.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kyrvrhyccyqpbgnded.swf.dvodltmf")) returned 0 [0168.880] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KyrvrhyccyQpbgNDeD.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kyrvrhyccyqpbgnded.swf.dvodltmf")) returned 0x2020 [0168.880] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KyrvrhyccyQpbgNDeD.swf", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf20a55f0, ftCreationTime.dwHighDateTime=0x1d4c94f, ftLastAccessTime.dwLowDateTime=0xbda13360, ftLastAccessTime.dwHighDateTime=0x1d4ce54, ftLastWriteTime.dwLowDateTime=0xbda13360, ftLastWriteTime.dwHighDateTime=0x1d4ce54, nFileSizeHigh=0x0, nFileSizeLow=0x7a15, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="KyrvrhyccyQpbgNDeD.swf", cAlternateFileName="KYRVRH~1.SWF")) returned 0x2e8458 [0168.880] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf20a55f0, ftCreationTime.dwHighDateTime=0x1d4c94f, ftLastAccessTime.dwLowDateTime=0xbda13360, ftLastAccessTime.dwHighDateTime=0x1d4ce54, ftLastWriteTime.dwLowDateTime=0xbda13360, ftLastWriteTime.dwHighDateTime=0x1d4ce54, nFileSizeHigh=0x0, nFileSizeLow=0x7a15, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="KyrvrhyccyQpbgNDeD.swf", cAlternateFileName="KYRVRH~1.SWF")) returned 0 [0168.880] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0168.880] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KyrvrhyccyQpbgNDeD.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kyrvrhyccyqpbgnded.swf")) returned 1 [0168.881] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KyrvrhyccyQpbgNDeD.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kyrvrhyccyqpbgnded.swf")) returned 0xffffffff [0168.881] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfce25fc0, ftCreationTime.dwHighDateTime=0x1d4cc49, ftLastAccessTime.dwLowDateTime=0x9fb49e40, ftLastAccessTime.dwHighDateTime=0x1d4ceaf, ftLastWriteTime.dwLowDateTime=0x9fb49e40, ftLastWriteTime.dwHighDateTime=0x1d4ceaf, nFileSizeHigh=0x0, nFileSizeLow=0x124f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="lu2yOzJ.m4a", cAlternateFileName="")) returned 1 [0168.881] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lu2yOzJ.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\lu2yozj.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0168.881] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lu2yOzJ.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\lu2yozj.m4a.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0168.882] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x124f7 [0168.882] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0168.883] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0168.967] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x124f7, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x124f7, lpOverlapped=0x0) returned 1 [0168.969] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x12500, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x12500, lpOverlapped=0x0) returned 1 [0168.971] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0168.991] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.000] CloseHandle (hObject=0xec) returned 1 [0169.000] CloseHandle (hObject=0xd8) returned 1 [0169.000] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lu2yOzJ.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\lu2yozj.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lu2yOzJ.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\lu2yozj.m4a.dvodltmf")) returned 0 [0169.001] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lu2yOzJ.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\lu2yozj.m4a.dvodltmf")) returned 0x2020 [0169.001] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lu2yOzJ.m4a", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfce25fc0, ftCreationTime.dwHighDateTime=0x1d4cc49, ftLastAccessTime.dwLowDateTime=0x9fb49e40, ftLastAccessTime.dwHighDateTime=0x1d4ceaf, ftLastWriteTime.dwLowDateTime=0x9fb49e40, ftLastWriteTime.dwHighDateTime=0x1d4ceaf, nFileSizeHigh=0x0, nFileSizeLow=0x124f7, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="lu2yOzJ.m4a", cAlternateFileName="")) returned 0x2e8458 [0169.002] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfce25fc0, ftCreationTime.dwHighDateTime=0x1d4cc49, ftLastAccessTime.dwLowDateTime=0x9fb49e40, ftLastAccessTime.dwHighDateTime=0x1d4ceaf, ftLastWriteTime.dwLowDateTime=0x9fb49e40, ftLastWriteTime.dwHighDateTime=0x1d4ceaf, nFileSizeHigh=0x0, nFileSizeLow=0x124f7, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="lu2yOzJ.m4a", cAlternateFileName="")) returned 0 [0169.002] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0169.002] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lu2yOzJ.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\lu2yozj.m4a")) returned 1 [0169.003] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lu2yOzJ.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\lu2yozj.m4a")) returned 0xffffffff [0169.003] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Macromedia", cAlternateFileName="MACROM~1")) returned 1 [0169.003] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0169.003] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.004] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0169.004] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4e0067, dwReserved1=0x650044, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0169.004] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4e0067, dwReserved1=0x650044, cFileName="..", cAlternateFileName="")) returned 1 [0169.004] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4e0067, dwReserved1=0x650044, cFileName="#SharedObjects", cAlternateFileName="#SHARE~1")) returned 1 [0169.004] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0169.005] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.005] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="P7Y3F7QB", cAlternateFileName="")) returned 1 [0169.005] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0169.006] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.006] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0169.006] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0169.006] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="P7Y3F7QB", cAlternateFileName="")) returned 0 [0169.006] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0169.006] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4e0067, dwReserved1=0x650044, cFileName="macromedia.com", cAlternateFileName="MACROM~1.COM")) returned 1 [0169.006] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0169.006] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.006] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="support", cAlternateFileName="")) returned 1 [0169.006] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0169.006] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.006] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="flashplayer", cAlternateFileName="FLASHP~1")) returned 1 [0169.006] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0169.007] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.007] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sys", cAlternateFileName="")) returned 1 [0169.007] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8598 [0169.007] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.008] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.sol", cAlternateFileName="")) returned 1 [0169.008] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0169.008] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0169.009] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d6 [0169.009] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0169.009] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0169.094] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1d6, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x1d6, lpOverlapped=0x0) returned 1 [0169.095] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x1e0, lpOverlapped=0x0) returned 1 [0169.096] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0169.116] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.125] CloseHandle (hObject=0xe8) returned 1 [0169.125] CloseHandle (hObject=0xe0) returned 1 [0169.126] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol.dvodltmf")) returned 0 [0169.126] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol.dvodltmf")) returned 0x2020 [0169.126] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1d6, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="settings.sol", cAlternateFileName="")) returned 0x2e85d8 [0169.127] FindNextFileA (in: hFindFile=0x2e85d8, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1d6, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="settings.sol", cAlternateFileName="")) returned 0 [0169.127] FindClose (in: hFindFile=0x2e85d8 | out: hFindFile=0x2e85d8) returned 1 [0169.127] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol")) returned 1 [0169.128] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol")) returned 0xffffffff [0169.128] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.sol", cAlternateFileName="")) returned 0 [0169.128] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0169.128] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sys", cAlternateFileName="")) returned 0 [0169.128] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0169.128] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="flashplayer", cAlternateFileName="FLASHP~1")) returned 0 [0169.128] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0169.128] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="support", cAlternateFileName="")) returned 0 [0169.128] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0169.128] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4e0067, dwReserved1=0x650044, cFileName="macromedia.com", cAlternateFileName="MACROM~1.COM")) returned 0 [0169.128] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0169.128] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 0 [0169.128] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0169.128] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0169.128] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f63, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0169.129] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f63, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.129] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f63, dwReserved1=0x0, cFileName="AddIns", cAlternateFileName="")) returned 1 [0169.129] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4e0067, dwReserved1=0x650044, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0169.130] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4e0067, dwReserved1=0x650044, cFileName="..", cAlternateFileName="")) returned 1 [0169.130] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4e0067, dwReserved1=0x650044, cFileName="..", cAlternateFileName="")) returned 0 [0169.130] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0169.130] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f63, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0169.130] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4e0067, dwReserved1=0x650044, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0169.130] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4e0067, dwReserved1=0x650044, cFileName="..", cAlternateFileName="")) returned 1 [0169.130] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4e0067, dwReserved1=0x650044, cFileName="..", cAlternateFileName="")) returned 0 [0169.130] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0169.130] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f63, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1 [0169.130] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4e0067, dwReserved1=0x650044, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0169.131] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4e0067, dwReserved1=0x650044, cFileName="..", cAlternateFileName="")) returned 1 [0169.131] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4e0067, dwReserved1=0x650044, cFileName="RSA", cAlternateFileName="")) returned 1 [0169.131] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0169.131] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.131] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0169.131] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0169.133] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.133] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xa1e34990, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="83AA4C~1")) returned 1 [0169.133] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x57, dwReserved0=0x0, dwReserved1=0x0, cFileName="932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="932A2D~1")) returned 1 [0169.133] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xb0aa1fc0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0aa1fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0aa1fc0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="FDA992~1")) returned 1 [0169.133] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xb0aa1fc0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0aa1fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0aa1fc0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="FDA992~1")) returned 0 [0169.133] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0169.134] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0169.134] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0169.134] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4e0067, dwReserved1=0x650044, cFileName="RSA", cAlternateFileName="")) returned 0 [0169.134] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0169.134] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f63, dwReserved1=0x0, cFileName="Document Building Blocks", cAlternateFileName="DOCUME~1")) returned 1 [0169.134] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0169.135] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="..", cAlternateFileName="")) returned 1 [0169.135] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="1033", cAlternateFileName="")) returned 1 [0169.135] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37396634, dwReserved1=0x34383465, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0169.135] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37396634, dwReserved1=0x34383465, cFileName="..", cAlternateFileName="")) returned 1 [0169.135] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37396634, dwReserved1=0x34383465, cFileName="14", cAlternateFileName="")) returned 1 [0169.135] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0169.135] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.135] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4e2b7e00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x3fe4ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="Built-In Building Blocks.dotx", cAlternateFileName="BUILT-~1.DOT")) returned 1 [0169.135] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\14\\built-in building blocks.dotx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0169.136] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\14\\built-in building blocks.dotx.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.136] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3fe4ab [0169.136] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0169.137] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0169.222] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3fe4ab, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x3fe4ab, lpOverlapped=0x0) returned 1 [0169.311] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3fe4b0, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x3fe4b0, lpOverlapped=0x0) returned 1 [0169.507] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0169.527] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.536] CloseHandle (hObject=0xf0) returned 1 [0169.536] CloseHandle (hObject=0xdc) returned 1 [0169.536] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\14\\built-in building blocks.dotx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\14\\built-in building blocks.dotx.dvodltmf")) returned 0 [0169.537] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\14\\built-in building blocks.dotx.dvodltmf")) returned 0x2020 [0169.537] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4e2b7e00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x3fe4ab, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Built-In Building Blocks.dotx", cAlternateFileName="BUILT-~1.DOT")) returned 0x2e8558 [0169.537] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4e2b7e00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x3fe4ab, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Built-In Building Blocks.dotx", cAlternateFileName="BUILT-~1.DOT")) returned 0 [0169.537] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0169.537] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\14\\built-in building blocks.dotx")) returned 1 [0169.546] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\14\\built-in building blocks.dotx")) returned 0xffffffff [0169.546] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4e2b7e00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x3fe4ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="Built-In Building Blocks.dotx", cAlternateFileName="BUILT-~1.DOT")) returned 0 [0169.546] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0169.546] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37396634, dwReserved1=0x34383465, cFileName="14", cAlternateFileName="")) returned 0 [0169.546] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0169.546] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="1033", cAlternateFileName="")) returned 0 [0169.546] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0169.546] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1e0470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f63, dwReserved1=0x0, cFileName="Excel", cAlternateFileName="")) returned 1 [0169.546] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1e0470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0169.547] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1e0470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="..", cAlternateFileName="")) returned 1 [0169.547] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="XLSTART", cAlternateFileName="")) returned 1 [0169.547] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69646c69, dwReserved1=0x4220676e, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0169.547] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69646c69, dwReserved1=0x4220676e, cFileName="..", cAlternateFileName="")) returned 1 [0169.547] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69646c69, dwReserved1=0x4220676e, cFileName="..", cAlternateFileName="")) returned 0 [0169.547] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0169.547] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="XLSTART", cAlternateFileName="")) returned 0 [0169.547] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0169.547] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f63, dwReserved1=0x0, cFileName="IME12", cAlternateFileName="")) returned 1 [0169.547] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0169.548] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="..", cAlternateFileName="")) returned 1 [0169.548] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="..", cAlternateFileName="")) returned 0 [0169.548] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0169.548] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f63, dwReserved1=0x0, cFileName="IMJP12", cAlternateFileName="")) returned 1 [0169.548] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0169.548] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="..", cAlternateFileName="")) returned 1 [0169.548] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="..", cAlternateFileName="")) returned 0 [0169.549] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0169.549] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f63, dwReserved1=0x0, cFileName="IMJP8_1", cAlternateFileName="")) returned 1 [0169.549] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0169.549] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="..", cAlternateFileName="")) returned 1 [0169.549] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="..", cAlternateFileName="")) returned 0 [0169.549] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0169.551] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f63, dwReserved1=0x0, cFileName="IMJP9_0", cAlternateFileName="")) returned 1 [0169.551] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0169.551] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="..", cAlternateFileName="")) returned 1 [0169.551] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="..", cAlternateFileName="")) returned 0 [0169.552] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0169.552] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f63, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0169.552] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0169.552] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="..", cAlternateFileName="")) returned 1 [0169.552] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbda554a0, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbda554a0, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="Quick Launch", cAlternateFileName="QUICKL~1")) returned 1 [0169.552] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbda554a0, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbda554a0, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69646c69, dwReserved1=0x4220676e, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0169.552] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbda554a0, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbda554a0, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69646c69, dwReserved1=0x4220676e, cFileName="..", cAlternateFileName="")) returned 1 [0169.552] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4eb35ad0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x69646c69, dwReserved1=0x4220676e, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0169.552] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0169.552] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.553] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0169.553] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0169.554] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0169.637] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xdd, lpOverlapped=0x0) returned 1 [0169.638] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xe0, lpOverlapped=0x0) returned 1 [0169.639] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0169.658] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.668] CloseHandle (hObject=0xe4) returned 1 [0169.668] CloseHandle (hObject=0xdc) returned 1 [0169.668] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini.dvodltmf")) returned 0 [0169.669] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini.dvodltmf")) returned 0x20 [0169.669] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4eb35ad0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8518 [0169.669] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4eb35ad0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0169.669] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0169.669] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini")) returned 1 [0169.670] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini")) returned 0xffffffff [0169.670] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df47e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df47e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3a683760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x8e9, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0169.670] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.671] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0169.672] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8e9 [0169.672] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0169.672] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0169.755] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x8e9, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x8e9, lpOverlapped=0x0) returned 1 [0169.757] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x8f0, lpOverlapped=0x0) returned 1 [0169.758] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0169.777] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.797] CloseHandle (hObject=0xdc) returned 1 [0169.797] CloseHandle (hObject=0xe4) returned 1 [0169.797] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk.dvodltmf")) returned 0 [0169.798] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk.dvodltmf")) returned 0x20 [0169.798] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df47e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df47e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3a683760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x8e9, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 0x2e8518 [0169.798] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df47e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df47e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3a683760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x8e9, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 0 [0169.798] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0169.798] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk")) returned 1 [0169.799] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk")) returned 0xffffffff [0169.799] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eb0f970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4eb0f970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4eb0f970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5a7, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Launch Internet Explorer Browser.lnk", cAlternateFileName="LAUNCH~1.LNK")) returned 1 [0169.799] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0169.799] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.804] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5a7 [0169.804] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0169.804] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0169.897] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x5a7, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x5a7, lpOverlapped=0x0) returned 1 [0169.900] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x5b0, lpOverlapped=0x0) returned 1 [0169.901] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0169.921] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.931] CloseHandle (hObject=0xe4) returned 1 [0169.931] CloseHandle (hObject=0xdc) returned 1 [0169.931] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk.dvodltmf")) returned 0 [0169.932] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk.dvodltmf")) returned 0x20 [0169.932] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eb0f970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4eb0f970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4eb0f970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5a7, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Launch Internet Explorer Browser.lnk", cAlternateFileName="LAUNCH~1.LNK")) returned 0x2e8518 [0169.932] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eb0f970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4eb0f970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4eb0f970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5a7, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Launch Internet Explorer Browser.lnk", cAlternateFileName="LAUNCH~1.LNK")) returned 0 [0169.932] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0169.932] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk")) returned 1 [0169.933] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk")) returned 0xffffffff [0169.933] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e11d030, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Shows Desktop.lnk", cAlternateFileName="SHOWSD~1.LNK")) returned 1 [0169.933] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0169.934] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0169.934] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x122 [0169.935] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0169.935] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0170.019] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x122, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x122, lpOverlapped=0x0) returned 1 [0170.020] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x130, lpOverlapped=0x0) returned 1 [0170.021] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0170.040] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.049] CloseHandle (hObject=0xdc) returned 1 [0170.049] CloseHandle (hObject=0xe4) returned 1 [0170.050] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.dvodltmf")) returned 0 [0170.051] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.dvodltmf")) returned 0x20 [0170.051] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e11d030, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Shows Desktop.lnk", cAlternateFileName="SHOWSD~1.LNK")) returned 0x2e8518 [0170.051] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e11d030, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Shows Desktop.lnk", cAlternateFileName="SHOWSD~1.LNK")) returned 0 [0170.051] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0170.051] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk")) returned 1 [0170.052] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk")) returned 0xffffffff [0170.052] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="User Pinned", cAlternateFileName="USERPI~1")) returned 1 [0170.052] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0170.052] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.052] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd0, dwReserved1=0x0, cFileName="ImplicitAppShortcuts", cAlternateFileName="IMPLIC~1")) returned 1 [0170.052] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c002e, dwReserved1=0x6b006e, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0170.053] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c002e, dwReserved1=0x6b006e, cFileName="..", cAlternateFileName="")) returned 1 [0170.053] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c002e, dwReserved1=0x6b006e, cFileName="..", cAlternateFileName="")) returned 0 [0170.053] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0170.053] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd0, dwReserved1=0x0, cFileName="TaskBar", cAlternateFileName="")) returned 1 [0170.053] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c002e, dwReserved1=0x6b006e, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0170.053] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c002e, dwReserved1=0x6b006e, cFileName="..", cAlternateFileName="")) returned 1 [0170.053] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc4b320, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x6c002e, dwReserved1=0x6b006e, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0170.053] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0170.053] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0170.055] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19c [0170.055] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0170.055] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0170.138] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x19c, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x19c, lpOverlapped=0x0) returned 1 [0170.139] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x1a0, lpOverlapped=0x0) returned 1 [0170.140] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0170.159] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.168] CloseHandle (hObject=0xf0) returned 1 [0170.168] CloseHandle (hObject=0xe0) returned 1 [0170.169] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini.dvodltmf")) returned 0 [0170.170] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini.dvodltmf")) returned 0x20 [0170.170] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc4b320, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8598 [0170.170] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc4b320, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0170.170] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0170.170] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini")) returned 1 [0170.172] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini")) returned 0xffffffff [0170.172] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e02c640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e02c640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df47e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8dd, dwReserved0=0x2dcc40, dwReserved1=0x18e6b4, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0170.172] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0170.172] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0170.173] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8dd [0170.173] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0170.174] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0170.259] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x8dd, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x8dd, lpOverlapped=0x0) returned 1 [0170.259] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x8e0, lpOverlapped=0x0) returned 1 [0170.260] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0170.298] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.308] CloseHandle (hObject=0xe0) returned 1 [0170.308] CloseHandle (hObject=0xf0) returned 1 [0170.309] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk.dvodltmf")) returned 0 [0170.310] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk.dvodltmf")) returned 0x20 [0170.310] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e02c640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e02c640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df47e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8dd, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 0x2e8598 [0170.310] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e02c640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e02c640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df47e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8dd, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 0 [0170.310] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0170.310] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk")) returned 1 [0170.312] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk")) returned 0xffffffff [0170.312] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc251c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc251c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x2dcc40, dwReserved1=0x18e6b4, cFileName="Internet Explorer (2).lnk", cAlternateFileName="INTERN~2.LNK")) returned 1 [0170.312] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0170.312] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0170.314] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5ad [0170.314] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0170.314] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0170.404] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x5ad, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x5ad, lpOverlapped=0x0) returned 1 [0170.405] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x5b0, lpOverlapped=0x0) returned 1 [0170.405] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0170.426] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.435] CloseHandle (hObject=0xf0) returned 1 [0170.435] CloseHandle (hObject=0xe0) returned 1 [0170.436] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk.dvodltmf")) returned 0 [0170.437] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk.dvodltmf")) returned 0x20 [0170.437] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc251c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc251c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Internet Explorer (2).lnk", cAlternateFileName="INTERN~2.LNK")) returned 0x2e8598 [0170.437] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc251c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc251c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Internet Explorer (2).lnk", cAlternateFileName="INTERN~2.LNK")) returned 0 [0170.437] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0170.437] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk")) returned 1 [0170.439] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk")) returned 0xffffffff [0170.439] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x2dcc40, dwReserved1=0x18e6b4, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 1 [0170.439] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0170.440] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0170.441] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5a9 [0170.441] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0170.442] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0170.525] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x5a9, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x5a9, lpOverlapped=0x0) returned 1 [0170.527] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x5b0, lpOverlapped=0x0) returned 1 [0170.528] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0170.547] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.556] CloseHandle (hObject=0xe0) returned 1 [0170.556] CloseHandle (hObject=0xf0) returned 1 [0170.556] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk.dvodltmf")) returned 0 [0170.557] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk.dvodltmf")) returned 0x20 [0170.557] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 0x2e8598 [0170.558] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 0 [0170.558] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0170.558] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk")) returned 1 [0170.559] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk")) returned 0xffffffff [0170.559] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0de7e00, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x491, dwReserved0=0x2dcc40, dwReserved1=0x18e6b4, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1 [0170.559] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0170.559] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0170.560] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x491 [0170.560] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0170.560] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0170.646] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x491, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x491, lpOverlapped=0x0) returned 1 [0170.647] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x4a0, lpOverlapped=0x0) returned 1 [0170.648] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0170.667] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.677] CloseHandle (hObject=0xf0) returned 1 [0170.677] CloseHandle (hObject=0xe0) returned 1 [0170.678] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk.dvodltmf")) returned 0 [0170.678] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk.dvodltmf")) returned 0x20 [0170.678] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0de7e00, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x491, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 0x2e8598 [0170.679] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0de7e00, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x491, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 0 [0170.679] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0170.679] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk")) returned 1 [0170.680] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk")) returned 0xffffffff [0170.681] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc4b320, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc4b320, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x2dcc40, dwReserved1=0x18e6b4, cFileName="Windows Explorer (2).lnk", cAlternateFileName="WINDOW~3.LNK")) returned 1 [0170.681] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0170.681] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0170.682] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4cc [0170.682] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0170.682] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0170.773] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4cc, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x4cc, lpOverlapped=0x0) returned 1 [0170.774] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x4d0, lpOverlapped=0x0) returned 1 [0170.775] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0170.794] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.804] CloseHandle (hObject=0xe0) returned 1 [0170.804] CloseHandle (hObject=0xf0) returned 1 [0170.804] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk.dvodltmf")) returned 0 [0170.805] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk.dvodltmf")) returned 0x20 [0170.805] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc4b320, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc4b320, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Windows Explorer (2).lnk", cAlternateFileName="WINDOW~3.LNK")) returned 0x2e8598 [0170.805] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc4b320, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc4b320, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Windows Explorer (2).lnk", cAlternateFileName="WINDOW~3.LNK")) returned 0 [0170.806] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0170.806] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk")) returned 1 [0170.807] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk")) returned 0xffffffff [0170.807] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x2dcc40, dwReserved1=0x18e6b4, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0170.807] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0170.808] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0170.809] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4cc [0170.810] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0170.810] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0170.904] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4cc, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x4cc, lpOverlapped=0x0) returned 1 [0170.905] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x4d0, lpOverlapped=0x0) returned 1 [0170.906] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0170.926] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.936] CloseHandle (hObject=0xf0) returned 1 [0170.936] CloseHandle (hObject=0xe0) returned 1 [0170.936] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk.dvodltmf")) returned 0 [0170.937] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk.dvodltmf")) returned 0x20 [0170.937] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0x2e8598 [0170.937] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0 [0170.937] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0170.937] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk")) returned 1 [0170.938] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk")) returned 0xffffffff [0170.938] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc4b320, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc4b320, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd869fe87, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x2dcc40, dwReserved1=0x18e6b4, cFileName="Windows Media Player (2).lnk", cAlternateFileName="WINDOW~4.LNK")) returned 1 [0170.938] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0170.938] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0170.940] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x60b [0170.940] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0170.940] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0171.024] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x60b, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x60b, lpOverlapped=0x0) returned 1 [0171.025] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x610, lpOverlapped=0x0) returned 1 [0171.026] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0171.045] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.055] CloseHandle (hObject=0xe0) returned 1 [0171.055] CloseHandle (hObject=0xf0) returned 1 [0171.055] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk.dvodltmf")) returned 0 [0171.056] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk.dvodltmf")) returned 0x20 [0171.056] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc4b320, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc4b320, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd869fe87, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Windows Media Player (2).lnk", cAlternateFileName="WINDOW~4.LNK")) returned 0x2e8598 [0171.057] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc4b320, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc4b320, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd869fe87, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Windows Media Player (2).lnk", cAlternateFileName="WINDOW~4.LNK")) returned 0 [0171.057] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0171.057] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk")) returned 1 [0171.058] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk")) returned 0xffffffff [0171.058] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2e24b3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x2dcc40, dwReserved1=0x18e6b4, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0171.058] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0171.059] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0171.060] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x60b [0171.060] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0171.061] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0171.151] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x60b, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x60b, lpOverlapped=0x0) returned 1 [0171.153] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x610, lpOverlapped=0x0) returned 1 [0171.153] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0171.173] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.182] CloseHandle (hObject=0xf0) returned 1 [0171.182] CloseHandle (hObject=0xe0) returned 1 [0171.183] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk.dvodltmf")) returned 0 [0171.183] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk.dvodltmf")) returned 0x20 [0171.183] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2e24b3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0x2e8598 [0171.184] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2e24b3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0171.184] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0171.184] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk")) returned 1 [0171.185] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk")) returned 0xffffffff [0171.185] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2e24b3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x2dcc40, dwReserved1=0x18e6b4, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0171.185] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0171.185] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd0, dwReserved1=0x0, cFileName="TaskBar", cAlternateFileName="")) returned 0 [0171.185] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0171.185] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e143190, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x726f6853, dwReserved1=0x74756374, cFileName="Window Switcher.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0171.185] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0171.185] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.186] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x110 [0171.186] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0171.187] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0171.272] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x110, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x110, lpOverlapped=0x0) returned 1 [0171.273] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x120, lpOverlapped=0x0) returned 1 [0171.274] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0171.293] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.303] CloseHandle (hObject=0xe4) returned 1 [0171.303] CloseHandle (hObject=0xdc) returned 1 [0171.303] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.dvodltmf")) returned 0 [0171.304] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.dvodltmf")) returned 0x20 [0171.304] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e143190, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Window Switcher.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0x2e8518 [0171.304] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e143190, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Window Switcher.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0171.304] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0171.304] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk")) returned 1 [0171.305] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk")) returned 0xffffffff [0171.305] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e143190, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x726f6853, dwReserved1=0x74756374, cFileName="Window Switcher.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0171.305] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0171.305] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="UserData", cAlternateFileName="")) returned 1 [0171.306] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0171.306] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="..", cAlternateFileName="")) returned 1 [0171.306] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Low", cAlternateFileName="")) returned 1 [0171.306] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0171.306] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.306] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd4, dwReserved1=0x0, cFileName="65UX3YG0", cAlternateFileName="")) returned 1 [0171.306] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0171.307] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.307] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0171.307] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0171.307] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd4, dwReserved1=0x0, cFileName="AY721QDR", cAlternateFileName="")) returned 1 [0171.307] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0171.308] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.308] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0171.308] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0171.308] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd4, dwReserved1=0x0, cFileName="DZBKZBIC", cAlternateFileName="")) returned 1 [0171.308] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0171.308] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.308] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0171.308] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0171.308] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0xd4, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0171.308] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0171.308] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\index.dat.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0171.311] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8000 [0171.311] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0171.311] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0171.403] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x8000, lpOverlapped=0x0) returned 1 [0171.408] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x8010, lpOverlapped=0x0) returned 1 [0171.410] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0171.429] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.439] CloseHandle (hObject=0xe4) returned 1 [0171.439] CloseHandle (hObject=0xe0) returned 1 [0171.439] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\index.dat.dvodltmf")) returned 0 [0171.440] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\index.dat.dvodltmf")) returned 0x2020 [0171.440] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0x2e8558 [0171.440] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0 [0171.440] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0171.440] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\index.dat")) returned 1 [0171.441] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\index.dat")) returned 0xffffffff [0171.441] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="VRLZOZ0E", cAlternateFileName="")) returned 1 [0171.441] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0171.442] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.442] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0171.442] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0171.442] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="VRLZOZ0E", cAlternateFileName="")) returned 0 [0171.442] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0171.442] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Low", cAlternateFileName="")) returned 0 [0171.442] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0171.442] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="UserData", cAlternateFileName="")) returned 0 [0171.442] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0171.442] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f68, dwReserved1=0x0, cFileName="MMC", cAlternateFileName="")) returned 1 [0171.442] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0171.443] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="..", cAlternateFileName="")) returned 1 [0171.443] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="..", cAlternateFileName="")) returned 0 [0171.443] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0171.443] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f68, dwReserved1=0x0, cFileName="MS Project", cAlternateFileName="MSPROJ~1")) returned 1 [0171.443] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0171.444] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="..", cAlternateFileName="")) returned 1 [0171.444] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="14", cAlternateFileName="")) returned 1 [0171.444] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0171.445] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="..", cAlternateFileName="")) returned 1 [0171.445] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8e064c0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="1033", cAlternateFileName="")) returned 1 [0171.445] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8e064c0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0171.446] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8e064c0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.446] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8e064c0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0xfee79d60, ftLastWriteTime.dwHighDateTime=0x1d3aab9, nFileSizeHigh=0x0, nFileSizeLow=0x5f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Global.MPT", cAlternateFileName="")) returned 1 [0171.446] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\14\\1033\\global.mpt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0171.446] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\14\\1033\\global.mpt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0171.447] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5f600 [0171.447] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0171.447] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0171.536] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x5f600, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x5f600, lpOverlapped=0x0) returned 1 [0171.543] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x5f610, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x5f610, lpOverlapped=0x0) returned 1 [0171.551] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0171.570] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.581] CloseHandle (hObject=0xe0) returned 1 [0171.581] CloseHandle (hObject=0xe4) returned 1 [0171.581] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\14\\1033\\global.mpt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\14\\1033\\global.mpt.dvodltmf")) returned 0 [0171.582] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\14\\1033\\global.mpt.dvodltmf")) returned 0x2020 [0171.582] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8e064c0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0xfee79d60, ftLastWriteTime.dwHighDateTime=0x1d3aab9, nFileSizeHigh=0x0, nFileSizeLow=0x5f600, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Global.MPT", cAlternateFileName="")) returned 0x2e8558 [0171.582] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8e064c0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0xfee79d60, ftLastWriteTime.dwHighDateTime=0x1d3aab9, nFileSizeHigh=0x0, nFileSizeLow=0x5f600, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Global.MPT", cAlternateFileName="")) returned 0 [0171.582] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0171.583] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\14\\1033\\global.mpt")) returned 1 [0171.586] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\14\\1033\\global.mpt")) returned 0xffffffff [0171.586] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8e064c0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0xfee79d60, ftLastWriteTime.dwHighDateTime=0x1d3aab9, nFileSizeHigh=0x0, nFileSizeLow=0x5f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Global.MPT", cAlternateFileName="")) returned 0 [0171.587] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0171.587] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8e064c0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="1033", cAlternateFileName="")) returned 0 [0171.587] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0171.587] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="14", cAlternateFileName="")) returned 0 [0171.587] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0171.587] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f68, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1 [0171.587] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0171.587] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="..", cAlternateFileName="")) returned 1 [0171.587] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1 [0171.587] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0171.587] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="..", cAlternateFileName="")) returned 1 [0171.588] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Pbk", cAlternateFileName="")) returned 1 [0171.588] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0171.588] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.588] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_hiddenPbk", cAlternateFileName="_HIDDE~1")) returned 1 [0171.588] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0171.588] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.588] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rasphone.pbk", cAlternateFileName="")) returned 1 [0171.588] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\rasphone.pbk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0171.588] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\rasphone.pbk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0171.589] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0171.589] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0171.589] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0171.703] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x10, lpOverlapped=0x0) returned 1 [0171.704] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0171.723] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.733] CloseHandle (hObject=0xe0) returned 1 [0171.733] CloseHandle (hObject=0xf0) returned 1 [0171.733] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\rasphone.pbk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\rasphone.pbk.dvodltmf")) returned 0 [0171.734] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\rasphone.pbk.dvodltmf")) returned 0x2020 [0171.734] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="rasphone.pbk", cAlternateFileName="")) returned 0x2e8598 [0171.734] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="rasphone.pbk", cAlternateFileName="")) returned 0 [0171.734] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0171.734] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\rasphone.pbk")) returned 1 [0171.735] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\rasphone.pbk")) returned 0xffffffff [0171.735] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rasphone.pbk", cAlternateFileName="")) returned 0 [0171.735] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0171.735] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_hiddenPbk", cAlternateFileName="_HIDDE~1")) returned 0 [0171.735] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0171.735] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Pbk", cAlternateFileName="")) returned 0 [0171.735] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0171.735] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 0 [0171.735] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0171.735] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43c8ae30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dae0390, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dae0390, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f68, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1 [0171.735] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43c8ae30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dae0390, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dae0390, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0171.738] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43c8ae30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dae0390, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dae0390, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="..", cAlternateFileName="")) returned 1 [0171.738] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4f6ce7b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f6ce7b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f6ce7b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x9382, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="MSO1033.acl", cAlternateFileName="")) returned 1 [0171.739] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\mso1033.acl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0171.740] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\mso1033.acl.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0171.741] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9382 [0171.741] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0171.741] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0171.841] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x9382, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x9382, lpOverlapped=0x0) returned 1 [0171.847] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x9390, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x9390, lpOverlapped=0x0) returned 1 [0171.849] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0171.868] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.886] CloseHandle (hObject=0xf4) returned 1 [0171.886] CloseHandle (hObject=0xdc) returned 1 [0171.887] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\mso1033.acl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\mso1033.acl.dvodltmf")) returned 0 [0171.887] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\mso1033.acl.dvodltmf")) returned 0x2020 [0171.887] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4f6ce7b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f6ce7b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f6ce7b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x9382, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="MSO1033.acl", cAlternateFileName="")) returned 0x2e84d8 [0171.888] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4f6ce7b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f6ce7b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f6ce7b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x9382, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="MSO1033.acl", cAlternateFileName="")) returned 0 [0171.888] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0171.888] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\mso1033.acl")) returned 1 [0171.889] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\mso1033.acl")) returned 0xffffffff [0171.889] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5dae0390, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x90b3d80, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x90b3d80, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0171.889] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5dae0390, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x90b3d80, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x90b3d80, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x94, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0171.890] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5dae0390, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x90b3d80, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x90b3d80, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x94, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.890] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90b3d80, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x90b3d80, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x90d9ee0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x94, dwReserved1=0x0, cFileName="Global.LNK", cAlternateFileName="")) returned 1 [0171.890] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\global.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0171.890] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\global.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0171.891] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x59a [0171.891] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0171.891] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0171.975] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x59a, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x59a, lpOverlapped=0x0) returned 1 [0171.977] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x5a0, lpOverlapped=0x0) returned 1 [0171.978] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0171.998] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.007] CloseHandle (hObject=0xf4) returned 1 [0172.007] CloseHandle (hObject=0xe4) returned 1 [0172.007] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\global.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\global.lnk.dvodltmf")) returned 0 [0172.008] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\global.lnk.dvodltmf")) returned 0x2020 [0172.008] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90b3d80, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x90b3d80, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x90d9ee0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Global.LNK", cAlternateFileName="")) returned 0x2e8518 [0172.008] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90b3d80, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x90b3d80, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x90d9ee0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Global.LNK", cAlternateFileName="")) returned 0 [0172.008] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0172.009] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\global.lnk")) returned 1 [0172.009] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\global.lnk")) returned 0xffffffff [0172.009] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x5dc5d150, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dc5d150, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x90d9ee0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x34, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="index.dat", cAlternateFileName="")) returned 1 [0172.009] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0172.010] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\index.dat.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0172.013] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x34 [0172.013] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0172.013] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0172.098] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x34, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x34, lpOverlapped=0x0) returned 1 [0172.099] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x40, lpOverlapped=0x0) returned 1 [0172.100] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0172.119] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.129] CloseHandle (hObject=0xe4) returned 1 [0172.129] CloseHandle (hObject=0xf4) returned 1 [0172.129] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\index.dat.dvodltmf")) returned 0 [0172.130] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\index.dat.dvodltmf")) returned 0x2020 [0172.130] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x5dc5d150, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dc5d150, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x90d9ee0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x34, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0x2e8518 [0172.130] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x5dc5d150, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dc5d150, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x90d9ee0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x34, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0 [0172.130] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0172.130] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\index.dat")) returned 1 [0172.131] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\index.dat")) returned 0xffffffff [0172.131] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5dc5d150, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dc5d150, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dc5d150, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Templates.LNK", cAlternateFileName="TEMPLA~1.LNK")) returned 1 [0172.131] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\templates.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0172.131] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\templates.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0172.132] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x472 [0172.132] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0172.132] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0172.225] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x472, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x472, lpOverlapped=0x0) returned 1 [0172.227] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x480, lpOverlapped=0x0) returned 1 [0172.228] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0172.247] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.256] CloseHandle (hObject=0xf4) returned 1 [0172.256] CloseHandle (hObject=0xe4) returned 1 [0172.256] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\templates.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\templates.lnk.dvodltmf")) returned 0 [0172.257] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\templates.lnk.dvodltmf")) returned 0x2020 [0172.257] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5dc5d150, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dc5d150, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dc5d150, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Templates.LNK", cAlternateFileName="TEMPLA~1.LNK")) returned 0x2e8518 [0172.258] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5dc5d150, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dc5d150, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dc5d150, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Templates.LNK", cAlternateFileName="TEMPLA~1.LNK")) returned 0 [0172.258] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0172.258] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\templates.lnk")) returned 1 [0172.259] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\templates.lnk")) returned 0xffffffff [0172.259] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5dc5d150, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dc5d150, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dc5d150, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Templates.LNK", cAlternateFileName="TEMPLA~1.LNK")) returned 0 [0172.259] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0172.259] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5dae0390, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x90b3d80, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x90b3d80, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 0 [0172.259] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0172.259] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5c734300, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f68, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1 [0172.259] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5c734300, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4b4e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0172.260] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5c734300, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4b4e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.260] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5de69980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5de69980, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5e0c9040, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x4b4e, dwReserved1=0x0, cFileName="Outlook.srs", cAlternateFileName="")) returned 1 [0172.260] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.srs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.261] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.srs.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0172.261] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa00 [0172.261] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0172.262] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0172.347] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0xa00, lpOverlapped=0x0) returned 1 [0172.348] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0xa10, lpOverlapped=0x0) returned 1 [0172.349] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0172.371] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.381] CloseHandle (hObject=0xdc) returned 1 [0172.381] CloseHandle (hObject=0xe4) returned 1 [0172.381] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.srs"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.srs.dvodltmf")) returned 0 [0172.382] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.srs.dvodltmf")) returned 0x2020 [0172.382] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5de69980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5de69980, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5e0c9040, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Outlook.srs", cAlternateFileName="")) returned 0x2e84d8 [0172.382] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5de69980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5de69980, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5e0c9040, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Outlook.srs", cAlternateFileName="")) returned 0 [0172.382] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0172.382] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.srs")) returned 1 [0172.383] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.srs")) returned 0xffffffff [0172.383] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6215c440, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x9a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook.xml", cAlternateFileName="")) returned 1 [0172.383] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0172.383] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.384] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9a2 [0172.384] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0172.384] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0172.469] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x9a2, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x9a2, lpOverlapped=0x0) returned 1 [0172.470] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x9b0, lpOverlapped=0x0) returned 1 [0172.472] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0172.492] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.501] CloseHandle (hObject=0xe4) returned 1 [0172.501] CloseHandle (hObject=0xdc) returned 1 [0172.501] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml.dvodltmf")) returned 0 [0172.502] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml.dvodltmf")) returned 0x2020 [0172.502] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6215c440, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x9a2, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Outlook.xml", cAlternateFileName="")) returned 0x2e84d8 [0172.502] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6215c440, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x9a2, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Outlook.xml", cAlternateFileName="")) returned 0 [0172.502] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0172.502] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml")) returned 1 [0172.503] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml")) returned 0xffffffff [0172.503] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6215c440, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x9a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook.xml", cAlternateFileName="")) returned 0 [0172.503] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0172.504] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x33c0ebb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x33c0ebb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f68, dwReserved1=0x0, cFileName="PowerPoint", cAlternateFileName="POWERP~1")) returned 1 [0172.504] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x33c0ebb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x33c0ebb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0172.505] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x33c0ebb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x33c0ebb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.505] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x33c0ebb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x33c0ebb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0172.505] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0172.505] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x510b16f0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x510b16f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f68, dwReserved1=0x0, cFileName="Proof", cAlternateFileName="")) returned 1 [0172.505] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x510b16f0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x510b16f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0172.506] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x510b16f0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x510b16f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.506] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x510b16f0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x510b16f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0172.506] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0172.506] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x541f1c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x541f1c70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f68, dwReserved1=0x0, cFileName="Protect", cAlternateFileName="")) returned 1 [0172.506] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x541f1c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x541f1c70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0172.506] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x541f1c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x541f1c70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.506] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf29f8e64, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x138, dwReserved0=0x0, dwReserved1=0x0, cFileName="CREDHIST", cAlternateFileName="")) returned 1 [0172.506] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3111613574-2524581245-2586426736-500", cAlternateFileName="S-1-5-~1")) returned 1 [0172.506] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x96, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0172.508] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x96, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.508] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2b9bd87, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x96, dwReserved1=0x0, cFileName="be5b4fbd-cb99-45f5-9462-5f896dd3a6b9", cAlternateFileName="BE5B4F~1")) returned 1 [0172.508] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x96, dwReserved1=0x0, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 1 [0172.508] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x96, dwReserved1=0x0, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 0 [0172.508] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0172.509] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x541f1c70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96972b80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x96972b80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3939, dwReserved1=0x2d356635, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~2")) returned 1 [0172.509] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x541f1c70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96972b80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x96972b80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x96, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0172.509] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x541f1c70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96972b80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x96972b80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x96, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.509] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf923e050, ftCreationTime.dwHighDateTime=0x1d3aab9, ftLastAccessTime.dwLowDateTime=0xf923e050, ftLastAccessTime.dwHighDateTime=0x1d3aab9, ftLastWriteTime.dwLowDateTime=0xf923e050, ftLastWriteTime.dwHighDateTime=0x1d3aab9, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x96, dwReserved1=0x0, cFileName="02540a10-7eb7-4b20-a8c7-470f8986389c", cAlternateFileName="02540A~1")) returned 1 [0172.509] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xdc5ea830, ftCreationTime.dwHighDateTime=0x1d41fce, ftLastAccessTime.dwLowDateTime=0xdc5ea830, ftLastAccessTime.dwHighDateTime=0x1d41fce, ftLastWriteTime.dwLowDateTime=0xdc5ea830, ftLastWriteTime.dwHighDateTime=0x1d41fce, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x96, dwReserved1=0x0, cFileName="0e15476d-d8fe-46ca-8099-ebdcf80f637c", cAlternateFileName="0E1547~1")) returned 1 [0172.509] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf6409280, ftCreationTime.dwHighDateTime=0x1d4ae2c, ftLastAccessTime.dwLowDateTime=0xf6409280, ftLastAccessTime.dwHighDateTime=0x1d4ae2c, ftLastWriteTime.dwLowDateTime=0xf6409280, ftLastWriteTime.dwHighDateTime=0x1d4ae2c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x96, dwReserved1=0x0, cFileName="102a7bc8-3f85-4bb4-840a-38257d2965d2", cAlternateFileName="102A7B~1")) returned 1 [0172.509] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x542b0350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x542b0350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x542b0350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x96, dwReserved1=0x0, cFileName="2be989a0-16a1-424b-9211-51aa3bb43e5d", cAlternateFileName="2BE989~1")) returned 1 [0172.509] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x96972b80, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x96972b80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x96972b80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x96, dwReserved1=0x0, cFileName="7408bc8d-e658-4d4a-b521-9bd25b12fc80", cAlternateFileName="7408BC~1")) returned 1 [0172.509] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x17ffec90, ftCreationTime.dwHighDateTime=0x1d3373c, ftLastAccessTime.dwLowDateTime=0x17ffec90, ftLastAccessTime.dwHighDateTime=0x1d3373c, ftLastWriteTime.dwLowDateTime=0x18024df0, ftLastWriteTime.dwHighDateTime=0x1d3373c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x96, dwReserved1=0x0, cFileName="fbbe72db-afd8-443b-88dd-64b20388700d", cAlternateFileName="FBBE72~1")) returned 1 [0172.509] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x542fc610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x542fc610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x969e4fa0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x96, dwReserved1=0x0, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 1 [0172.509] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x542fc610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x542fc610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x969e4fa0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x96, dwReserved1=0x0, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 0 [0172.509] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0172.509] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2b1e4b40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b1e4b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x36031920, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x342d3864, dwReserved1=0x2d623334, cFileName="SYNCHIST", cAlternateFileName="")) returned 1 [0172.509] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2b1e4b40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b1e4b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x36031920, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x342d3864, dwReserved1=0x2d623334, cFileName="SYNCHIST", cAlternateFileName="")) returned 0 [0172.509] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0172.509] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0172.509] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3864, dwReserved1=0x2d623334, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0172.510] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3864, dwReserved1=0x2d623334, cFileName="..", cAlternateFileName="")) returned 1 [0172.510] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3864, dwReserved1=0x2d623334, cFileName="..", cAlternateFileName="")) returned 0 [0172.510] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0172.511] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbec39d0, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="Publisher Building Blocks", cAlternateFileName="PUBLIS~2")) returned 1 [0172.511] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbec39d0, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3864, dwReserved1=0x2d623334, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0172.511] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbec39d0, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3864, dwReserved1=0x2d623334, cFileName="..", cAlternateFileName="")) returned 1 [0172.511] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x342d3864, dwReserved1=0x2d623334, cFileName="ContentStore.xml", cAlternateFileName="CONTEN~1.XML")) returned 1 [0172.512] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.512] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0172.513] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa8 [0172.513] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0172.513] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0172.602] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa8, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0xa8, lpOverlapped=0x0) returned 1 [0172.603] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0xb0, lpOverlapped=0x0) returned 1 [0172.604] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0172.623] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.634] CloseHandle (hObject=0xdc) returned 1 [0172.634] CloseHandle (hObject=0xe4) returned 1 [0172.634] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml.dvodltmf")) returned 0 [0172.635] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml.dvodltmf")) returned 0x2020 [0172.635] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ContentStore.xml", cAlternateFileName="CONTEN~1.XML")) returned 0x2e84d8 [0172.635] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ContentStore.xml", cAlternateFileName="CONTEN~1.XML")) returned 0 [0172.635] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0172.635] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml")) returned 1 [0172.636] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml")) returned 0xffffffff [0172.636] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x342d3864, dwReserved1=0x2d623334, cFileName="ContentStore.xml", cAlternateFileName="CONTEN~1.XML")) returned 0 [0172.636] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0172.636] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d782e65, dwReserved1=0x3337396c, cFileName="Speech", cAlternateFileName="")) returned 1 [0172.636] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18edec, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0172.637] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18edec, cFileName="..", cAlternateFileName="")) returned 1 [0172.637] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18edec, cFileName="..", cAlternateFileName="")) returned 0 [0172.637] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0172.637] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d782e65, dwReserved1=0x3337396c, cFileName="SystemCertificates", cAlternateFileName="SYSTEM~1")) returned 1 [0172.637] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18edec, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0172.637] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18edec, cFileName="..", cAlternateFileName="")) returned 1 [0172.637] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18edec, cFileName="My", cAlternateFileName="")) returned 1 [0172.637] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0172.637] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.637] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc4, dwReserved1=0x0, cFileName="Certificates", cAlternateFileName="CERTIF~1")) returned 1 [0172.637] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0172.638] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.638] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0172.638] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0172.638] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc4, dwReserved1=0x0, cFileName="CRLs", cAlternateFileName="")) returned 1 [0172.638] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0172.638] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.638] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0172.638] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0172.638] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc4, dwReserved1=0x0, cFileName="CTLs", cAlternateFileName="")) returned 1 [0172.638] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0172.638] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.638] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0172.638] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0172.638] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc4, dwReserved1=0x0, cFileName="CTLs", cAlternateFileName="")) returned 0 [0172.638] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0172.638] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18edec, cFileName="My", cAlternateFileName="")) returned 0 [0172.639] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0172.639] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d42f10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2795d470, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x2795d470, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d782e65, dwReserved1=0x3337396c, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0172.639] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d42f10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2795d470, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x2795d470, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc73, dwReserved1=0x18edec, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0172.640] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d42f10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2795d470, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x2795d470, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc73, dwReserved1=0x18edec, cFileName="..", cAlternateFileName="")) returned 1 [0172.640] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5db2c650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5db2c650, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5db78910, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x509b, dwReserved0=0x2dcc73, dwReserved1=0x18edec, cFileName="Normal.dotm", cAlternateFileName="NORMAL~1.DOT")) returned 1 [0172.640] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\templates\\normal.dotm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0172.640] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\templates\\normal.dotm.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.640] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x509b [0172.640] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0172.641] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0172.724] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x509b, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x509b, lpOverlapped=0x0) returned 1 [0172.725] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x50a0, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x50a0, lpOverlapped=0x0) returned 1 [0172.726] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0172.746] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.755] CloseHandle (hObject=0xe4) returned 1 [0172.755] CloseHandle (hObject=0xdc) returned 1 [0172.755] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\templates\\normal.dotm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\templates\\normal.dotm.dvodltmf")) returned 0 [0172.756] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\templates\\normal.dotm.dvodltmf")) returned 0x2020 [0172.756] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5db2c650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5db2c650, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5db78910, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x509b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Normal.dotm", cAlternateFileName="NORMAL~1.DOT")) returned 0x2e84d8 [0172.756] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5db2c650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5db2c650, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5db78910, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x509b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Normal.dotm", cAlternateFileName="NORMAL~1.DOT")) returned 0 [0172.756] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0172.757] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\templates\\normal.dotm")) returned 1 [0172.757] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\templates\\normal.dotm")) returned 0xffffffff [0172.758] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5db2c650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5db2c650, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5db78910, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x509b, dwReserved0=0x2dcc73, dwReserved1=0x18edec, cFileName="Normal.dotm", cAlternateFileName="NORMAL~1.DOT")) returned 0 [0172.758] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0172.758] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d782e65, dwReserved1=0x3337396c, cFileName="UProof", cAlternateFileName="")) returned 1 [0172.758] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18edec, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0172.759] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18edec, cFileName="..", cAlternateFileName="")) returned 1 [0172.759] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0x2dcc40, dwReserved1=0x18edec, cFileName="CUSTOM.DIC", cAlternateFileName="")) returned 1 [0172.759] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\uproof\\custom.dic"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.759] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\uproof\\custom.dic.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0172.760] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2 [0172.760] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0172.760] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0172.844] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x2, lpOverlapped=0x0) returned 1 [0172.845] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x10, lpOverlapped=0x0) returned 1 [0172.846] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0172.866] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.875] CloseHandle (hObject=0xdc) returned 1 [0172.876] CloseHandle (hObject=0xe4) returned 1 [0172.876] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\uproof\\custom.dic"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\uproof\\custom.dic.dvodltmf")) returned 0 [0172.876] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\uproof\\custom.dic.dvodltmf")) returned 0x2020 [0172.877] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="CUSTOM.DIC", cAlternateFileName="")) returned 0x2e84d8 [0172.877] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="CUSTOM.DIC", cAlternateFileName="")) returned 0 [0172.877] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0172.877] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\uproof\\custom.dic")) returned 1 [0172.886] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\uproof\\custom.dic")) returned 0xffffffff [0172.886] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0x2dcc40, dwReserved1=0x18edec, cFileName="CUSTOM.DIC", cAlternateFileName="")) returned 0 [0172.886] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0172.886] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d782e65, dwReserved1=0x3337396c, cFileName="Windows", cAlternateFileName="")) returned 1 [0172.886] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0172.886] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.886] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0172.886] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x92, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0172.886] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x92, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.886] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c3625f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1c3625f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1c3625f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x53, dwReserved0=0x92, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adobe[1].txt", cAlternateFileName="5P5NRG~1.TXT")) returned 1 [0172.887] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0172.887] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0172.888] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x53 [0172.888] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0172.888] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0172.972] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x53, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x53, lpOverlapped=0x0) returned 1 [0172.973] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x60, lpOverlapped=0x0) returned 1 [0172.974] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0172.994] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.003] CloseHandle (hObject=0xdc) returned 1 [0173.003] CloseHandle (hObject=0xf4) returned 1 [0173.003] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.dvodltmf")) returned 0 [0173.004] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.dvodltmf")) returned 0x2020 [0173.004] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c3625f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1c3625f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1c3625f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x53, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@adobe[1].txt", cAlternateFileName="5P5NRG~1.TXT")) returned 0x2e8518 [0173.004] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c3625f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1c3625f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1c3625f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x53, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@adobe[1].txt", cAlternateFileName="5P5NRG~1.TXT")) returned 0 [0173.004] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0173.005] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt")) returned 1 [0173.005] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt")) returned 0xffffffff [0173.005] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d72bcd0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e6a4bd0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e6a4bd0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="5p5nrgjn0js_halpmcxz@adobe[3].txt", cAlternateFileName="5P0100~1.TXT")) returned 1 [0173.005] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0173.007] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.007] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x227 [0173.008] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0173.008] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0173.107] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x227, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x227, lpOverlapped=0x0) returned 1 [0173.108] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x230, lpOverlapped=0x0) returned 1 [0173.109] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0173.128] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.137] CloseHandle (hObject=0xf4) returned 1 [0173.137] CloseHandle (hObject=0xdc) returned 1 [0173.137] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.dvodltmf")) returned 0 [0173.138] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.dvodltmf")) returned 0x2020 [0173.138] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d72bcd0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e6a4bd0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e6a4bd0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@adobe[3].txt", cAlternateFileName="5P0100~1.TXT")) returned 0x2e8518 [0173.138] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d72bcd0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e6a4bd0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e6a4bd0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@adobe[3].txt", cAlternateFileName="5P0100~1.TXT")) returned 0 [0173.139] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0173.139] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt")) returned 1 [0173.139] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt")) returned 0xffffffff [0173.140] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d8f4d50, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e658910, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e658910, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="5p5nrgjn0js_halpmcxz@demdex[1].txt", cAlternateFileName="5PFFE8~1.TXT")) returned 1 [0173.140] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.141] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0173.142] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf1 [0173.142] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0173.142] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0173.227] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xf1, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xf1, lpOverlapped=0x0) returned 1 [0173.228] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x100, lpOverlapped=0x0) returned 1 [0173.229] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0173.248] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.258] CloseHandle (hObject=0xdc) returned 1 [0173.258] CloseHandle (hObject=0xf4) returned 1 [0173.258] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.dvodltmf")) returned 0 [0173.259] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.dvodltmf")) returned 0x2020 [0173.259] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d8f4d50, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e658910, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e658910, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@demdex[1].txt", cAlternateFileName="5PFFE8~1.TXT")) returned 0x2e8518 [0173.259] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d8f4d50, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e658910, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e658910, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@demdex[1].txt", cAlternateFileName="5PFFE8~1.TXT")) returned 0 [0173.259] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0173.259] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt")) returned 1 [0173.260] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt")) returned 0xffffffff [0173.260] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e658910, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e658910, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e658910, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", cAlternateFileName="5PB43E~1.TXT")) returned 1 [0173.260] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0173.261] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.262] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6f [0173.262] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0173.262] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0173.348] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x6f, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x6f, lpOverlapped=0x0) returned 1 [0173.349] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x70, lpOverlapped=0x0) returned 1 [0173.350] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0173.376] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.385] CloseHandle (hObject=0xf4) returned 1 [0173.385] CloseHandle (hObject=0xdc) returned 1 [0173.385] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.dvodltmf")) returned 0 [0173.386] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.dvodltmf")) returned 0x2020 [0173.386] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e658910, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e658910, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e658910, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", cAlternateFileName="5PB43E~1.TXT")) returned 0x2e8518 [0173.386] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e658910, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e658910, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e658910, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", cAlternateFileName="5PB43E~1.TXT")) returned 0 [0173.386] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0173.386] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt")) returned 1 [0173.387] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt")) returned 0xffffffff [0173.387] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dcf9270, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1dcf9270, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1dcf9270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x6e, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="5p5nrgjn0js_halpmcxz@everesttech[1].txt", cAlternateFileName="5P5NRG~4.TXT")) returned 1 [0173.387] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.388] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0173.389] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6e [0173.389] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0173.389] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0173.478] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x6e, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x6e, lpOverlapped=0x0) returned 1 [0173.478] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x70, lpOverlapped=0x0) returned 1 [0173.479] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0173.499] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.508] CloseHandle (hObject=0xdc) returned 1 [0173.508] CloseHandle (hObject=0xf4) returned 1 [0173.508] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.dvodltmf")) returned 0 [0173.509] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.dvodltmf")) returned 0x2020 [0173.509] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dcf9270, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1dcf9270, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1dcf9270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x6e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@everesttech[1].txt", cAlternateFileName="5P5NRG~4.TXT")) returned 0x2e8518 [0173.510] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dcf9270, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1dcf9270, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1dcf9270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x6e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@everesttech[1].txt", cAlternateFileName="5P5NRG~4.TXT")) returned 0 [0173.510] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0173.510] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt")) returned 1 [0173.511] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt")) returned 0xffffffff [0173.511] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86af2d0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="5p5nrgjn0js_halpmcxz@google[2].txt", cAlternateFileName="5P5NRG~2.TXT")) returned 1 [0173.511] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0173.512] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.513] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x114 [0173.513] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0173.513] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0173.596] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x114, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x114, lpOverlapped=0x0) returned 1 [0173.597] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x120, lpOverlapped=0x0) returned 1 [0173.598] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0173.617] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.628] CloseHandle (hObject=0xf4) returned 1 [0173.629] CloseHandle (hObject=0xdc) returned 1 [0173.629] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.dvodltmf")) returned 0 [0173.629] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.dvodltmf")) returned 0x2020 [0173.629] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86af2d0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@google[2].txt", cAlternateFileName="5P5NRG~2.TXT")) returned 0x2e8518 [0173.630] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86af2d0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@google[2].txt", cAlternateFileName="5P5NRG~2.TXT")) returned 0 [0173.630] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0173.630] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt")) returned 1 [0173.631] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt")) returned 0xffffffff [0173.631] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dcf9270, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1dcf9270, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1dcf9270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x56, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="5p5nrgjn0js_halpmcxz@ml314[1].txt", cAlternateFileName="5P0DBF~1.TXT")) returned 1 [0173.631] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.631] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0173.632] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x56 [0173.632] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0173.633] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0173.715] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x56, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x56, lpOverlapped=0x0) returned 1 [0173.716] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x60, lpOverlapped=0x0) returned 1 [0173.717] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0173.736] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.746] CloseHandle (hObject=0xdc) returned 1 [0173.746] CloseHandle (hObject=0xf4) returned 1 [0173.746] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.dvodltmf")) returned 0 [0173.746] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.dvodltmf")) returned 0x2020 [0173.746] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dcf9270, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1dcf9270, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1dcf9270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x56, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@ml314[1].txt", cAlternateFileName="5P0DBF~1.TXT")) returned 0x2e8518 [0173.747] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dcf9270, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1dcf9270, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1dcf9270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x56, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@ml314[1].txt", cAlternateFileName="5P0DBF~1.TXT")) returned 0 [0173.747] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0173.747] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt")) returned 1 [0173.748] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt")) returned 0xffffffff [0173.748] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e5e64f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e5e64f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e5e64f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", cAlternateFileName="5P94E6~1.TXT")) returned 1 [0173.748] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0173.748] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0173.749] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19e [0173.749] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0173.749] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0173.838] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x19e, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x19e, lpOverlapped=0x0) returned 1 [0173.839] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x1a0, lpOverlapped=0x0) returned 1 [0173.840] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0173.860] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.869] CloseHandle (hObject=0xf4) returned 1 [0173.869] CloseHandle (hObject=0xdc) returned 1 [0173.869] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.dvodltmf")) returned 0 [0173.870] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.dvodltmf")) returned 0x2020 [0173.870] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e5e64f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e5e64f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e5e64f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", cAlternateFileName="5P94E6~1.TXT")) returned 0x2e8518 [0173.870] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e5e64f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e5e64f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e5e64f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", cAlternateFileName="5P94E6~1.TXT")) returned 0 [0173.870] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0173.871] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt")) returned 1 [0173.871] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt")) returned 0xffffffff [0173.871] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x75061760, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="index.dat", cAlternateFileName="")) returned 1 [0173.871] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0173.872] CloseHandle (hObject=0xffffffff) returned 0 [0173.872] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat.dvodltmf")) returned 0 [0173.872] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat.dvodltmf")) returned 0xffffffff [0173.872] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x75061760, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0x2e8518 [0173.872] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x75061760, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0 [0173.872] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0173.872] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat")) returned 0 [0173.872] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat")) returned 0x2026 [0173.872] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2bc9ae40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52878dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Low", cAlternateFileName="")) returned 1 [0173.872] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2bc9ae40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52878dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0173.875] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2bc9ae40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52878dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.876] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44eb6480, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44eb6480, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44eb6480, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0xa2, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", cAlternateFileName="5P9943~1.TXT")) returned 1 [0173.876] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0173.876] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0173.877] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x66 [0173.877] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0173.877] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0173.968] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x66, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x66, lpOverlapped=0x0) returned 1 [0173.969] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x70, lpOverlapped=0x0) returned 1 [0173.970] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0173.990] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.000] CloseHandle (hObject=0xf4) returned 1 [0174.000] CloseHandle (hObject=0xf0) returned 1 [0174.000] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.dvodltmf")) returned 0 [0174.001] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.dvodltmf")) returned 0x2020 [0174.001] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44eb6480, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44eb6480, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44eb6480, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", cAlternateFileName="5P9943~1.TXT")) returned 0x2e8558 [0174.001] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44eb6480, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44eb6480, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44eb6480, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", cAlternateFileName="5P9943~1.TXT")) returned 0 [0174.001] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0174.002] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt")) returned 1 [0174.002] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt")) returned 0xffffffff [0174.002] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44bd95f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44bd95f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44bd95f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", cAlternateFileName="5P37D9~1.TXT")) returned 1 [0174.002] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0174.003] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0174.003] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x66 [0174.003] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0174.004] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0174.087] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x66, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x66, lpOverlapped=0x0) returned 1 [0174.088] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x70, lpOverlapped=0x0) returned 1 [0174.089] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0174.134] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.143] CloseHandle (hObject=0xf0) returned 1 [0174.143] CloseHandle (hObject=0xf4) returned 1 [0174.143] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.dvodltmf")) returned 0 [0174.144] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.dvodltmf")) returned 0x2020 [0174.144] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44bd95f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44bd95f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44bd95f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", cAlternateFileName="5P37D9~1.TXT")) returned 0x2e8558 [0174.145] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44bd95f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44bd95f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44bd95f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", cAlternateFileName="5P37D9~1.TXT")) returned 0 [0174.145] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0174.145] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt")) returned 1 [0174.145] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt")) returned 0xffffffff [0174.146] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf73d210, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf73d210, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf73d210, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5d, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="5p5nrgjn0js_halpmcxz@adformdsp[1].txt", cAlternateFileName="5P2CBA~1.TXT")) returned 1 [0174.146] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0174.149] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0174.150] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5d [0174.150] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0174.150] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0174.234] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x5d, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x5d, lpOverlapped=0x0) returned 1 [0174.234] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x60, lpOverlapped=0x0) returned 1 [0174.235] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0174.255] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.265] CloseHandle (hObject=0xf4) returned 1 [0174.265] CloseHandle (hObject=0xf0) returned 1 [0174.265] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.dvodltmf")) returned 0 [0174.266] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.dvodltmf")) returned 0x2020 [0174.266] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf73d210, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf73d210, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf73d210, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@adformdsp[1].txt", cAlternateFileName="5P2CBA~1.TXT")) returned 0x2e8558 [0174.267] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf73d210, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf73d210, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf73d210, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@adformdsp[1].txt", cAlternateFileName="5P2CBA~1.TXT")) returned 0 [0174.267] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0174.267] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt")) returned 1 [0174.268] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt")) returned 0xffffffff [0174.268] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2a0770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf7d5790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7d5790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adform[1].txt", cAlternateFileName="5P8600~1.TXT")) returned 1 [0174.268] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0174.268] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0174.273] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xea [0174.273] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0174.273] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0174.469] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xea, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0xea, lpOverlapped=0x0) returned 1 [0174.469] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0xf0, lpOverlapped=0x0) returned 1 [0174.470] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0174.490] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.500] CloseHandle (hObject=0xf0) returned 1 [0174.500] CloseHandle (hObject=0xf4) returned 1 [0174.500] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt.dvodltmf")) returned 0 [0174.501] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt.dvodltmf")) returned 0x2020 [0174.501] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2a0770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf7d5790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7d5790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@adform[1].txt", cAlternateFileName="5P8600~1.TXT")) returned 0x2e8558 [0174.501] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2a0770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf7d5790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7d5790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@adform[1].txt", cAlternateFileName="5P8600~1.TXT")) returned 0 [0174.501] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0174.501] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt")) returned 1 [0174.502] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt")) returned 0xffffffff [0174.502] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe5d5130, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0x45f08810, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45f08810, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="5p5nrgjn0js_halpmcxz@adnxs[1].txt", cAlternateFileName="5P89EF~1.TXT")) returned 1 [0174.502] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0174.503] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0174.504] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x242 [0174.504] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0174.504] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0174.588] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x242, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x242, lpOverlapped=0x0) returned 1 [0174.590] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x250, lpOverlapped=0x0) returned 1 [0174.591] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0174.610] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.620] CloseHandle (hObject=0xf4) returned 1 [0174.620] CloseHandle (hObject=0xf0) returned 1 [0174.620] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.dvodltmf")) returned 0 [0174.621] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.dvodltmf")) returned 0x2020 [0174.621] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe5d5130, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0x45f08810, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45f08810, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@adnxs[1].txt", cAlternateFileName="5P89EF~1.TXT")) returned 0x2e8558 [0174.621] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe5d5130, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0x45f08810, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45f08810, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@adnxs[1].txt", cAlternateFileName="5P89EF~1.TXT")) returned 0 [0174.621] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0174.622] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt")) returned 1 [0174.622] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt")) returned 0xffffffff [0174.623] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x65, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="5p5nrgjn0js_halpmcxz@adtech[2].txt", cAlternateFileName="5PC5B2~1.TXT")) returned 1 [0174.623] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0174.623] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0174.623] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x65 [0174.623] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0174.624] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0174.719] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x65, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x65, lpOverlapped=0x0) returned 1 [0174.719] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x70, lpOverlapped=0x0) returned 1 [0174.720] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0174.739] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.749] CloseHandle (hObject=0xf0) returned 1 [0174.749] CloseHandle (hObject=0xf4) returned 1 [0174.749] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.dvodltmf")) returned 0 [0174.750] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.dvodltmf")) returned 0x2020 [0174.750] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x65, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@adtech[2].txt", cAlternateFileName="5PC5B2~1.TXT")) returned 0x2e8558 [0174.750] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x65, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@adtech[2].txt", cAlternateFileName="5PC5B2~1.TXT")) returned 0 [0174.750] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0174.750] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt")) returned 1 [0174.751] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt")) returned 0xffffffff [0174.751] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53c70990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53c70990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53c70990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="5p5nrgjn0js_halpmcxz@adtr02[1].txt", cAlternateFileName="5P5NRG~3.TXT")) returned 1 [0174.751] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0174.751] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0174.752] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x52 [0174.752] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0174.752] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0174.835] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x52, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x52, lpOverlapped=0x0) returned 1 [0174.853] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x60, lpOverlapped=0x0) returned 1 [0174.854] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0174.874] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.883] CloseHandle (hObject=0xf4) returned 1 [0174.883] CloseHandle (hObject=0xf0) returned 1 [0174.883] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.dvodltmf")) returned 0 [0174.884] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.dvodltmf")) returned 0x2020 [0174.884] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53c70990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53c70990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53c70990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@adtr02[1].txt", cAlternateFileName="5P5NRG~3.TXT")) returned 0x2e8558 [0174.884] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53c70990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53c70990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53c70990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@adtr02[1].txt", cAlternateFileName="5P5NRG~3.TXT")) returned 0 [0174.884] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0174.884] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt")) returned 1 [0174.885] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt")) returned 0xffffffff [0174.885] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x517fd8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51332930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x51332930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="5p5nrgjn0js_halpmcxz@advertising[1].txt", cAlternateFileName="5P5NRG~1.TXT")) returned 1 [0174.885] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0174.886] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0174.887] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x125 [0174.887] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0174.887] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0174.978] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x125, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x125, lpOverlapped=0x0) returned 1 [0174.979] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x130, lpOverlapped=0x0) returned 1 [0174.980] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0174.999] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.009] CloseHandle (hObject=0xf0) returned 1 [0175.009] CloseHandle (hObject=0xf4) returned 1 [0175.009] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.dvodltmf")) returned 0 [0175.010] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.dvodltmf")) returned 0x2020 [0175.010] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x517fd8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51332930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x51332930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@advertising[1].txt", cAlternateFileName="5P5NRG~1.TXT")) returned 0x2e8558 [0175.010] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x517fd8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51332930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x51332930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@advertising[1].txt", cAlternateFileName="5P5NRG~1.TXT")) returned 0 [0175.010] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0175.010] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt")) returned 1 [0175.011] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt")) returned 0xffffffff [0175.011] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54cce0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54cce0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54cce0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@api.bing[2].txt", cAlternateFileName="5P40FC~1.TXT")) returned 1 [0175.011] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0175.012] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0175.012] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0175.012] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0175.013] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0175.097] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0xdd, lpOverlapped=0x0) returned 1 [0175.098] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0xe0, lpOverlapped=0x0) returned 1 [0175.099] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0175.119] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.128] CloseHandle (hObject=0xf4) returned 1 [0175.128] CloseHandle (hObject=0xf0) returned 1 [0175.129] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.dvodltmf")) returned 0 [0175.129] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.dvodltmf")) returned 0x2020 [0175.129] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54cce0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54cce0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54cce0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@api.bing[2].txt", cAlternateFileName="5P40FC~1.TXT")) returned 0x2e8558 [0175.130] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54cce0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54cce0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54cce0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@api.bing[2].txt", cAlternateFileName="5P40FC~1.TXT")) returned 0 [0175.130] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0175.130] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt")) returned 1 [0175.131] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt")) returned 0xffffffff [0175.131] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4611db50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4611db50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4611db50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@at.atwola[1].txt", cAlternateFileName="5P74F0~1.TXT")) returned 1 [0175.131] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0175.131] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0175.131] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x201 [0175.132] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0175.132] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0175.214] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x201, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x201, lpOverlapped=0x0) returned 1 [0175.215] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x210, lpOverlapped=0x0) returned 1 [0175.216] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0175.235] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.244] CloseHandle (hObject=0xf0) returned 1 [0175.245] CloseHandle (hObject=0xf4) returned 1 [0175.245] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.dvodltmf")) returned 0 [0175.245] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.dvodltmf")) returned 0x2020 [0175.246] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4611db50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4611db50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4611db50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@at.atwola[1].txt", cAlternateFileName="5P74F0~1.TXT")) returned 0x2e8558 [0175.246] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4611db50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4611db50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4611db50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@at.atwola[1].txt", cAlternateFileName="5P74F0~1.TXT")) returned 0 [0175.246] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0175.246] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt")) returned 1 [0175.247] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt")) returned 0xffffffff [0175.247] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x534b4210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x562c6900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x562c6900, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@bing[1].txt", cAlternateFileName="5PBE12~1.TXT")) returned 1 [0175.247] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0175.247] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0175.247] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ea [0175.247] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0175.248] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0175.330] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1ea, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x1ea, lpOverlapped=0x0) returned 1 [0175.332] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x1f0, lpOverlapped=0x0) returned 1 [0175.332] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0175.353] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.368] CloseHandle (hObject=0xf4) returned 1 [0175.369] CloseHandle (hObject=0xf0) returned 1 [0175.369] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt.dvodltmf")) returned 0 [0175.370] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt.dvodltmf")) returned 0x2020 [0175.370] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x534b4210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x562c6900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x562c6900, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1ea, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@bing[1].txt", cAlternateFileName="5PBE12~1.TXT")) returned 0x2e8558 [0175.370] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x534b4210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x562c6900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x562c6900, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1ea, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@bing[1].txt", cAlternateFileName="5PBE12~1.TXT")) returned 0 [0175.370] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0175.370] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt")) returned 1 [0175.371] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt")) returned 0xffffffff [0175.371] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="5p5nrgjn0js_halpmcxz@c.bing[1].txt", cAlternateFileName="5P5NRG~2.TXT")) returned 1 [0175.371] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0175.371] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0175.372] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c8 [0175.372] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0175.372] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0175.459] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1c8, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x1c8, lpOverlapped=0x0) returned 1 [0175.460] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x1d0, lpOverlapped=0x0) returned 1 [0175.461] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0175.481] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.490] CloseHandle (hObject=0xf0) returned 1 [0175.490] CloseHandle (hObject=0xf4) returned 1 [0175.490] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.dvodltmf")) returned 0 [0175.491] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.dvodltmf")) returned 0x2020 [0175.491] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@c.bing[1].txt", cAlternateFileName="5P5NRG~2.TXT")) returned 0x2e8558 [0175.491] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@c.bing[1].txt", cAlternateFileName="5P5NRG~2.TXT")) returned 0 [0175.491] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0175.491] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt")) returned 1 [0175.492] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt")) returned 0xffffffff [0175.492] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdf95770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbdf95770, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdf95770, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x82, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="5p5nrgjn0js_halpmcxz@c.msn[1].txt", cAlternateFileName="5PB89C~1.TXT")) returned 1 [0175.492] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0175.493] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0175.494] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x82 [0175.494] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0175.494] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0175.577] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x82, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x82, lpOverlapped=0x0) returned 1 [0175.577] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x90, lpOverlapped=0x0) returned 1 [0175.578] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0175.598] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.607] CloseHandle (hObject=0xf4) returned 1 [0175.607] CloseHandle (hObject=0xf0) returned 1 [0175.607] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt.dvodltmf")) returned 0 [0175.608] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt.dvodltmf")) returned 0x2020 [0175.608] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdf95770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbdf95770, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdf95770, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x82, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@c.msn[1].txt", cAlternateFileName="5PB89C~1.TXT")) returned 0x2e8558 [0175.609] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdf95770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbdf95770, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdf95770, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x82, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@c.msn[1].txt", cAlternateFileName="5PB89C~1.TXT")) returned 0 [0175.609] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0175.609] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt")) returned 1 [0175.609] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt")) returned 0xffffffff [0175.610] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6301df20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63a15b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63a15b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="5p5nrgjn0js_halpmcxz@doubleclick[2].txt", cAlternateFileName="5P93CC~1.TXT")) returned 1 [0175.610] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0175.610] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0175.611] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x110 [0175.611] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0175.611] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0175.695] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x110, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x110, lpOverlapped=0x0) returned 1 [0175.696] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x120, lpOverlapped=0x0) returned 1 [0175.697] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0175.716] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.727] CloseHandle (hObject=0xf0) returned 1 [0175.727] CloseHandle (hObject=0xf4) returned 1 [0175.727] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt.dvodltmf")) returned 0 [0175.728] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt.dvodltmf")) returned 0x2020 [0175.728] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6301df20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63a15b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63a15b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@doubleclick[2].txt", cAlternateFileName="5P93CC~1.TXT")) returned 0x2e8558 [0175.728] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6301df20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63a15b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63a15b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@doubleclick[2].txt", cAlternateFileName="5P93CC~1.TXT")) returned 0 [0175.728] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0175.728] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt")) returned 1 [0175.729] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt")) returned 0xffffffff [0175.729] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61093ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61093ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61093ba0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x256, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@google[1].txt", cAlternateFileName="5P12F9~1.TXT")) returned 1 [0175.729] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0175.730] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0175.730] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x256 [0175.730] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0175.731] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0175.820] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x256, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x256, lpOverlapped=0x0) returned 1 [0175.821] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x260, lpOverlapped=0x0) returned 1 [0175.822] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0175.842] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.851] CloseHandle (hObject=0xf4) returned 1 [0175.851] CloseHandle (hObject=0xf0) returned 1 [0175.851] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt.dvodltmf")) returned 0 [0175.852] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt.dvodltmf")) returned 0x2020 [0175.852] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61093ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61093ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61093ba0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x256, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@google[1].txt", cAlternateFileName="5P12F9~1.TXT")) returned 0x2e8558 [0175.852] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61093ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61093ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61093ba0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x256, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@google[1].txt", cAlternateFileName="5P12F9~1.TXT")) returned 0 [0175.852] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0175.853] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt")) returned 1 [0175.854] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt")) returned 0xffffffff [0175.854] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x610b9d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61282d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="5p5nrgjn0js_halpmcxz@google[3].txt", cAlternateFileName="5P692F~1.TXT")) returned 1 [0175.854] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0175.854] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0175.855] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc4 [0175.855] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0175.855] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0175.945] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xc4, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0xc4, lpOverlapped=0x0) returned 1 [0175.946] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0xd0, lpOverlapped=0x0) returned 1 [0175.947] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0175.967] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.976] CloseHandle (hObject=0xf0) returned 1 [0175.976] CloseHandle (hObject=0xf4) returned 1 [0175.976] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt.dvodltmf")) returned 0 [0175.977] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt.dvodltmf")) returned 0x2020 [0175.977] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x610b9d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61282d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@google[3].txt", cAlternateFileName="5P692F~1.TXT")) returned 0x2e8558 [0175.977] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x610b9d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61282d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@google[3].txt", cAlternateFileName="5P692F~1.TXT")) returned 0 [0175.977] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0175.977] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt")) returned 1 [0175.979] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt")) returned 0xffffffff [0175.979] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64e777a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64e777a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64e777a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x21f, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="5p5nrgjn0js_halpmcxz@google[4].txt", cAlternateFileName="5P3B8C~1.TXT")) returned 1 [0175.979] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0175.979] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0175.979] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x21f [0175.980] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0175.980] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0176.061] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x21f, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x21f, lpOverlapped=0x0) returned 1 [0176.062] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x220, lpOverlapped=0x0) returned 1 [0176.063] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0176.082] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.092] CloseHandle (hObject=0xf4) returned 1 [0176.092] CloseHandle (hObject=0xf0) returned 1 [0176.092] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt.dvodltmf")) returned 0 [0176.093] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt.dvodltmf")) returned 0x2020 [0176.093] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64e777a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64e777a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64e777a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x21f, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@google[4].txt", cAlternateFileName="5P3B8C~1.TXT")) returned 0x2e8558 [0176.093] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64e777a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64e777a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64e777a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x21f, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@google[4].txt", cAlternateFileName="5P3B8C~1.TXT")) returned 0 [0176.093] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0176.093] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt")) returned 1 [0176.094] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt")) returned 0xffffffff [0176.094] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x465ba5f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x465ba5f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x465ba5f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="5p5nrgjn0js_halpmcxz@linkedin[1].txt", cAlternateFileName="5P1C80~1.TXT")) returned 1 [0176.094] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0176.094] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0176.095] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x110 [0176.095] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0176.095] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0176.177] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x110, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x110, lpOverlapped=0x0) returned 1 [0176.178] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x120, lpOverlapped=0x0) returned 1 [0176.179] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0176.198] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.207] CloseHandle (hObject=0xf0) returned 1 [0176.207] CloseHandle (hObject=0xf4) returned 1 [0176.208] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt.dvodltmf")) returned 0 [0176.208] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt.dvodltmf")) returned 0x2020 [0176.208] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x465ba5f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x465ba5f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x465ba5f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@linkedin[1].txt", cAlternateFileName="5P1C80~1.TXT")) returned 0x2e8558 [0176.209] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x465ba5f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x465ba5f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x465ba5f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@linkedin[1].txt", cAlternateFileName="5P1C80~1.TXT")) returned 0 [0176.209] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0176.209] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt")) returned 1 [0176.210] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt")) returned 0xffffffff [0176.210] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfa5cef0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfa5cef0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfa5cef0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x76, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@m.exactag[1].txt", cAlternateFileName="5PD7A3~1.TXT")) returned 1 [0176.210] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0176.210] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0176.210] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x76 [0176.210] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0176.211] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0176.293] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x76, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x76, lpOverlapped=0x0) returned 1 [0176.294] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x80, lpOverlapped=0x0) returned 1 [0176.295] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0176.314] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.324] CloseHandle (hObject=0xf4) returned 1 [0176.324] CloseHandle (hObject=0xf0) returned 1 [0176.324] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt.dvodltmf")) returned 0 [0176.325] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt.dvodltmf")) returned 0x2020 [0176.325] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfa5cef0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfa5cef0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfa5cef0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x76, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@m.exactag[1].txt", cAlternateFileName="5PD7A3~1.TXT")) returned 0x2e8558 [0176.325] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfa5cef0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfa5cef0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfa5cef0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x76, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@m.exactag[1].txt", cAlternateFileName="5PD7A3~1.TXT")) returned 0 [0176.325] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0176.325] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt")) returned 1 [0176.326] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt")) returned 0xffffffff [0176.326] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50b50050, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50b50050, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50b50050, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x337, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@msn[1].txt", cAlternateFileName="5PBFF9~1.TXT")) returned 1 [0176.326] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0176.326] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0176.327] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x337 [0176.327] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0176.327] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0176.410] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x337, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x337, lpOverlapped=0x0) returned 1 [0176.411] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x340, lpOverlapped=0x0) returned 1 [0176.412] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0176.433] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.442] CloseHandle (hObject=0xf0) returned 1 [0176.442] CloseHandle (hObject=0xf4) returned 1 [0176.442] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt.dvodltmf")) returned 0 [0176.443] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt.dvodltmf")) returned 0x2020 [0176.443] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50b50050, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50b50050, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50b50050, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x337, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@msn[1].txt", cAlternateFileName="5PBFF9~1.TXT")) returned 0x2e8558 [0176.443] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50b50050, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50b50050, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50b50050, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x337, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@msn[1].txt", cAlternateFileName="5PBFF9~1.TXT")) returned 0 [0176.443] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0176.444] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt")) returned 1 [0176.444] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt")) returned 0xffffffff [0176.444] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5348e0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5348e0b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5348e0b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt", cAlternateFileName="5P5NRG~4.TXT")) returned 1 [0176.444] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0176.445] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0176.445] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xce [0176.445] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0176.446] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0176.533] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0xce, lpOverlapped=0x0) returned 1 [0176.534] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0xd0, lpOverlapped=0x0) returned 1 [0176.534] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0176.554] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.564] CloseHandle (hObject=0xf4) returned 1 [0176.564] CloseHandle (hObject=0xf0) returned 1 [0176.564] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.dvodltmf")) returned 0 [0176.565] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.dvodltmf")) returned 0x2020 [0176.565] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5348e0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5348e0b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5348e0b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt", cAlternateFileName="5P5NRG~4.TXT")) returned 0x2e8558 [0176.565] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5348e0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5348e0b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5348e0b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt", cAlternateFileName="5P5NRG~4.TXT")) returned 0 [0176.565] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0176.565] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt")) returned 1 [0176.566] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt")) returned 0xffffffff [0176.566] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf73d210, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf73d210, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf73d210, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6c, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt", cAlternateFileName="5P4910~1.TXT")) returned 1 [0176.566] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0176.567] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0176.567] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6c [0176.567] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0176.568] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0176.653] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x6c, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x6c, lpOverlapped=0x0) returned 1 [0176.654] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x70, lpOverlapped=0x0) returned 1 [0176.655] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0176.674] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.683] CloseHandle (hObject=0xf0) returned 1 [0176.683] CloseHandle (hObject=0xf4) returned 1 [0176.683] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.dvodltmf")) returned 0 [0176.684] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.dvodltmf")) returned 0x2020 [0176.684] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf73d210, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf73d210, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf73d210, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt", cAlternateFileName="5P4910~1.TXT")) returned 0x2e8558 [0176.684] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf73d210, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf73d210, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf73d210, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt", cAlternateFileName="5P4910~1.TXT")) returned 0 [0176.685] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0176.685] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt")) returned 1 [0176.685] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt")) returned 0xffffffff [0176.685] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf99e810, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf99e810, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf99e810, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x68, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="5p5nrgjn0js_halpmcxz@skadtec[1].txt", cAlternateFileName="5P37A2~1.TXT")) returned 1 [0176.686] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0176.686] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0176.686] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x68 [0176.686] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0176.687] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0176.775] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x68, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x68, lpOverlapped=0x0) returned 1 [0176.776] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x70, lpOverlapped=0x0) returned 1 [0176.777] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0176.798] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.808] CloseHandle (hObject=0xf4) returned 1 [0176.808] CloseHandle (hObject=0xf0) returned 1 [0176.808] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt.dvodltmf")) returned 0 [0176.809] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt.dvodltmf")) returned 0x2020 [0176.809] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf99e810, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf99e810, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf99e810, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x68, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@skadtec[1].txt", cAlternateFileName="5P37A2~1.TXT")) returned 0x2e8558 [0176.809] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf99e810, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf99e810, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf99e810, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x68, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@skadtec[1].txt", cAlternateFileName="5P37A2~1.TXT")) returned 0 [0176.809] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0176.809] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt")) returned 1 [0176.810] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt")) returned 0xffffffff [0176.810] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf54e030, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf54e030, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf54e030, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="5p5nrgjn0js_halpmcxz@track.adform[2].txt", cAlternateFileName="5PD4D3~1.TXT")) returned 1 [0176.810] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0176.810] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0176.811] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb2 [0176.811] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0176.811] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0176.905] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb2, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0xb2, lpOverlapped=0x0) returned 1 [0176.906] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0xc0, lpOverlapped=0x0) returned 1 [0176.906] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0176.926] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.935] CloseHandle (hObject=0xf0) returned 1 [0176.935] CloseHandle (hObject=0xf4) returned 1 [0176.936] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt.dvodltmf")) returned 0 [0176.936] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt.dvodltmf")) returned 0x2020 [0176.937] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf54e030, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf54e030, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf54e030, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@track.adform[2].txt", cAlternateFileName="5PD4D3~1.TXT")) returned 0x2e8558 [0176.937] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf54e030, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf54e030, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf54e030, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@track.adform[2].txt", cAlternateFileName="5PD4D3~1.TXT")) returned 0 [0176.937] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0176.937] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt")) returned 1 [0176.938] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt")) returned 0xffffffff [0176.938] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x555a9a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x555a9a10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x555a9a10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="5p5nrgjn0js_halpmcxz@www.bing[2].txt", cAlternateFileName="5PA943~1.TXT")) returned 1 [0176.938] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0176.938] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0176.939] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd7 [0176.939] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0176.939] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0177.030] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd7, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0xd7, lpOverlapped=0x0) returned 1 [0177.031] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0xe0, lpOverlapped=0x0) returned 1 [0177.032] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0177.051] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.061] CloseHandle (hObject=0xf4) returned 1 [0177.061] CloseHandle (hObject=0xf0) returned 1 [0177.061] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt.dvodltmf")) returned 0 [0177.062] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt.dvodltmf")) returned 0x2020 [0177.062] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x555a9a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x555a9a10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x555a9a10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@www.bing[2].txt", cAlternateFileName="5PA943~1.TXT")) returned 0x2e8558 [0177.062] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x555a9a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x555a9a10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x555a9a10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@www.bing[2].txt", cAlternateFileName="5PA943~1.TXT")) returned 0 [0177.062] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0177.062] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt")) returned 1 [0177.063] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt")) returned 0xffffffff [0177.063] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d8c7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d8c7b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54d8c7b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@www.linkedin[1].txt", cAlternateFileName="5PC3D9~1.TXT")) returned 1 [0177.063] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0177.063] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0177.064] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa9 [0177.064] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0177.064] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0177.148] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa9, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0xa9, lpOverlapped=0x0) returned 1 [0177.149] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0xb0, lpOverlapped=0x0) returned 1 [0177.150] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0177.170] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.179] CloseHandle (hObject=0xf0) returned 1 [0177.179] CloseHandle (hObject=0xf4) returned 1 [0177.181] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.dvodltmf")) returned 0 [0177.182] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.dvodltmf")) returned 0x2020 [0177.182] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d8c7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d8c7b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54d8c7b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa9, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@www.linkedin[1].txt", cAlternateFileName="5PC3D9~1.TXT")) returned 0x2e8558 [0177.182] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d8c7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d8c7b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54d8c7b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa9, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@www.linkedin[1].txt", cAlternateFileName="5PC3D9~1.TXT")) returned 0 [0177.182] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0177.182] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt")) returned 1 [0177.183] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt")) returned 0xffffffff [0177.183] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4523d1d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x526fc010, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x526fc010, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="5p5nrgjn0js_halpmcxz@www.msn[2].txt", cAlternateFileName="5PD551~1.TXT")) returned 1 [0177.183] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0177.184] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0177.184] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x402 [0177.184] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0177.185] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0177.267] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x402, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x402, lpOverlapped=0x0) returned 1 [0177.268] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x410, lpOverlapped=0x0) returned 1 [0177.269] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0177.289] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.298] CloseHandle (hObject=0xf4) returned 1 [0177.298] CloseHandle (hObject=0xf0) returned 1 [0177.298] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt.dvodltmf")) returned 0 [0177.299] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt.dvodltmf")) returned 0x2020 [0177.299] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4523d1d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x526fc010, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x526fc010, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@www.msn[2].txt", cAlternateFileName="5PD551~1.TXT")) returned 0x2e8558 [0177.299] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4523d1d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x526fc010, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x526fc010, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5p5nrgjn0js_halpmcxz@www.msn[2].txt", cAlternateFileName="5PD551~1.TXT")) returned 0 [0177.299] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0177.299] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt")) returned 1 [0177.300] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt")) returned 0xffffffff [0177.300] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x432daef0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="index.dat", cAlternateFileName="")) returned 1 [0177.300] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0177.301] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\index.dat.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0177.301] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8000 [0177.301] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0177.301] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0177.388] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x8000, lpOverlapped=0x0) returned 1 [0177.390] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x8010, lpOverlapped=0x0) returned 1 [0177.391] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0177.410] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.420] CloseHandle (hObject=0xf0) returned 1 [0177.420] CloseHandle (hObject=0xf4) returned 1 [0177.420] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\index.dat.dvodltmf")) returned 0 [0177.422] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\index.dat.dvodltmf")) returned 0x2020 [0177.422] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\index.dat", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x432daef0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0x2e8558 [0177.422] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x432daef0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0 [0177.422] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0177.422] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\index.dat")) returned 1 [0177.423] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\index.dat")) returned 0xffffffff [0177.423] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x432daef0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="index.dat", cAlternateFileName="")) returned 0 [0177.423] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0177.423] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2bc9ae40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52878dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Low", cAlternateFileName="")) returned 0 [0177.423] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0177.423] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c61685f, dwReserved1=0x78636d70, cFileName="IECompatCache", cAlternateFileName="IECOMP~1")) returned 1 [0177.423] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c61685f, dwReserved1=0x78636d70, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0177.424] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c61685f, dwReserved1=0x78636d70, cFileName="..", cAlternateFileName="")) returned 1 [0177.424] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c61685f, dwReserved1=0x78636d70, cFileName="Low", cAlternateFileName="")) returned 1 [0177.424] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0177.424] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="..", cAlternateFileName="")) returned 1 [0177.424] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="..", cAlternateFileName="")) returned 0 [0177.424] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0177.424] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c61685f, dwReserved1=0x78636d70, cFileName="Low", cAlternateFileName="")) returned 0 [0177.424] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0177.425] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9256a4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c61685f, dwReserved1=0x78636d70, cFileName="IETldCache", cAlternateFileName="IETLDC~1")) returned 1 [0177.425] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9256a4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c61685f, dwReserved1=0x78636d70, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0177.425] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9256a4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c61685f, dwReserved1=0x78636d70, cFileName="..", cAlternateFileName="")) returned 1 [0177.425] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x83c55340, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x6c61685f, dwReserved1=0x78636d70, cFileName="index.dat", cAlternateFileName="")) returned 1 [0177.425] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0177.425] CloseHandle (hObject=0xffffffff) returned 0 [0177.425] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\index.dat.dvodltmf")) returned 0 [0177.425] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\index.dat.dvodltmf")) returned 0xffffffff [0177.425] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x83c55340, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0x2e8518 [0177.425] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x83c55340, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0 [0177.425] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0177.425] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\index.dat")) returned 0 [0177.425] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\index.dat")) returned 0x2026 [0177.425] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f0dcf10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Low", cAlternateFileName="")) returned 1 [0177.425] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f0dcf10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0177.426] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f0dcf10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.426] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f0dcf10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64c3a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0xa8, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0177.426] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\low\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0177.426] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\low\\index.dat.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0177.427] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40000 [0177.427] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0177.427] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0177.511] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x40000, lpOverlapped=0x0) returned 1 [0177.517] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x40010, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x40010, lpOverlapped=0x0) returned 1 [0177.522] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0177.541] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.551] CloseHandle (hObject=0xf4) returned 1 [0177.551] CloseHandle (hObject=0xf0) returned 1 [0177.551] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\low\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\low\\index.dat.dvodltmf")) returned 0 [0177.552] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\low\\index.dat.dvodltmf")) returned 0x2020 [0177.552] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\index.dat", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f0dcf10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64c3a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0x2e8558 [0177.552] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f0dcf10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64c3a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0 [0177.552] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0177.552] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\low\\index.dat")) returned 1 [0177.557] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\low\\index.dat")) returned 0xffffffff [0177.557] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f0dcf10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64c3a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0xa8, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0177.557] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0177.557] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f0dcf10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Low", cAlternateFileName="")) returned 0 [0177.557] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0177.558] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d22d5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c61685f, dwReserved1=0x78636d70, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0177.558] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d22d5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0177.558] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d22d5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="..", cAlternateFileName="")) returned 1 [0177.558] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0177.558] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.558] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0177.559] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x112 [0177.560] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0177.560] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0177.646] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x112, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x112, lpOverlapped=0x0) returned 1 [0177.647] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x120, lpOverlapped=0x0) returned 1 [0177.648] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0177.668] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.677] CloseHandle (hObject=0xdc) returned 1 [0177.677] CloseHandle (hObject=0xf0) returned 1 [0177.678] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini.dvodltmf")) returned 0 [0177.679] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini.dvodltmf")) returned 0x2020 [0177.679] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8518 [0177.679] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0177.679] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0177.679] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini")) returned 1 [0177.681] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini")) returned 0xffffffff [0177.681] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d1e12e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2b, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Documents.library-ms", cAlternateFileName="DOCUME~1.LIB")) returned 1 [0177.681] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\documents.library-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0177.681] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\documents.library-ms.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.682] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe2b [0177.682] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0177.683] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0177.766] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe2b, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xe2b, lpOverlapped=0x0) returned 1 [0177.766] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xe30, lpOverlapped=0x0) returned 1 [0177.767] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0177.795] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.805] CloseHandle (hObject=0xf0) returned 1 [0177.805] CloseHandle (hObject=0xdc) returned 1 [0177.805] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\documents.library-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\documents.library-ms.dvodltmf")) returned 0 [0177.806] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\documents.library-ms.dvodltmf")) returned 0x2020 [0177.806] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d1e12e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Documents.library-ms", cAlternateFileName="DOCUME~1.LIB")) returned 0x2e8518 [0177.807] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d1e12e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Documents.library-ms", cAlternateFileName="DOCUME~1.LIB")) returned 0 [0177.807] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0177.807] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\documents.library-ms")) returned 1 [0177.808] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\documents.library-ms")) returned 0xffffffff [0177.808] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d22d5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Music.library-ms", cAlternateFileName="MUSIC~1.LIB")) returned 1 [0177.808] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\music.library-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.808] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\music.library-ms.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0177.809] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe00 [0177.809] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0177.809] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0177.892] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xe00, lpOverlapped=0x0) returned 1 [0177.893] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xe10, lpOverlapped=0x0) returned 1 [0177.894] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0177.913] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.922] CloseHandle (hObject=0xdc) returned 1 [0177.922] CloseHandle (hObject=0xf0) returned 1 [0177.923] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\music.library-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\music.library-ms.dvodltmf")) returned 0 [0177.924] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\music.library-ms.dvodltmf")) returned 0x2020 [0177.924] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d22d5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Music.library-ms", cAlternateFileName="MUSIC~1.LIB")) returned 0x2e8518 [0177.924] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d22d5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Music.library-ms", cAlternateFileName="MUSIC~1.LIB")) returned 0 [0177.924] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0177.924] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\music.library-ms")) returned 1 [0177.925] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\music.library-ms")) returned 0xffffffff [0177.925] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d207440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe23, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Pictures.library-ms", cAlternateFileName="PICTUR~1.LIB")) returned 1 [0177.925] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\pictures.library-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0177.925] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\pictures.library-ms.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0177.926] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe23 [0177.926] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0177.927] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0178.029] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe23, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xe23, lpOverlapped=0x0) returned 1 [0178.030] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xe30, lpOverlapped=0x0) returned 1 [0178.031] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0178.051] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.060] CloseHandle (hObject=0xf0) returned 1 [0178.061] CloseHandle (hObject=0xdc) returned 1 [0178.061] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\pictures.library-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\pictures.library-ms.dvodltmf")) returned 0 [0178.062] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\pictures.library-ms.dvodltmf")) returned 0x2020 [0178.062] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d207440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe23, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Pictures.library-ms", cAlternateFileName="PICTUR~1.LIB")) returned 0x2e8518 [0178.062] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d207440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe23, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Pictures.library-ms", cAlternateFileName="PICTUR~1.LIB")) returned 0 [0178.062] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0178.063] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\pictures.library-ms")) returned 1 [0178.064] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\pictures.library-ms")) returned 0xffffffff [0178.064] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d207440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe0e, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Videos.library-ms", cAlternateFileName="VIDEOS~1.LIB")) returned 1 [0178.064] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\videos.library-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.064] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\videos.library-ms.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0178.065] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe0e [0178.065] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0178.065] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0178.151] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe0e, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xe0e, lpOverlapped=0x0) returned 1 [0178.151] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xe10, lpOverlapped=0x0) returned 1 [0178.152] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0178.172] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.182] CloseHandle (hObject=0xdc) returned 1 [0178.182] CloseHandle (hObject=0xf0) returned 1 [0178.183] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\videos.library-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\videos.library-ms.dvodltmf")) returned 0 [0178.184] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\videos.library-ms.dvodltmf")) returned 0x2020 [0178.184] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d207440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe0e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Videos.library-ms", cAlternateFileName="VIDEOS~1.LIB")) returned 0x2e8518 [0178.184] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d207440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe0e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Videos.library-ms", cAlternateFileName="VIDEOS~1.LIB")) returned 0 [0178.184] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0178.184] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\videos.library-ms")) returned 1 [0178.185] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\videos.library-ms")) returned 0xffffffff [0178.185] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d207440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe0e, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Videos.library-ms", cAlternateFileName="VIDEOS~1.LIB")) returned 0 [0178.185] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0178.185] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d797261, dwReserved1=0x736d736d, cFileName="Network Shortcuts", cAlternateFileName="NETWOR~1")) returned 1 [0178.185] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0178.186] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="..", cAlternateFileName="")) returned 1 [0178.186] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="..", cAlternateFileName="")) returned 0 [0178.186] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0178.186] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d797261, dwReserved1=0x736d736d, cFileName="Printer Shortcuts", cAlternateFileName="PRINTE~1")) returned 1 [0178.186] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0178.186] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="..", cAlternateFileName="")) returned 1 [0178.186] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="..", cAlternateFileName="")) returned 0 [0178.186] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0178.186] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x94fde710, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x94fde710, ftLastWriteTime.dwHighDateTime=0x1d2fab5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d797261, dwReserved1=0x736d736d, cFileName="PrivacIE", cAlternateFileName="")) returned 1 [0178.186] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x94fde710, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x94fde710, ftLastWriteTime.dwHighDateTime=0x1d2fab5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0178.187] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x94fde710, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x94fde710, ftLastWriteTime.dwHighDateTime=0x1d2fab5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="..", cAlternateFileName="")) returned 1 [0178.187] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x94fde710, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0x94fde710, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x2bc126f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="index.dat", cAlternateFileName="")) returned 1 [0178.187] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0178.188] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.188] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8000 [0178.188] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0178.189] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0178.273] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x8000, lpOverlapped=0x0) returned 1 [0178.277] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x8010, lpOverlapped=0x0) returned 1 [0178.278] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0178.298] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.308] CloseHandle (hObject=0xf0) returned 1 [0178.308] CloseHandle (hObject=0xdc) returned 1 [0178.308] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat.dvodltmf")) returned 0 [0178.309] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat.dvodltmf")) returned 0x2020 [0178.309] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x94fde710, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0x94fde710, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x2bc126f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0x2e8518 [0178.309] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x94fde710, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0x94fde710, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x2bc126f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0 [0178.309] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0178.309] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat")) returned 1 [0178.310] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat")) returned 0xffffffff [0178.311] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50fa8bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Low", cAlternateFileName="")) returned 1 [0178.311] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50fa8bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0178.311] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50fa8bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.311] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x50fa8bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0xa4, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0178.311] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\low\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0178.311] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\low\\index.dat.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0178.312] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c000 [0178.312] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0178.312] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0178.402] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1c000, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x1c000, lpOverlapped=0x0) returned 1 [0178.405] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1c010, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x1c010, lpOverlapped=0x0) returned 1 [0178.408] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0178.428] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.438] CloseHandle (hObject=0xf0) returned 1 [0178.438] CloseHandle (hObject=0xf4) returned 1 [0178.438] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\low\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\low\\index.dat.dvodltmf")) returned 0 [0178.439] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\index.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\low\\index.dat.dvodltmf")) returned 0x2020 [0178.439] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\index.dat", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x50fa8bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0x2e8558 [0178.439] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x50fa8bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="index.dat", cAlternateFileName="")) returned 0 [0178.439] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0178.439] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\low\\index.dat")) returned 1 [0178.440] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\low\\index.dat")) returned 0xffffffff [0178.441] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x50fa8bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0xa4, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0178.441] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0178.441] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50fa8bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Low", cAlternateFileName="")) returned 0 [0178.441] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0178.441] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x76dd67a0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76dd67a0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d797261, dwReserved1=0x736d736d, cFileName="Recent", cAlternateFileName="")) returned 1 [0178.441] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x76dd67a0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76dfc900, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0178.441] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x76dd67a0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76dfc900, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="..", cAlternateFileName="")) returned 1 [0178.441] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762d41e0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x762d41e0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x762d41e0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe70, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="-3aYPU.lnk", cAlternateFileName="")) returned 1 [0178.441] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-3aYPU.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-3aypu.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.441] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-3aYPU.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-3aypu.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0178.442] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe70 [0178.442] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0178.443] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0178.531] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe70, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xe70, lpOverlapped=0x0) returned 1 [0178.532] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xe80, lpOverlapped=0x0) returned 1 [0178.533] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0178.552] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.562] CloseHandle (hObject=0xdc) returned 1 [0178.562] CloseHandle (hObject=0xf4) returned 1 [0178.562] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-3aYPU.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-3aypu.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-3aYPU.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-3aypu.lnk.dvodltmf")) returned 0 [0178.563] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-3aYPU.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-3aypu.lnk.dvodltmf")) returned 0x20 [0178.563] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-3aYPU.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762d41e0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x762d41e0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x762d41e0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe70, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="-3aYPU.lnk", cAlternateFileName="")) returned 0x2e8518 [0178.563] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762d41e0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x762d41e0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x762d41e0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe70, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="-3aYPU.lnk", cAlternateFileName="")) returned 0 [0178.563] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0178.563] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-3aYPU.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-3aypu.lnk")) returned 1 [0178.564] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-3aYPU.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-3aypu.lnk")) returned 0xffffffff [0178.564] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a1e540, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76a1e540, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76a1e540, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa7a, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="-kxITE2Z6YJ2-3US2zZ.lnk", cAlternateFileName="-KXITE~1.LNK")) returned 1 [0178.564] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-kxITE2Z6YJ2-3US2zZ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-kxite2z6yj2-3us2zz.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0178.564] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-kxITE2Z6YJ2-3US2zZ.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-kxite2z6yj2-3us2zz.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.565] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa7a [0178.565] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0178.565] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0178.653] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa7a, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xa7a, lpOverlapped=0x0) returned 1 [0178.653] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xa80, lpOverlapped=0x0) returned 1 [0178.654] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0178.674] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.683] CloseHandle (hObject=0xf4) returned 1 [0178.684] CloseHandle (hObject=0xdc) returned 1 [0178.684] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-kxITE2Z6YJ2-3US2zZ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-kxite2z6yj2-3us2zz.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-kxITE2Z6YJ2-3US2zZ.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-kxite2z6yj2-3us2zz.lnk.dvodltmf")) returned 0 [0178.684] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-kxITE2Z6YJ2-3US2zZ.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-kxite2z6yj2-3us2zz.lnk.dvodltmf")) returned 0x20 [0178.685] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-kxITE2Z6YJ2-3US2zZ.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a1e540, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76a1e540, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76a1e540, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa7a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="-kxITE2Z6YJ2-3US2zZ.lnk", cAlternateFileName="-KXITE~1.LNK")) returned 0x2e8518 [0178.685] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a1e540, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76a1e540, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76a1e540, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa7a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="-kxITE2Z6YJ2-3US2zZ.lnk", cAlternateFileName="-KXITE~1.LNK")) returned 0 [0178.685] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0178.685] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-kxITE2Z6YJ2-3US2zZ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-kxite2z6yj2-3us2zz.lnk")) returned 1 [0178.686] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-kxITE2Z6YJ2-3US2zZ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-kxite2z6yj2-3us2zz.lnk")) returned 0xffffffff [0178.686] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76b4f040, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76b4f040, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76b4f040, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x135e, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="-O Kjbqp.lnk", cAlternateFileName="-OKJBQ~1.LNK")) returned 1 [0178.686] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-O Kjbqp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-o kjbqp.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.686] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-O Kjbqp.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-o kjbqp.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0178.687] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x135e [0178.687] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0178.687] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0178.770] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x135e, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x135e, lpOverlapped=0x0) returned 1 [0178.771] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x1360, lpOverlapped=0x0) returned 1 [0178.772] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0178.791] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.801] CloseHandle (hObject=0xdc) returned 1 [0178.801] CloseHandle (hObject=0xf4) returned 1 [0178.801] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-O Kjbqp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-o kjbqp.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-O Kjbqp.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-o kjbqp.lnk.dvodltmf")) returned 0 [0178.802] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-O Kjbqp.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-o kjbqp.lnk.dvodltmf")) returned 0x20 [0178.802] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-O Kjbqp.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76b4f040, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76b4f040, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76b4f040, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x135e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="-O Kjbqp.lnk", cAlternateFileName="-OKJBQ~1.LNK")) returned 0x2e8518 [0178.802] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76b4f040, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76b4f040, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76b4f040, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x135e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="-O Kjbqp.lnk", cAlternateFileName="-OKJBQ~1.LNK")) returned 0 [0178.802] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0178.802] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-O Kjbqp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-o kjbqp.lnk")) returned 1 [0178.803] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-O Kjbqp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-o kjbqp.lnk")) returned 0xffffffff [0178.803] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x756c7280, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76261dc0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76261dc0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe7f, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="-x mXlGCowEqZikIAM.lnk", cAlternateFileName="-XMXLG~1.LNK")) returned 1 [0178.803] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-x mXlGCowEqZikIAM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-x mxlgcoweqzikiam.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0178.803] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-x mXlGCowEqZikIAM.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-x mxlgcoweqzikiam.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.804] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe7f [0178.804] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0178.804] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0178.904] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe7f, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xe7f, lpOverlapped=0x0) returned 1 [0178.905] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xe80, lpOverlapped=0x0) returned 1 [0178.906] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0178.925] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.935] CloseHandle (hObject=0xf4) returned 1 [0178.935] CloseHandle (hObject=0xdc) returned 1 [0178.935] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-x mXlGCowEqZikIAM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-x mxlgcoweqzikiam.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-x mXlGCowEqZikIAM.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-x mxlgcoweqzikiam.lnk.dvodltmf")) returned 0 [0178.936] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-x mXlGCowEqZikIAM.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-x mxlgcoweqzikiam.lnk.dvodltmf")) returned 0x20 [0178.936] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-x mXlGCowEqZikIAM.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x756c7280, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76261dc0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76261dc0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe7f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="-x mXlGCowEqZikIAM.lnk", cAlternateFileName="-XMXLG~1.LNK")) returned 0x2e8518 [0178.936] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x756c7280, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76261dc0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76261dc0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe7f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="-x mXlGCowEqZikIAM.lnk", cAlternateFileName="-XMXLG~1.LNK")) returned 0 [0178.936] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0178.937] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-x mXlGCowEqZikIAM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-x mxlgcoweqzikiam.lnk")) returned 1 [0178.937] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-x mXlGCowEqZikIAM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-x mxlgcoweqzikiam.lnk")) returned 0xffffffff [0178.938] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76640180, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76640180, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76640180, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="07iSZWrH.lnk", cAlternateFileName="")) returned 1 [0178.938] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\07iSZWrH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\07iszwrh.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0178.938] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\07iSZWrH.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\07iszwrh.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0178.939] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x239 [0178.939] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0178.939] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0179.030] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x239, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x239, lpOverlapped=0x0) returned 1 [0179.031] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x240, lpOverlapped=0x0) returned 1 [0179.032] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0179.051] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.061] CloseHandle (hObject=0xdc) returned 1 [0179.061] CloseHandle (hObject=0xf4) returned 1 [0179.061] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\07iSZWrH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\07iszwrh.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\07iSZWrH.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\07iszwrh.lnk.dvodltmf")) returned 0 [0179.062] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\07iSZWrH.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\07iszwrh.lnk.dvodltmf")) returned 0x20 [0179.062] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\07iSZWrH.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76640180, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76640180, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76640180, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="07iSZWrH.lnk", cAlternateFileName="")) returned 0x2e8518 [0179.062] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76640180, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76640180, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76640180, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="07iSZWrH.lnk", cAlternateFileName="")) returned 0 [0179.062] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0179.062] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\07iSZWrH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\07iszwrh.lnk")) returned 1 [0179.063] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\07iSZWrH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\07iszwrh.lnk")) returned 0xffffffff [0179.063] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75381440, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x765a7c00, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x765a7c00, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x132b, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="11yxE6YnXM8XXe7Vwj.lnk", cAlternateFileName="11YXE6~1.LNK")) returned 1 [0179.063] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\11yxE6YnXM8XXe7Vwj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\11yxe6ynxm8xxe7vwj.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0179.063] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\11yxE6YnXM8XXe7Vwj.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\11yxe6ynxm8xxe7vwj.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0179.064] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x132b [0179.064] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0179.064] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0179.148] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x132b, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x132b, lpOverlapped=0x0) returned 1 [0179.149] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x1330, lpOverlapped=0x0) returned 1 [0179.150] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0179.170] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.180] CloseHandle (hObject=0xf4) returned 1 [0179.180] CloseHandle (hObject=0xdc) returned 1 [0179.180] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\11yxE6YnXM8XXe7Vwj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\11yxe6ynxm8xxe7vwj.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\11yxE6YnXM8XXe7Vwj.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\11yxe6ynxm8xxe7vwj.lnk.dvodltmf")) returned 0 [0179.181] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\11yxE6YnXM8XXe7Vwj.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\11yxe6ynxm8xxe7vwj.lnk.dvodltmf")) returned 0x20 [0179.181] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\11yxE6YnXM8XXe7Vwj.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75381440, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x765a7c00, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x765a7c00, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x132b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="11yxE6YnXM8XXe7Vwj.lnk", cAlternateFileName="11YXE6~1.LNK")) returned 0x2e8518 [0179.181] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75381440, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x765a7c00, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x765a7c00, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x132b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="11yxE6YnXM8XXe7Vwj.lnk", cAlternateFileName="11YXE6~1.LNK")) returned 0 [0179.181] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0179.181] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\11yxE6YnXM8XXe7Vwj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\11yxe6ynxm8xxe7vwj.lnk")) returned 1 [0179.182] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\11yxE6YnXM8XXe7Vwj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\11yxe6ynxm8xxe7vwj.lnk")) returned 0xffffffff [0179.182] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76796de0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76796de0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76796de0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa37, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="2TLciQ138M.lnk", cAlternateFileName="2TLCIQ~1.LNK")) returned 1 [0179.182] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2TLciQ138M.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2tlciq138m.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0179.182] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2TLciQ138M.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2tlciq138m.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0179.183] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa37 [0179.183] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0179.183] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0179.268] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa37, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xa37, lpOverlapped=0x0) returned 1 [0179.269] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xa40, lpOverlapped=0x0) returned 1 [0179.270] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0179.290] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.299] CloseHandle (hObject=0xdc) returned 1 [0179.299] CloseHandle (hObject=0xf4) returned 1 [0179.299] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2TLciQ138M.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2tlciq138m.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2TLciQ138M.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2tlciq138m.lnk.dvodltmf")) returned 0 [0179.300] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2TLciQ138M.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2tlciq138m.lnk.dvodltmf")) returned 0x20 [0179.300] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2TLciQ138M.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76796de0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76796de0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76796de0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa37, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="2TLciQ138M.lnk", cAlternateFileName="2TLCIQ~1.LNK")) returned 0x2e8518 [0179.301] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76796de0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76796de0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76796de0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa37, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="2TLciQ138M.lnk", cAlternateFileName="2TLCIQ~1.LNK")) returned 0 [0179.301] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0179.301] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2TLciQ138M.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2tlciq138m.lnk")) returned 1 [0179.302] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2TLciQ138M.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2tlciq138m.lnk")) returned 0xffffffff [0179.302] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76796de0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76796de0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76796de0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe9a, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="3 BomAB.lnk", cAlternateFileName="3BOMAB~1.LNK")) returned 1 [0179.302] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3 BomAB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3 bomab.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0179.302] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3 BomAB.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3 bomab.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0179.306] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe9a [0179.306] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0179.306] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0179.502] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe9a, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xe9a, lpOverlapped=0x0) returned 1 [0179.503] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xea0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xea0, lpOverlapped=0x0) returned 1 [0179.504] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0179.524] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.537] CloseHandle (hObject=0xf4) returned 1 [0179.537] CloseHandle (hObject=0xdc) returned 1 [0179.537] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3 BomAB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3 bomab.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3 BomAB.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3 bomab.lnk.dvodltmf")) returned 0 [0179.538] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3 BomAB.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3 bomab.lnk.dvodltmf")) returned 0x20 [0179.538] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3 BomAB.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76796de0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76796de0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76796de0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe9a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="3 BomAB.lnk", cAlternateFileName="3BOMAB~1.LNK")) returned 0x2e8518 [0179.538] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76796de0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76796de0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76796de0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe9a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="3 BomAB.lnk", cAlternateFileName="3BOMAB~1.LNK")) returned 0 [0179.538] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0179.538] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3 BomAB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3 bomab.lnk")) returned 1 [0179.539] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3 BomAB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3 bomab.lnk")) returned 0xffffffff [0179.539] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x750d3b80, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x750d3b80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x750d3b80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe65, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="31Q pP.lnk", cAlternateFileName="31QPP~1.LNK")) returned 1 [0179.539] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\31Q pP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\31q pp.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0179.539] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\31Q pP.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\31q pp.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0179.540] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe65 [0179.540] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0179.541] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0179.627] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe65, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xe65, lpOverlapped=0x0) returned 1 [0179.628] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xe70, lpOverlapped=0x0) returned 1 [0179.629] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0179.649] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.658] CloseHandle (hObject=0xdc) returned 1 [0179.658] CloseHandle (hObject=0xf4) returned 1 [0179.659] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\31Q pP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\31q pp.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\31Q pP.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\31q pp.lnk.dvodltmf")) returned 0 [0179.660] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\31Q pP.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\31q pp.lnk.dvodltmf")) returned 0x20 [0179.660] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\31Q pP.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x750d3b80, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x750d3b80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x750d3b80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe65, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="31Q pP.lnk", cAlternateFileName="31QPP~1.LNK")) returned 0x2e8518 [0179.660] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x750d3b80, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x750d3b80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x750d3b80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe65, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="31Q pP.lnk", cAlternateFileName="31QPP~1.LNK")) returned 0 [0179.660] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0179.660] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\31Q pP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\31q pp.lnk")) returned 1 [0179.661] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\31Q pP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\31q pp.lnk")) returned 0xffffffff [0179.661] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x764e9520, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x764e9520, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x764e9520, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe6d, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="3qAmIeEuD.lnk", cAlternateFileName="3QAMIE~1.LNK")) returned 1 [0179.661] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3qAmIeEuD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3qamieeud.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0179.661] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3qAmIeEuD.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3qamieeud.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0179.662] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe6d [0179.662] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0179.663] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0179.747] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe6d, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xe6d, lpOverlapped=0x0) returned 1 [0179.747] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xe70, lpOverlapped=0x0) returned 1 [0179.748] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0179.768] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.783] CloseHandle (hObject=0xf4) returned 1 [0179.783] CloseHandle (hObject=0xdc) returned 1 [0179.783] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3qAmIeEuD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3qamieeud.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3qAmIeEuD.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3qamieeud.lnk.dvodltmf")) returned 0 [0179.784] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3qAmIeEuD.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3qamieeud.lnk.dvodltmf")) returned 0x20 [0179.784] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3qAmIeEuD.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x764e9520, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x764e9520, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x764e9520, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe6d, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="3qAmIeEuD.lnk", cAlternateFileName="3QAMIE~1.LNK")) returned 0x2e8518 [0179.785] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x764e9520, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x764e9520, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x764e9520, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe6d, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="3qAmIeEuD.lnk", cAlternateFileName="3QAMIE~1.LNK")) returned 0 [0179.785] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0179.785] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3qAmIeEuD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3qamieeud.lnk")) returned 1 [0179.786] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3qAmIeEuD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3qamieeud.lnk")) returned 0xffffffff [0179.786] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a6a800, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76a6a800, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76a6a800, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="3Z7Oh.flv.lnk", cAlternateFileName="3Z7OHF~1.LNK")) returned 1 [0179.786] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3Z7Oh.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3z7oh.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0179.786] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3Z7Oh.flv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3z7oh.flv.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0179.787] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x226 [0179.787] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0179.787] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0179.872] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x226, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x226, lpOverlapped=0x0) returned 1 [0179.873] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x230, lpOverlapped=0x0) returned 1 [0179.874] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0179.894] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.903] CloseHandle (hObject=0xdc) returned 1 [0179.903] CloseHandle (hObject=0xf4) returned 1 [0179.904] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3Z7Oh.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3z7oh.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3Z7Oh.flv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3z7oh.flv.lnk.dvodltmf")) returned 0 [0179.904] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3Z7Oh.flv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3z7oh.flv.lnk.dvodltmf")) returned 0x20 [0179.904] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3Z7Oh.flv.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a6a800, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76a6a800, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76a6a800, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="3Z7Oh.flv.lnk", cAlternateFileName="3Z7OHF~1.LNK")) returned 0x2e8518 [0179.905] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a6a800, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76a6a800, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76a6a800, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="3Z7Oh.flv.lnk", cAlternateFileName="3Z7OHF~1.LNK")) returned 0 [0179.905] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0179.905] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3Z7Oh.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3z7oh.flv.lnk")) returned 1 [0179.906] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3Z7Oh.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3z7oh.flv.lnk")) returned 0xffffffff [0179.906] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a446a0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76a446a0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76a446a0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="4MSGIDZlCWwjJ3mDt.mkv.lnk", cAlternateFileName="4MSGID~1.LNK")) returned 1 [0179.906] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4MSGIDZlCWwjJ3mDt.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4msgidzlcwwjj3mdt.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0179.906] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4MSGIDZlCWwjJ3mDt.mkv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4msgidzlcwwjj3mdt.mkv.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0179.907] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x266 [0179.907] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0179.907] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0180.002] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x266, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x266, lpOverlapped=0x0) returned 1 [0180.003] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x270, lpOverlapped=0x0) returned 1 [0180.004] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0180.024] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.034] CloseHandle (hObject=0xf4) returned 1 [0180.034] CloseHandle (hObject=0xdc) returned 1 [0180.034] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4MSGIDZlCWwjJ3mDt.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4msgidzlcwwjj3mdt.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4MSGIDZlCWwjJ3mDt.mkv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4msgidzlcwwjj3mdt.mkv.lnk.dvodltmf")) returned 0 [0180.035] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4MSGIDZlCWwjJ3mDt.mkv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4msgidzlcwwjj3mdt.mkv.lnk.dvodltmf")) returned 0x20 [0180.035] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4MSGIDZlCWwjJ3mDt.mkv.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a446a0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76a446a0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76a446a0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="4MSGIDZlCWwjJ3mDt.mkv.lnk", cAlternateFileName="4MSGID~1.LNK")) returned 0x2e8518 [0180.035] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a446a0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76a446a0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76a446a0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="4MSGIDZlCWwjJ3mDt.mkv.lnk", cAlternateFileName="4MSGID~1.LNK")) returned 0 [0180.035] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0180.035] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4MSGIDZlCWwjJ3mDt.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4msgidzlcwwjj3mdt.mkv.lnk")) returned 1 [0180.036] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4MSGIDZlCWwjJ3mDt.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4msgidzlcwwjj3mdt.mkv.lnk")) returned 0xffffffff [0180.036] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7674ab20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7674ab20, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76770c80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xf86, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="5h5gNxYKIOY.lnk", cAlternateFileName="5H5GNX~1.LNK")) returned 1 [0180.036] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5h5gNxYKIOY.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5h5gnxykioy.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0180.036] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5h5gNxYKIOY.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5h5gnxykioy.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0180.037] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf86 [0180.037] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0180.038] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0180.124] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xf86, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xf86, lpOverlapped=0x0) returned 1 [0180.125] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf90, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xf90, lpOverlapped=0x0) returned 1 [0180.126] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0180.146] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.155] CloseHandle (hObject=0xdc) returned 1 [0180.155] CloseHandle (hObject=0xf4) returned 1 [0180.155] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5h5gNxYKIOY.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5h5gnxykioy.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5h5gNxYKIOY.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5h5gnxykioy.lnk.dvodltmf")) returned 0 [0180.156] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5h5gNxYKIOY.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5h5gnxykioy.lnk.dvodltmf")) returned 0x20 [0180.156] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5h5gNxYKIOY.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7674ab20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7674ab20, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76770c80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xf86, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5h5gNxYKIOY.lnk", cAlternateFileName="5H5GNX~1.LNK")) returned 0x2e8518 [0180.157] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7674ab20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7674ab20, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76770c80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xf86, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5h5gNxYKIOY.lnk", cAlternateFileName="5H5GNX~1.LNK")) returned 0 [0180.157] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0180.157] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5h5gNxYKIOY.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5h5gnxykioy.lnk")) returned 1 [0180.158] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5h5gNxYKIOY.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5h5gnxykioy.lnk")) returned 0xffffffff [0180.158] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7617d580, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7617d580, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7617d580, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1fc4, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="5QpK.ots.lnk", cAlternateFileName="5QPKOT~1.LNK")) returned 1 [0180.158] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5QpK.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5qpk.ots.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0180.158] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5QpK.ots.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5qpk.ots.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0180.159] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1fc4 [0180.159] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0180.159] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0180.246] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1fc4, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x1fc4, lpOverlapped=0x0) returned 1 [0180.247] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1fd0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x1fd0, lpOverlapped=0x0) returned 1 [0180.248] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0180.267] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.277] CloseHandle (hObject=0xf4) returned 1 [0180.277] CloseHandle (hObject=0xdc) returned 1 [0180.277] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5QpK.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5qpk.ots.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5QpK.ots.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5qpk.ots.lnk.dvodltmf")) returned 0 [0180.278] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5QpK.ots.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5qpk.ots.lnk.dvodltmf")) returned 0x20 [0180.278] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5QpK.ots.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7617d580, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7617d580, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7617d580, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1fc4, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5QpK.ots.lnk", cAlternateFileName="5QPKOT~1.LNK")) returned 0x2e8518 [0180.278] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7617d580, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7617d580, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7617d580, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1fc4, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5QpK.ots.lnk", cAlternateFileName="5QPKOT~1.LNK")) returned 0 [0180.278] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0180.278] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5QpK.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5qpk.ots.lnk")) returned 1 [0180.279] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5QpK.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5qpk.ots.lnk")) returned 0xffffffff [0180.279] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76796de0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76796de0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76796de0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x25c, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="6eC3qF19PhMh RC.lnk", cAlternateFileName="6EC3QF~1.LNK")) returned 1 [0180.279] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6eC3qF19PhMh RC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6ec3qf19phmh rc.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0180.279] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6eC3qF19PhMh RC.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6ec3qf19phmh rc.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0180.280] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x25c [0180.280] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0180.281] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0180.371] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x25c, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x25c, lpOverlapped=0x0) returned 1 [0180.371] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x260, lpOverlapped=0x0) returned 1 [0180.372] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0180.394] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.403] CloseHandle (hObject=0xdc) returned 1 [0180.403] CloseHandle (hObject=0xf4) returned 1 [0180.403] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6eC3qF19PhMh RC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6ec3qf19phmh rc.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6eC3qF19PhMh RC.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6ec3qf19phmh rc.lnk.dvodltmf")) returned 0 [0180.404] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6eC3qF19PhMh RC.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6ec3qf19phmh rc.lnk.dvodltmf")) returned 0x20 [0180.404] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6eC3qF19PhMh RC.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76796de0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76796de0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76796de0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x25c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="6eC3qF19PhMh RC.lnk", cAlternateFileName="6EC3QF~1.LNK")) returned 0x2e8518 [0180.404] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76796de0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76796de0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76796de0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x25c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="6eC3qF19PhMh RC.lnk", cAlternateFileName="6EC3QF~1.LNK")) returned 0 [0180.405] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0180.405] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6eC3qF19PhMh RC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6ec3qf19phmh rc.lnk")) returned 1 [0180.405] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6eC3qF19PhMh RC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6ec3qf19phmh rc.lnk")) returned 0xffffffff [0180.406] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x750d3b80, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x750d3b80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x750d3b80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xf29, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="6Euyj0AK2Oua_19Sy5mn.lnk", cAlternateFileName="6EUYJ0~1.LNK")) returned 1 [0180.406] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6Euyj0AK2Oua_19Sy5mn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6euyj0ak2oua_19sy5mn.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0180.406] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6Euyj0AK2Oua_19Sy5mn.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6euyj0ak2oua_19sy5mn.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0180.407] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf29 [0180.407] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0180.407] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0180.497] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xf29, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xf29, lpOverlapped=0x0) returned 1 [0180.498] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf30, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xf30, lpOverlapped=0x0) returned 1 [0180.499] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0180.520] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.529] CloseHandle (hObject=0xf4) returned 1 [0180.529] CloseHandle (hObject=0xdc) returned 1 [0180.530] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6Euyj0AK2Oua_19Sy5mn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6euyj0ak2oua_19sy5mn.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6Euyj0AK2Oua_19Sy5mn.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6euyj0ak2oua_19sy5mn.lnk.dvodltmf")) returned 0 [0180.530] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6Euyj0AK2Oua_19Sy5mn.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6euyj0ak2oua_19sy5mn.lnk.dvodltmf")) returned 0x20 [0180.530] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6Euyj0AK2Oua_19Sy5mn.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x750d3b80, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x750d3b80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x750d3b80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xf29, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="6Euyj0AK2Oua_19Sy5mn.lnk", cAlternateFileName="6EUYJ0~1.LNK")) returned 0x2e8518 [0180.531] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x750d3b80, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x750d3b80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x750d3b80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xf29, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="6Euyj0AK2Oua_19Sy5mn.lnk", cAlternateFileName="6EUYJ0~1.LNK")) returned 0 [0180.531] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0180.531] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6Euyj0AK2Oua_19Sy5mn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6euyj0ak2oua_19sy5mn.lnk")) returned 1 [0180.532] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6Euyj0AK2Oua_19Sy5mn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6euyj0ak2oua_19sy5mn.lnk")) returned 0xffffffff [0180.532] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x757f7d80, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x757f7d80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x757f7d80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe95, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="6fOsplrpzN.lnk", cAlternateFileName="6FOSPL~1.LNK")) returned 1 [0180.532] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6fOsplrpzN.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6fosplrpzn.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0180.532] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6fOsplrpzN.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6fosplrpzn.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0180.533] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe95 [0180.533] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0180.534] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0180.619] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe95, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xe95, lpOverlapped=0x0) returned 1 [0180.620] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xea0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xea0, lpOverlapped=0x0) returned 1 [0180.621] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0180.642] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.652] CloseHandle (hObject=0xdc) returned 1 [0180.652] CloseHandle (hObject=0xf4) returned 1 [0180.652] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6fOsplrpzN.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6fosplrpzn.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6fOsplrpzN.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6fosplrpzn.lnk.dvodltmf")) returned 0 [0180.653] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6fOsplrpzN.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6fosplrpzn.lnk.dvodltmf")) returned 0x20 [0180.653] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6fOsplrpzN.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x757f7d80, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x757f7d80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x757f7d80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe95, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="6fOsplrpzN.lnk", cAlternateFileName="6FOSPL~1.LNK")) returned 0x2e8518 [0180.653] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x757f7d80, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x757f7d80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x757f7d80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe95, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="6fOsplrpzN.lnk", cAlternateFileName="6FOSPL~1.LNK")) returned 0 [0180.653] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0180.653] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6fOsplrpzN.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6fosplrpzn.lnk")) returned 1 [0180.654] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6fOsplrpzN.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6fosplrpzn.lnk")) returned 0xffffffff [0180.654] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7529cc00, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7529cc00, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7529cc00, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xed3, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="6ZeRihtSXKkhKq9.lnk", cAlternateFileName="6ZERIH~1.LNK")) returned 1 [0180.654] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6ZeRihtSXKkhKq9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6zerihtsxkkhkq9.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0180.654] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6ZeRihtSXKkhKq9.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6zerihtsxkkhkq9.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0180.655] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xed3 [0180.655] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0180.655] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0180.742] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xed3, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xed3, lpOverlapped=0x0) returned 1 [0180.742] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xee0, lpOverlapped=0x0) returned 1 [0180.744] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0180.763] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.777] CloseHandle (hObject=0xf4) returned 1 [0180.777] CloseHandle (hObject=0xdc) returned 1 [0180.777] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6ZeRihtSXKkhKq9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6zerihtsxkkhkq9.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6ZeRihtSXKkhKq9.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6zerihtsxkkhkq9.lnk.dvodltmf")) returned 0 [0180.778] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6ZeRihtSXKkhKq9.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6zerihtsxkkhkq9.lnk.dvodltmf")) returned 0x20 [0180.778] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6ZeRihtSXKkhKq9.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7529cc00, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7529cc00, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7529cc00, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xed3, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="6ZeRihtSXKkhKq9.lnk", cAlternateFileName="6ZERIH~1.LNK")) returned 0x2e8518 [0180.778] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7529cc00, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7529cc00, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7529cc00, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xed3, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="6ZeRihtSXKkhKq9.lnk", cAlternateFileName="6ZERIH~1.LNK")) returned 0 [0180.778] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0180.778] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6ZeRihtSXKkhKq9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6zerihtsxkkhkq9.lnk")) returned 1 [0180.779] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6ZeRihtSXKkhKq9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6zerihtsxkkhkq9.lnk")) returned 0xffffffff [0180.779] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7695fe60, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7695fe60, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76985fc0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x14e2, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="7JfD0V2aQp.lnk", cAlternateFileName="7JFD0V~1.LNK")) returned 1 [0180.779] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7JfD0V2aQp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7jfd0v2aqp.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0180.779] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7JfD0V2aQp.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7jfd0v2aqp.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0180.780] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14e2 [0180.780] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0180.780] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0180.865] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x14e2, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x14e2, lpOverlapped=0x0) returned 1 [0180.866] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x14f0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x14f0, lpOverlapped=0x0) returned 1 [0180.866] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0180.886] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.896] CloseHandle (hObject=0xdc) returned 1 [0180.896] CloseHandle (hObject=0xf4) returned 1 [0180.896] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7JfD0V2aQp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7jfd0v2aqp.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7JfD0V2aQp.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7jfd0v2aqp.lnk.dvodltmf")) returned 0 [0180.897] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7JfD0V2aQp.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7jfd0v2aqp.lnk.dvodltmf")) returned 0x20 [0180.897] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7JfD0V2aQp.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7695fe60, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7695fe60, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76985fc0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x14e2, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="7JfD0V2aQp.lnk", cAlternateFileName="7JFD0V~1.LNK")) returned 0x2e8518 [0180.897] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7695fe60, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7695fe60, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76985fc0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x14e2, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="7JfD0V2aQp.lnk", cAlternateFileName="7JFD0V~1.LNK")) returned 0 [0180.897] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0180.897] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7JfD0V2aQp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7jfd0v2aqp.lnk")) returned 1 [0180.898] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7JfD0V2aQp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7jfd0v2aqp.lnk")) returned 0xffffffff [0180.898] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a1e540, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76a1e540, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76a1e540, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe5a, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="8 fmo.lnk", cAlternateFileName="8FMO~1.LNK")) returned 1 [0180.898] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8 fmo.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8 fmo.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0180.899] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8 fmo.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8 fmo.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0180.899] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe5a [0180.899] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0180.900] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0180.984] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe5a, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xe5a, lpOverlapped=0x0) returned 1 [0180.985] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xe60, lpOverlapped=0x0) returned 1 [0180.986] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0181.013] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.023] CloseHandle (hObject=0xf4) returned 1 [0181.023] CloseHandle (hObject=0xdc) returned 1 [0181.023] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8 fmo.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8 fmo.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8 fmo.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8 fmo.lnk.dvodltmf")) returned 0 [0181.024] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8 fmo.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8 fmo.lnk.dvodltmf")) returned 0x20 [0181.024] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8 fmo.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a1e540, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76a1e540, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76a1e540, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe5a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="8 fmo.lnk", cAlternateFileName="8FMO~1.LNK")) returned 0x2e8518 [0181.024] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a1e540, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76a1e540, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76a1e540, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe5a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="8 fmo.lnk", cAlternateFileName="8FMO~1.LNK")) returned 0 [0181.024] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0181.024] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8 fmo.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8 fmo.lnk")) returned 1 [0181.025] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8 fmo.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8 fmo.lnk")) returned 0xffffffff [0181.025] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76cf1f60, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76cf1f60, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76cf1f60, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x275, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="8KI_D-7z3bfwjLxD6ua2.lnk", cAlternateFileName="8KI_D-~1.LNK")) returned 1 [0181.025] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8KI_D-7z3bfwjLxD6ua2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8ki_d-7z3bfwjlxd6ua2.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0181.025] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8KI_D-7z3bfwjLxD6ua2.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8ki_d-7z3bfwjlxd6ua2.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0181.026] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x275 [0181.026] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0181.026] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0181.111] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x275, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x275, lpOverlapped=0x0) returned 1 [0181.112] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x280, lpOverlapped=0x0) returned 1 [0181.113] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0181.132] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.142] CloseHandle (hObject=0xdc) returned 1 [0181.142] CloseHandle (hObject=0xf4) returned 1 [0181.142] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8KI_D-7z3bfwjLxD6ua2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8ki_d-7z3bfwjlxd6ua2.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8KI_D-7z3bfwjLxD6ua2.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8ki_d-7z3bfwjlxd6ua2.lnk.dvodltmf")) returned 0 [0181.143] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8KI_D-7z3bfwjLxD6ua2.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8ki_d-7z3bfwjlxd6ua2.lnk.dvodltmf")) returned 0x20 [0181.143] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8KI_D-7z3bfwjLxD6ua2.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76cf1f60, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76cf1f60, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76cf1f60, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x275, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="8KI_D-7z3bfwjLxD6ua2.lnk", cAlternateFileName="8KI_D-~1.LNK")) returned 0x2e8518 [0181.143] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76cf1f60, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76cf1f60, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76cf1f60, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x275, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="8KI_D-7z3bfwjLxD6ua2.lnk", cAlternateFileName="8KI_D-~1.LNK")) returned 0 [0181.143] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0181.143] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8KI_D-7z3bfwjLxD6ua2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8ki_d-7z3bfwjlxd6ua2.lnk")) returned 1 [0181.144] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8KI_D-7z3bfwjLxD6ua2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8ki_d-7z3bfwjlxd6ua2.lnk")) returned 0xffffffff [0181.144] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75d79060, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75d79060, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75d79060, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x13f3, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="8LcN6A2xkeU9B04.lnk", cAlternateFileName="8LCN6A~1.LNK")) returned 1 [0181.144] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8LcN6A2xkeU9B04.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8lcn6a2xkeu9b04.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0181.144] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8LcN6A2xkeU9B04.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8lcn6a2xkeu9b04.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0181.145] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13f3 [0181.145] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0181.145] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0181.230] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x13f3, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x13f3, lpOverlapped=0x0) returned 1 [0181.231] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x1400, lpOverlapped=0x0) returned 1 [0181.232] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0181.251] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.261] CloseHandle (hObject=0xf4) returned 1 [0181.261] CloseHandle (hObject=0xdc) returned 1 [0181.261] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8LcN6A2xkeU9B04.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8lcn6a2xkeu9b04.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8LcN6A2xkeU9B04.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8lcn6a2xkeu9b04.lnk.dvodltmf")) returned 0 [0181.262] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8LcN6A2xkeU9B04.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8lcn6a2xkeu9b04.lnk.dvodltmf")) returned 0x20 [0181.262] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8LcN6A2xkeU9B04.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75d79060, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75d79060, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75d79060, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x13f3, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="8LcN6A2xkeU9B04.lnk", cAlternateFileName="8LCN6A~1.LNK")) returned 0x2e8518 [0181.262] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75d79060, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75d79060, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75d79060, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x13f3, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="8LcN6A2xkeU9B04.lnk", cAlternateFileName="8LCN6A~1.LNK")) returned 0 [0181.262] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0181.262] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8LcN6A2xkeU9B04.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8lcn6a2xkeu9b04.lnk")) returned 1 [0181.263] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8LcN6A2xkeU9B04.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8lcn6a2xkeu9b04.lnk")) returned 0xffffffff [0181.263] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76913ba0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76913ba0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76913ba0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x40b, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="8T8s9jBtANTygPB.lnk", cAlternateFileName="8T8S9J~1.LNK")) returned 1 [0181.263] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8T8s9jBtANTygPB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8t8s9jbtantygpb.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0181.263] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8T8s9jBtANTygPB.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8t8s9jbtantygpb.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0181.264] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40b [0181.264] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0181.265] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0181.350] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x40b, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x40b, lpOverlapped=0x0) returned 1 [0181.351] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x410, lpOverlapped=0x0) returned 1 [0181.352] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0181.377] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.386] CloseHandle (hObject=0xdc) returned 1 [0181.386] CloseHandle (hObject=0xf4) returned 1 [0181.387] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8T8s9jBtANTygPB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8t8s9jbtantygpb.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8T8s9jBtANTygPB.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8t8s9jbtantygpb.lnk.dvodltmf")) returned 0 [0181.387] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8T8s9jBtANTygPB.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8t8s9jbtantygpb.lnk.dvodltmf")) returned 0x20 [0181.387] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8T8s9jBtANTygPB.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76913ba0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76913ba0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76913ba0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x40b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="8T8s9jBtANTygPB.lnk", cAlternateFileName="8T8S9J~1.LNK")) returned 0x2e8518 [0181.388] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76913ba0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76913ba0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76913ba0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x40b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="8T8s9jBtANTygPB.lnk", cAlternateFileName="8T8S9J~1.LNK")) returned 0 [0181.388] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0181.388] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8T8s9jBtANTygPB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8t8s9jbtantygpb.lnk")) returned 1 [0181.389] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8T8s9jBtANTygPB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8t8s9jbtantygpb.lnk")) returned 0xffffffff [0181.389] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76913ba0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76913ba0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76913ba0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x22d, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="8_DKhm.lnk", cAlternateFileName="")) returned 1 [0181.389] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8_DKhm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8_dkhm.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0181.389] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8_DKhm.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8_dkhm.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0181.390] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x22d [0181.390] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0181.390] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0181.483] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x22d, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x22d, lpOverlapped=0x0) returned 1 [0181.484] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x230, lpOverlapped=0x0) returned 1 [0181.485] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0181.505] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.514] CloseHandle (hObject=0xf4) returned 1 [0181.514] CloseHandle (hObject=0xdc) returned 1 [0181.514] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8_DKhm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8_dkhm.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8_DKhm.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8_dkhm.lnk.dvodltmf")) returned 0 [0181.515] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8_DKhm.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8_dkhm.lnk.dvodltmf")) returned 0x20 [0181.515] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8_DKhm.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76913ba0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76913ba0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76913ba0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x22d, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="8_DKhm.lnk", cAlternateFileName="")) returned 0x2e8518 [0181.515] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76913ba0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76913ba0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76913ba0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x22d, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="8_DKhm.lnk", cAlternateFileName="")) returned 0 [0181.515] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0181.515] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8_DKhm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8_dkhm.lnk")) returned 1 [0181.516] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8_DKhm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8_dkhm.lnk")) returned 0xffffffff [0181.516] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7650f680, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7650f680, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7650f680, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="92cQxQtAMLs.lnk", cAlternateFileName="92CQXQ~1.LNK")) returned 1 [0181.516] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\92cQxQtAMLs.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\92cqxqtamls.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0181.517] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\92cQxQtAMLs.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\92cqxqtamls.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0181.517] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f7 [0181.518] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0181.518] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0181.602] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3f7, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x3f7, lpOverlapped=0x0) returned 1 [0181.603] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x400, lpOverlapped=0x0) returned 1 [0181.604] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0181.623] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.634] CloseHandle (hObject=0xdc) returned 1 [0181.634] CloseHandle (hObject=0xf4) returned 1 [0181.634] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\92cQxQtAMLs.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\92cqxqtamls.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\92cQxQtAMLs.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\92cqxqtamls.lnk.dvodltmf")) returned 0 [0181.635] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\92cQxQtAMLs.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\92cqxqtamls.lnk.dvodltmf")) returned 0x20 [0181.635] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\92cQxQtAMLs.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7650f680, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7650f680, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7650f680, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="92cQxQtAMLs.lnk", cAlternateFileName="92CQXQ~1.LNK")) returned 0x2e8518 [0181.635] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7650f680, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7650f680, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7650f680, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="92cQxQtAMLs.lnk", cAlternateFileName="92CQXQ~1.LNK")) returned 0 [0181.635] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0181.635] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\92cQxQtAMLs.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\92cqxqtamls.lnk")) returned 1 [0181.636] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\92cQxQtAMLs.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\92cqxqtamls.lnk")) returned 0xffffffff [0181.636] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x757d1c20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x757d1c20, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x757d1c20, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xf09, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="9AAcEoE6H8 3wYJD4.ots.lnk", cAlternateFileName="9AACEO~1.LNK")) returned 1 [0181.636] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9AAcEoE6H8 3wYJD4.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9aaceoe6h8 3wyjd4.ots.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0181.636] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9AAcEoE6H8 3wYJD4.ots.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9aaceoe6h8 3wyjd4.ots.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0181.637] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf09 [0181.637] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0181.637] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0181.722] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xf09, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xf09, lpOverlapped=0x0) returned 1 [0181.723] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xf10, lpOverlapped=0x0) returned 1 [0181.724] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0181.744] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.754] CloseHandle (hObject=0xf4) returned 1 [0181.754] CloseHandle (hObject=0xdc) returned 1 [0181.754] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9AAcEoE6H8 3wYJD4.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9aaceoe6h8 3wyjd4.ots.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9AAcEoE6H8 3wYJD4.ots.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9aaceoe6h8 3wyjd4.ots.lnk.dvodltmf")) returned 0 [0181.755] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9AAcEoE6H8 3wYJD4.ots.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9aaceoe6h8 3wyjd4.ots.lnk.dvodltmf")) returned 0x20 [0181.755] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9AAcEoE6H8 3wYJD4.ots.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x757d1c20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x757d1c20, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x757d1c20, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xf09, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="9AAcEoE6H8 3wYJD4.ots.lnk", cAlternateFileName="9AACEO~1.LNK")) returned 0x2e8518 [0181.755] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x757d1c20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x757d1c20, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x757d1c20, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xf09, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="9AAcEoE6H8 3wYJD4.ots.lnk", cAlternateFileName="9AACEO~1.LNK")) returned 0 [0181.755] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0181.755] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9AAcEoE6H8 3wYJD4.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9aaceoe6h8 3wyjd4.ots.lnk")) returned 1 [0181.756] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9AAcEoE6H8 3wYJD4.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9aaceoe6h8 3wyjd4.ots.lnk")) returned 0xffffffff [0181.756] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75902720, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75902720, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75902720, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa7a, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="9qF34TVKBnwfFX zYWG.lnk", cAlternateFileName="9QF34T~1.LNK")) returned 1 [0181.756] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9qF34TVKBnwfFX zYWG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9qf34tvkbnwffx zywg.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0181.756] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9qF34TVKBnwfFX zYWG.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9qf34tvkbnwffx zywg.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0181.757] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa7a [0181.757] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0181.758] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0181.848] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa7a, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xa7a, lpOverlapped=0x0) returned 1 [0181.849] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xa80, lpOverlapped=0x0) returned 1 [0181.854] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0181.873] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.883] CloseHandle (hObject=0xdc) returned 1 [0181.883] CloseHandle (hObject=0xf4) returned 1 [0181.883] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9qF34TVKBnwfFX zYWG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9qf34tvkbnwffx zywg.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9qF34TVKBnwfFX zYWG.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9qf34tvkbnwffx zywg.lnk.dvodltmf")) returned 0 [0181.884] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9qF34TVKBnwfFX zYWG.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9qf34tvkbnwffx zywg.lnk.dvodltmf")) returned 0x20 [0181.884] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9qF34TVKBnwfFX zYWG.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75902720, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75902720, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75902720, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa7a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="9qF34TVKBnwfFX zYWG.lnk", cAlternateFileName="9QF34T~1.LNK")) returned 0x2e8518 [0181.884] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75902720, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75902720, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75902720, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa7a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="9qF34TVKBnwfFX zYWG.lnk", cAlternateFileName="9QF34T~1.LNK")) returned 0 [0181.884] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0181.884] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9qF34TVKBnwfFX zYWG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9qf34tvkbnwffx zywg.lnk")) returned 1 [0181.885] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9qF34TVKBnwfFX zYWG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9qf34tvkbnwffx zywg.lnk")) returned 0xffffffff [0181.885] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x769ac120, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x769ac120, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x769ac120, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x2f3, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="9t9C WEEH7Mb0lRFGHf.lnk", cAlternateFileName="9T9CWE~1.LNK")) returned 1 [0181.885] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9t9C WEEH7Mb0lRFGHf.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9t9c weeh7mb0lrfghf.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0181.886] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9t9C WEEH7Mb0lRFGHf.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9t9c weeh7mb0lrfghf.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0181.886] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2f3 [0181.887] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0181.887] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0181.972] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2f3, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x2f3, lpOverlapped=0x0) returned 1 [0181.973] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x300, lpOverlapped=0x0) returned 1 [0181.974] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0181.994] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.003] CloseHandle (hObject=0xf4) returned 1 [0182.003] CloseHandle (hObject=0xdc) returned 1 [0182.003] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9t9C WEEH7Mb0lRFGHf.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9t9c weeh7mb0lrfghf.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9t9C WEEH7Mb0lRFGHf.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9t9c weeh7mb0lrfghf.lnk.dvodltmf")) returned 0 [0182.004] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9t9C WEEH7Mb0lRFGHf.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9t9c weeh7mb0lrfghf.lnk.dvodltmf")) returned 0x20 [0182.004] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9t9C WEEH7Mb0lRFGHf.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x769ac120, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x769ac120, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x769ac120, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x2f3, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="9t9C WEEH7Mb0lRFGHf.lnk", cAlternateFileName="9T9CWE~1.LNK")) returned 0x2e8518 [0182.005] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x769ac120, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x769ac120, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x769ac120, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x2f3, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="9t9C WEEH7Mb0lRFGHf.lnk", cAlternateFileName="9T9CWE~1.LNK")) returned 0 [0182.005] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0182.005] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9t9C WEEH7Mb0lRFGHf.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9t9c weeh7mb0lrfghf.lnk")) returned 1 [0182.006] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9t9C WEEH7Mb0lRFGHf.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9t9c weeh7mb0lrfghf.lnk")) returned 0xffffffff [0182.006] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76b9b300, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76b9b300, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76b9b300, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa07, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="A hOJQ.lnk", cAlternateFileName="AHOJQ~1.LNK")) returned 1 [0182.006] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A hOJQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a hojq.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0182.006] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A hOJQ.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a hojq.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0182.007] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa07 [0182.007] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0182.007] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0182.100] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa07, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xa07, lpOverlapped=0x0) returned 1 [0182.101] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xa10, lpOverlapped=0x0) returned 1 [0182.102] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0182.122] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.132] CloseHandle (hObject=0xdc) returned 1 [0182.132] CloseHandle (hObject=0xf4) returned 1 [0182.132] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A hOJQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a hojq.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A hOJQ.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a hojq.lnk.dvodltmf")) returned 0 [0182.133] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A hOJQ.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a hojq.lnk.dvodltmf")) returned 0x20 [0182.133] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A hOJQ.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76b9b300, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76b9b300, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76b9b300, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa07, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="A hOJQ.lnk", cAlternateFileName="AHOJQ~1.LNK")) returned 0x2e8518 [0182.133] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76b9b300, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76b9b300, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76b9b300, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa07, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="A hOJQ.lnk", cAlternateFileName="AHOJQ~1.LNK")) returned 0 [0182.133] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0182.133] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A hOJQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a hojq.lnk")) returned 1 [0182.134] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A hOJQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a hojq.lnk")) returned 0xffffffff [0182.134] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7674ab20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7674ab20, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7674ab20, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa79, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="A2F9i3GigO6CRtVsg.lnk", cAlternateFileName="A2F9I3~1.LNK")) returned 1 [0182.134] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A2F9i3GigO6CRtVsg.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a2f9i3gigo6crtvsg.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0182.135] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A2F9i3GigO6CRtVsg.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a2f9i3gigo6crtvsg.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0182.135] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa79 [0182.135] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0182.136] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0182.219] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa79, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xa79, lpOverlapped=0x0) returned 1 [0182.220] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xa80, lpOverlapped=0x0) returned 1 [0182.221] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0182.241] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.251] CloseHandle (hObject=0xf4) returned 1 [0182.251] CloseHandle (hObject=0xdc) returned 1 [0182.251] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A2F9i3GigO6CRtVsg.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a2f9i3gigo6crtvsg.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A2F9i3GigO6CRtVsg.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a2f9i3gigo6crtvsg.lnk.dvodltmf")) returned 0 [0182.252] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A2F9i3GigO6CRtVsg.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a2f9i3gigo6crtvsg.lnk.dvodltmf")) returned 0x20 [0182.252] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A2F9i3GigO6CRtVsg.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7674ab20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7674ab20, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7674ab20, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa79, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="A2F9i3GigO6CRtVsg.lnk", cAlternateFileName="A2F9I3~1.LNK")) returned 0x2e8518 [0182.252] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7674ab20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7674ab20, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7674ab20, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa79, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="A2F9i3GigO6CRtVsg.lnk", cAlternateFileName="A2F9I3~1.LNK")) returned 0 [0182.252] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0182.252] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A2F9i3GigO6CRtVsg.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a2f9i3gigo6crtvsg.lnk")) returned 1 [0182.253] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A2F9i3GigO6CRtVsg.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a2f9i3gigo6crtvsg.lnk")) returned 0xffffffff [0182.253] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75fb4500, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75fb4500, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75fb4500, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x18d8, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="a4d7Zvt65 zTYB1q.lnk", cAlternateFileName="A4D7ZV~1.LNK")) returned 1 [0182.253] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a4d7Zvt65 zTYB1q.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a4d7zvt65 ztyb1q.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0182.253] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a4d7Zvt65 zTYB1q.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a4d7zvt65 ztyb1q.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0182.254] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18d8 [0182.254] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0182.255] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0182.340] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x18d8, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x18d8, lpOverlapped=0x0) returned 1 [0182.341] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x18e0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x18e0, lpOverlapped=0x0) returned 1 [0182.342] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0182.367] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.377] CloseHandle (hObject=0xdc) returned 1 [0182.377] CloseHandle (hObject=0xf4) returned 1 [0182.377] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a4d7Zvt65 zTYB1q.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a4d7zvt65 ztyb1q.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a4d7Zvt65 zTYB1q.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a4d7zvt65 ztyb1q.lnk.dvodltmf")) returned 0 [0182.378] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a4d7Zvt65 zTYB1q.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a4d7zvt65 ztyb1q.lnk.dvodltmf")) returned 0x20 [0182.378] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a4d7Zvt65 zTYB1q.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75fb4500, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75fb4500, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75fb4500, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x18d8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="a4d7Zvt65 zTYB1q.lnk", cAlternateFileName="A4D7ZV~1.LNK")) returned 0x2e8518 [0182.378] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75fb4500, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75fb4500, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75fb4500, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x18d8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="a4d7Zvt65 zTYB1q.lnk", cAlternateFileName="A4D7ZV~1.LNK")) returned 0 [0182.378] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0182.378] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a4d7Zvt65 zTYB1q.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a4d7zvt65 ztyb1q.lnk")) returned 1 [0182.379] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a4d7Zvt65 zTYB1q.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a4d7zvt65 ztyb1q.lnk")) returned 0xffffffff [0182.379] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x769d2280, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x769d2280, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x769d2280, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x261, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="A6iaStFgDrW2BOZV.lnk", cAlternateFileName="A6IAST~1.LNK")) returned 1 [0182.379] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A6iaStFgDrW2BOZV.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a6iastfgdrw2bozv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0182.379] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A6iaStFgDrW2BOZV.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a6iastfgdrw2bozv.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0182.380] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x261 [0182.380] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0182.381] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0182.472] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x261, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x261, lpOverlapped=0x0) returned 1 [0182.473] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x270, lpOverlapped=0x0) returned 1 [0182.474] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0182.494] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.503] CloseHandle (hObject=0xf4) returned 1 [0182.503] CloseHandle (hObject=0xdc) returned 1 [0182.504] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A6iaStFgDrW2BOZV.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a6iastfgdrw2bozv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A6iaStFgDrW2BOZV.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a6iastfgdrw2bozv.lnk.dvodltmf")) returned 0 [0182.504] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A6iaStFgDrW2BOZV.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a6iastfgdrw2bozv.lnk.dvodltmf")) returned 0x20 [0182.504] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A6iaStFgDrW2BOZV.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x769d2280, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x769d2280, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x769d2280, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x261, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="A6iaStFgDrW2BOZV.lnk", cAlternateFileName="A6IAST~1.LNK")) returned 0x2e8518 [0182.505] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x769d2280, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x769d2280, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x769d2280, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x261, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="A6iaStFgDrW2BOZV.lnk", cAlternateFileName="A6IAST~1.LNK")) returned 0 [0182.505] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0182.505] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A6iaStFgDrW2BOZV.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a6iastfgdrw2bozv.lnk")) returned 1 [0182.506] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A6iaStFgDrW2BOZV.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a6iastfgdrw2bozv.lnk")) returned 0xffffffff [0182.506] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7529cc00, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7529cc00, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7529cc00, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xedc, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="agUo4TPBVzCT.lnk", cAlternateFileName="AGUO4T~1.LNK")) returned 1 [0182.506] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\agUo4TPBVzCT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aguo4tpbvzct.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0182.506] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\agUo4TPBVzCT.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aguo4tpbvzct.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0182.507] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xedc [0182.507] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0182.507] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0182.594] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xedc, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xedc, lpOverlapped=0x0) returned 1 [0182.595] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xee0, lpOverlapped=0x0) returned 1 [0182.596] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0182.616] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.627] CloseHandle (hObject=0xdc) returned 1 [0182.627] CloseHandle (hObject=0xf4) returned 1 [0182.628] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\agUo4TPBVzCT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aguo4tpbvzct.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\agUo4TPBVzCT.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aguo4tpbvzct.lnk.dvodltmf")) returned 0 [0182.628] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\agUo4TPBVzCT.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aguo4tpbvzct.lnk.dvodltmf")) returned 0x20 [0182.628] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\agUo4TPBVzCT.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7529cc00, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7529cc00, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7529cc00, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xedc, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="agUo4TPBVzCT.lnk", cAlternateFileName="AGUO4T~1.LNK")) returned 0x2e8518 [0182.629] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7529cc00, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7529cc00, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7529cc00, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xedc, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="agUo4TPBVzCT.lnk", cAlternateFileName="AGUO4T~1.LNK")) returned 0 [0182.629] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0182.629] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\agUo4TPBVzCT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aguo4tpbvzct.lnk")) returned 1 [0182.630] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\agUo4TPBVzCT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aguo4tpbvzct.lnk")) returned 0xffffffff [0182.630] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75f8e3a0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75f8e3a0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75f8e3a0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1490, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="alhB3.lnk", cAlternateFileName="")) returned 1 [0182.630] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\alhB3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\alhb3.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0182.630] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\alhB3.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\alhb3.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0182.631] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1490 [0182.631] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0182.631] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0182.716] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1490, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x1490, lpOverlapped=0x0) returned 1 [0182.717] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x14a0, lpOverlapped=0x0) returned 1 [0182.718] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0182.738] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.747] CloseHandle (hObject=0xf4) returned 1 [0182.747] CloseHandle (hObject=0xdc) returned 1 [0182.748] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\alhB3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\alhb3.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\alhB3.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\alhb3.lnk.dvodltmf")) returned 0 [0182.749] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\alhB3.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\alhb3.lnk.dvodltmf")) returned 0x20 [0182.749] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\alhB3.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75f8e3a0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75f8e3a0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75f8e3a0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1490, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="alhB3.lnk", cAlternateFileName="")) returned 0x2e8518 [0182.749] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75f8e3a0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75f8e3a0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75f8e3a0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1490, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="alhB3.lnk", cAlternateFileName="")) returned 0 [0182.749] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0182.749] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\alhB3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\alhb3.lnk")) returned 1 [0182.750] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\alhB3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\alhb3.lnk")) returned 0xffffffff [0182.750] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce65c0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="AutomaticDestinations", cAlternateFileName="AUTOMA~1")) returned 1 [0182.750] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce65c0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0182.751] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce65c0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.751] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x76d16180, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1fc26, dwReserved0=0xa0, dwReserved1=0x0, cFileName="1b4dd67f29cb1962.automaticDestinations-ms", cAlternateFileName="1B4DD6~1.AUT")) returned 1 [0182.751] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0182.751] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0182.751] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1fc26 [0182.751] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0182.752] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0182.847] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1fc26, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x1fc26, lpOverlapped=0x0) returned 1 [0182.849] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1fc30, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x1fc30, lpOverlapped=0x0) returned 1 [0182.852] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0182.871] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.881] CloseHandle (hObject=0xf4) returned 1 [0182.881] CloseHandle (hObject=0xf0) returned 1 [0182.881] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms.dvodltmf")) returned 0 [0182.882] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms.dvodltmf")) returned 0x20 [0182.882] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x76d16180, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1fc26, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="1b4dd67f29cb1962.automaticDestinations-ms", cAlternateFileName="1B4DD6~1.AUT")) returned 0x2e8558 [0182.882] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x76d16180, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1fc26, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="1b4dd67f29cb1962.automaticDestinations-ms", cAlternateFileName="1B4DD6~1.AUT")) returned 0 [0182.882] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0182.882] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms")) returned 1 [0182.884] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms")) returned 0xffffffff [0182.884] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc606a140, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc606a140, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa5f178d0, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="7e4dca80246863e3.automaticDestinations-ms", cAlternateFileName="7E4DCA~1.AUT")) returned 1 [0182.884] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\7e4dca80246863e3.automaticdestinations-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0182.885] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\7e4dca80246863e3.automaticdestinations-ms.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0182.886] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a00 [0182.886] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0182.886] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0182.972] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x1a00, lpOverlapped=0x0) returned 1 [0182.973] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1a10, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x1a10, lpOverlapped=0x0) returned 1 [0182.974] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0182.994] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.004] CloseHandle (hObject=0xf0) returned 1 [0183.004] CloseHandle (hObject=0xf4) returned 1 [0183.004] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\7e4dca80246863e3.automaticdestinations-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\7e4dca80246863e3.automaticdestinations-ms.dvodltmf")) returned 0 [0183.005] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\7e4dca80246863e3.automaticdestinations-ms.dvodltmf")) returned 0x20 [0183.005] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc606a140, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc606a140, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa5f178d0, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="7e4dca80246863e3.automaticDestinations-ms", cAlternateFileName="7E4DCA~1.AUT")) returned 0x2e8558 [0183.005] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc606a140, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc606a140, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa5f178d0, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="7e4dca80246863e3.automaticDestinations-ms", cAlternateFileName="7E4DCA~1.AUT")) returned 0 [0183.005] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0183.005] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\7e4dca80246863e3.automaticdestinations-ms")) returned 1 [0183.006] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\7e4dca80246863e3.automaticdestinations-ms")) returned 0xffffffff [0183.006] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bce65c0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce4e50, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="eb282ead62b4db87.automaticDestinations-ms", cAlternateFileName="EB282E~1.AUT")) returned 1 [0183.006] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\eb282ead62b4db87.automaticDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\eb282ead62b4db87.automaticdestinations-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0183.007] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\eb282ead62b4db87.automaticDestinations-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\eb282ead62b4db87.automaticdestinations-ms.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0183.008] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe00 [0183.008] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0183.008] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0183.102] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0xe00, lpOverlapped=0x0) returned 1 [0183.104] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0xe10, lpOverlapped=0x0) returned 1 [0183.105] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0183.125] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.134] CloseHandle (hObject=0xf4) returned 1 [0183.134] CloseHandle (hObject=0xf0) returned 1 [0183.134] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\eb282ead62b4db87.automaticDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\eb282ead62b4db87.automaticdestinations-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\eb282ead62b4db87.automaticDestinations-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\eb282ead62b4db87.automaticdestinations-ms.dvodltmf")) returned 0 [0183.135] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\eb282ead62b4db87.automaticDestinations-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\eb282ead62b4db87.automaticdestinations-ms.dvodltmf")) returned 0x20 [0183.135] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\eb282ead62b4db87.automaticDestinations-ms", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bce65c0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce4e50, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="eb282ead62b4db87.automaticDestinations-ms", cAlternateFileName="EB282E~1.AUT")) returned 0x2e8558 [0183.136] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bce65c0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce4e50, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="eb282ead62b4db87.automaticDestinations-ms", cAlternateFileName="EB282E~1.AUT")) returned 0 [0183.136] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0183.136] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\eb282ead62b4db87.automaticDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\eb282ead62b4db87.automaticdestinations-ms")) returned 1 [0183.137] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\eb282ead62b4db87.automaticDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\eb282ead62b4db87.automaticdestinations-ms")) returned 0xffffffff [0183.137] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bce65c0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce4e50, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="eb282ead62b4db87.automaticDestinations-ms", cAlternateFileName="EB282E~1.AUT")) returned 0 [0183.137] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0183.137] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75baffe0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75baffe0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75baffe0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x232, dwReserved0=0x38626434, dwReserved1=0x75612e37, cFileName="az0q2Si.lnk", cAlternateFileName="")) returned 1 [0183.137] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\az0q2Si.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\az0q2si.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.137] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\az0q2Si.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\az0q2si.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0183.138] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x232 [0183.138] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0183.138] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0183.235] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x232, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x232, lpOverlapped=0x0) returned 1 [0183.235] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x240, lpOverlapped=0x0) returned 1 [0183.236] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0183.256] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.266] CloseHandle (hObject=0xdc) returned 1 [0183.266] CloseHandle (hObject=0xf0) returned 1 [0183.266] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\az0q2Si.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\az0q2si.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\az0q2Si.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\az0q2si.lnk.dvodltmf")) returned 0 [0183.267] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\az0q2Si.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\az0q2si.lnk.dvodltmf")) returned 0x20 [0183.267] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\az0q2Si.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75baffe0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75baffe0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75baffe0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x232, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="az0q2Si.lnk", cAlternateFileName="")) returned 0x2e8518 [0183.267] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75baffe0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75baffe0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75baffe0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x232, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="az0q2Si.lnk", cAlternateFileName="")) returned 0 [0183.267] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0183.267] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\az0q2Si.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\az0q2si.lnk")) returned 1 [0183.268] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\az0q2Si.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\az0q2si.lnk")) returned 0xffffffff [0183.268] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x750878c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x750878c0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x750878c0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="BaeJOAr8APa.lnk", cAlternateFileName="BAEJOA~1.LNK")) returned 1 [0183.268] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BaeJOAr8APa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\baejoar8apa.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0183.268] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BaeJOAr8APa.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\baejoar8apa.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.269] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f7 [0183.269] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0183.270] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0183.362] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3f7, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x3f7, lpOverlapped=0x0) returned 1 [0183.363] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x400, lpOverlapped=0x0) returned 1 [0183.364] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0183.402] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.412] CloseHandle (hObject=0xf0) returned 1 [0183.412] CloseHandle (hObject=0xdc) returned 1 [0183.412] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BaeJOAr8APa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\baejoar8apa.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BaeJOAr8APa.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\baejoar8apa.lnk.dvodltmf")) returned 0 [0183.413] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BaeJOAr8APa.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\baejoar8apa.lnk.dvodltmf")) returned 0x20 [0183.413] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BaeJOAr8APa.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x750878c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x750878c0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x750878c0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BaeJOAr8APa.lnk", cAlternateFileName="BAEJOA~1.LNK")) returned 0x2e8518 [0183.413] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x750878c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x750878c0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x750878c0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="BaeJOAr8APa.lnk", cAlternateFileName="BAEJOA~1.LNK")) returned 0 [0183.413] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0183.413] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BaeJOAr8APa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\baejoar8apa.lnk")) returned 1 [0183.414] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BaeJOAr8APa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\baejoar8apa.lnk")) returned 0xffffffff [0183.414] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75465c80, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x768c78e0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x768c78e0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x963, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="bdV6se_Y33.lnk", cAlternateFileName="BDV6SE~1.LNK")) returned 1 [0183.414] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bdV6se_Y33.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bdv6se_y33.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.415] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bdV6se_Y33.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bdv6se_y33.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0183.415] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x963 [0183.415] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0183.416] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0183.510] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x963, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x963, lpOverlapped=0x0) returned 1 [0183.511] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x970, lpOverlapped=0x0) returned 1 [0183.512] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0183.571] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.581] CloseHandle (hObject=0xdc) returned 1 [0183.581] CloseHandle (hObject=0xf0) returned 1 [0183.581] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bdV6se_Y33.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bdv6se_y33.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bdV6se_Y33.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bdv6se_y33.lnk.dvodltmf")) returned 0 [0183.582] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bdV6se_Y33.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bdv6se_y33.lnk.dvodltmf")) returned 0x20 [0183.582] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bdV6se_Y33.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75465c80, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x768c78e0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x768c78e0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x963, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="bdV6se_Y33.lnk", cAlternateFileName="BDV6SE~1.LNK")) returned 0x2e8518 [0183.582] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75465c80, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x768c78e0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x768c78e0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x963, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="bdV6se_Y33.lnk", cAlternateFileName="BDV6SE~1.LNK")) returned 0 [0183.582] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0183.583] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bdV6se_Y33.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bdv6se_y33.lnk")) returned 1 [0183.583] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bdV6se_Y33.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bdv6se_y33.lnk")) returned 0xffffffff [0183.583] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76b02d80, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76b02d80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76b02d80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="bKPyQJpjymh3 ls7X.lnk", cAlternateFileName="BKPYQJ~1.LNK")) returned 1 [0183.584] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bKPyQJpjymh3 ls7X.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bkpyqjpjymh3 ls7x.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0183.584] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bKPyQJpjymh3 ls7X.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bkpyqjpjymh3 ls7x.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.585] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x266 [0183.585] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0183.585] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0183.680] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x266, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x266, lpOverlapped=0x0) returned 1 [0183.681] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x270, lpOverlapped=0x0) returned 1 [0183.682] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0183.702] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.711] CloseHandle (hObject=0xf0) returned 1 [0183.712] CloseHandle (hObject=0xdc) returned 1 [0183.712] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bKPyQJpjymh3 ls7X.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bkpyqjpjymh3 ls7x.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bKPyQJpjymh3 ls7X.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bkpyqjpjymh3 ls7x.lnk.dvodltmf")) returned 0 [0183.713] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bKPyQJpjymh3 ls7X.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bkpyqjpjymh3 ls7x.lnk.dvodltmf")) returned 0x20 [0183.713] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bKPyQJpjymh3 ls7X.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76b02d80, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76b02d80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76b02d80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="bKPyQJpjymh3 ls7X.lnk", cAlternateFileName="BKPYQJ~1.LNK")) returned 0x2e8518 [0183.713] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76b02d80, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76b02d80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76b02d80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="bKPyQJpjymh3 ls7X.lnk", cAlternateFileName="BKPYQJ~1.LNK")) returned 0 [0183.713] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0183.713] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bKPyQJpjymh3 ls7X.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bkpyqjpjymh3 ls7x.lnk")) returned 1 [0183.714] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bKPyQJpjymh3 ls7X.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bkpyqjpjymh3 ls7x.lnk")) returned 0xffffffff [0183.714] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75b89e80, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75b89e80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75b89e80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x14a3, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="bOPAR.lnk", cAlternateFileName="")) returned 1 [0183.714] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bOPAR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bopar.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.714] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bOPAR.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bopar.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0183.715] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14a3 [0183.715] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0183.715] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0183.829] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x14a3, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x14a3, lpOverlapped=0x0) returned 1 [0183.830] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x14b0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x14b0, lpOverlapped=0x0) returned 1 [0183.831] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0183.853] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.863] CloseHandle (hObject=0xdc) returned 1 [0183.863] CloseHandle (hObject=0xf0) returned 1 [0183.872] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bOPAR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bopar.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bOPAR.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bopar.lnk.dvodltmf")) returned 0 [0183.873] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bOPAR.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bopar.lnk.dvodltmf")) returned 0x20 [0183.873] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bOPAR.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75b89e80, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75b89e80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75b89e80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x14a3, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="bOPAR.lnk", cAlternateFileName="")) returned 0x2e8518 [0183.874] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75b89e80, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75b89e80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75b89e80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x14a3, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="bOPAR.lnk", cAlternateFileName="")) returned 0 [0183.874] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0183.874] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bOPAR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bopar.lnk")) returned 1 [0183.875] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bOPAR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bopar.lnk")) returned 0xffffffff [0183.875] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76939d00, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76939d00, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76939d00, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x132a, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="cFa2Xdk.ots.lnk", cAlternateFileName="CFA2XD~1.LNK")) returned 1 [0183.875] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cFa2Xdk.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cfa2xdk.ots.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0183.875] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cFa2Xdk.ots.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cfa2xdk.ots.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0183.876] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x132a [0183.876] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0183.876] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0183.983] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x132a, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x132a, lpOverlapped=0x0) returned 1 [0183.983] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x1330, lpOverlapped=0x0) returned 1 [0183.984] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0184.005] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.014] CloseHandle (hObject=0xf0) returned 1 [0184.014] CloseHandle (hObject=0xdc) returned 1 [0184.015] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cFa2Xdk.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cfa2xdk.ots.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cFa2Xdk.ots.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cfa2xdk.ots.lnk.dvodltmf")) returned 0 [0184.015] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cFa2Xdk.ots.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cfa2xdk.ots.lnk.dvodltmf")) returned 0x20 [0184.015] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cFa2Xdk.ots.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76939d00, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76939d00, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76939d00, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x132a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="cFa2Xdk.ots.lnk", cAlternateFileName="CFA2XD~1.LNK")) returned 0x2e8518 [0184.016] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76939d00, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76939d00, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76939d00, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x132a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="cFa2Xdk.ots.lnk", cAlternateFileName="CFA2XD~1.LNK")) returned 0 [0184.016] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0184.016] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cFa2Xdk.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cfa2xdk.ots.lnk")) returned 1 [0184.017] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cFa2Xdk.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cfa2xdk.ots.lnk")) returned 0xffffffff [0184.017] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75902720, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75902720, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75902720, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="chgwst6vKL.lnk", cAlternateFileName="CHGWST~1.LNK")) returned 1 [0184.017] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\chgwst6vKL.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\chgwst6vkl.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.017] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\chgwst6vKL.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\chgwst6vkl.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0184.018] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x243 [0184.018] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0184.018] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0184.173] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x243, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x243, lpOverlapped=0x0) returned 1 [0184.174] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x250, lpOverlapped=0x0) returned 1 [0184.175] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0184.195] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.205] CloseHandle (hObject=0xdc) returned 1 [0184.205] CloseHandle (hObject=0xf0) returned 1 [0184.205] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\chgwst6vKL.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\chgwst6vkl.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\chgwst6vKL.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\chgwst6vkl.lnk.dvodltmf")) returned 0 [0184.206] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\chgwst6vKL.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\chgwst6vkl.lnk.dvodltmf")) returned 0x20 [0184.206] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\chgwst6vKL.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75902720, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75902720, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75902720, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="chgwst6vKL.lnk", cAlternateFileName="CHGWST~1.LNK")) returned 0x2e8518 [0184.206] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75902720, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75902720, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75902720, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="chgwst6vKL.lnk", cAlternateFileName="CHGWST~1.LNK")) returned 0 [0184.206] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0184.206] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\chgwst6vKL.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\chgwst6vkl.lnk")) returned 1 [0184.207] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\chgwst6vKL.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\chgwst6vkl.lnk")) returned 0xffffffff [0184.207] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="CustomDestinations", cAlternateFileName="CUSTOM~1")) returned 1 [0184.207] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaa, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0184.208] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaa, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0184.208] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc975e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc975e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0xaa, dwReserved1=0x0, cFileName="1b4dd67f29cb1962.customDestinations-ms", cAlternateFileName="1B4DD6~1.CUS")) returned 1 [0184.208] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\1b4dd67f29cb1962.customdestinations-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.208] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\1b4dd67f29cb1962.customdestinations-ms.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0184.209] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0184.209] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0184.210] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0184.304] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x18, lpOverlapped=0x0) returned 1 [0184.351] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x20, lpOverlapped=0x0) returned 1 [0184.352] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0184.478] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.488] CloseHandle (hObject=0xdc) returned 1 [0184.488] CloseHandle (hObject=0xf4) returned 1 [0184.488] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\1b4dd67f29cb1962.customdestinations-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\1b4dd67f29cb1962.customdestinations-ms.dvodltmf")) returned 0 [0184.489] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\1b4dd67f29cb1962.customdestinations-ms.dvodltmf")) returned 0x20 [0184.489] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc975e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc975e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="1b4dd67f29cb1962.customDestinations-ms", cAlternateFileName="1B4DD6~1.CUS")) returned 0x2e8558 [0184.489] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc975e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc975e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="1b4dd67f29cb1962.customDestinations-ms", cAlternateFileName="1B4DD6~1.CUS")) returned 0 [0184.489] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0184.489] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\1b4dd67f29cb1962.customdestinations-ms")) returned 1 [0184.490] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\1b4dd67f29cb1962.customdestinations-ms")) returned 0xffffffff [0184.490] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe22bfd60, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0xcbe116e0, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xcbe116e0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="590aee7bdd69b59b.customDestinations-ms", cAlternateFileName="590AEE~1.CUS")) returned 1 [0184.490] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\590aee7bdd69b59b.customdestinations-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0184.491] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\590aee7bdd69b59b.customdestinations-ms.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.492] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f68 [0184.492] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0184.492] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0184.579] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1f68, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x1f68, lpOverlapped=0x0) returned 1 [0184.581] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1f70, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x1f70, lpOverlapped=0x0) returned 1 [0184.582] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0184.602] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.611] CloseHandle (hObject=0xf4) returned 1 [0184.611] CloseHandle (hObject=0xdc) returned 1 [0184.612] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\590aee7bdd69b59b.customdestinations-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\590aee7bdd69b59b.customdestinations-ms.dvodltmf")) returned 0 [0184.612] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\590aee7bdd69b59b.customdestinations-ms.dvodltmf")) returned 0x20 [0184.613] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe22bfd60, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0xcbe116e0, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xcbe116e0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="590aee7bdd69b59b.customDestinations-ms", cAlternateFileName="590AEE~1.CUS")) returned 0x2e8558 [0184.613] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe22bfd60, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0xcbe116e0, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xcbe116e0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="590aee7bdd69b59b.customDestinations-ms", cAlternateFileName="590AEE~1.CUS")) returned 0 [0184.613] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0184.613] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\590aee7bdd69b59b.customdestinations-ms")) returned 1 [0184.614] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\590aee7bdd69b59b.customdestinations-ms")) returned 0xffffffff [0184.614] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2da822a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2daa8400, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x43a3, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="5afe4de1b92fc382.customDestinations-ms", cAlternateFileName="5AFE4D~1.CUS")) returned 1 [0184.614] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5afe4de1b92fc382.customdestinations-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.615] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5afe4de1b92fc382.customdestinations-ms.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0184.616] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43a3 [0184.616] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0184.616] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0184.706] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x43a3, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x43a3, lpOverlapped=0x0) returned 1 [0184.707] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x43b0, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x43b0, lpOverlapped=0x0) returned 1 [0184.709] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0184.729] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.738] CloseHandle (hObject=0xdc) returned 1 [0184.738] CloseHandle (hObject=0xf4) returned 1 [0184.739] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5afe4de1b92fc382.customdestinations-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5afe4de1b92fc382.customdestinations-ms.dvodltmf")) returned 0 [0184.739] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5afe4de1b92fc382.customdestinations-ms.dvodltmf")) returned 0x20 [0184.739] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2da822a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2daa8400, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x43a3, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5afe4de1b92fc382.customDestinations-ms", cAlternateFileName="5AFE4D~1.CUS")) returned 0x2e8558 [0184.740] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2da822a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2daa8400, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x43a3, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="5afe4de1b92fc382.customDestinations-ms", cAlternateFileName="5AFE4D~1.CUS")) returned 0 [0184.740] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0184.740] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5afe4de1b92fc382.customdestinations-ms")) returned 1 [0184.741] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5afe4de1b92fc382.customdestinations-ms")) returned 0xffffffff [0184.741] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x17d4, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="5d696d521de238c3.customDestinations-ms", cAlternateFileName="5D696D~1.CUS")) returned 1 [0184.741] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5d696d521de238c3.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5d696d521de238c3.customdestinations-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0184.742] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5d696d521de238c3.customDestinations-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5d696d521de238c3.customdestinations-ms.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.742] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17d4 [0184.742] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0184.743] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0184.828] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x17d4, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x17d4, lpOverlapped=0x0) returned 1 [0184.830] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x17e0, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x17e0, lpOverlapped=0x0) returned 1 [0184.831] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0184.850] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.860] CloseHandle (hObject=0xf4) returned 1 [0184.860] CloseHandle (hObject=0xdc) returned 1 [0184.860] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5d696d521de238c3.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5d696d521de238c3.customdestinations-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5d696d521de238c3.customDestinations-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5d696d521de238c3.customdestinations-ms.dvodltmf")) returned 0 [0184.861] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5d696d521de238c3.customDestinations-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5d696d521de238c3.customdestinations-ms.dvodltmf")) returned 0x20 [0184.861] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5d696d521de238c3.customDestinations-ms", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x17d4, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5d696d521de238c3.customDestinations-ms", cAlternateFileName="5D696D~1.CUS")) returned 0x2e8558 [0184.861] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x17d4, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5d696d521de238c3.customDestinations-ms", cAlternateFileName="5D696D~1.CUS")) returned 0 [0184.861] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0184.861] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5d696d521de238c3.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5d696d521de238c3.customdestinations-ms")) returned 1 [0184.862] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5d696d521de238c3.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5d696d521de238c3.customdestinations-ms")) returned 0xffffffff [0184.862] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc975e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc975e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="7e4dca80246863e3.customDestinations-ms", cAlternateFileName="7E4DCA~1.CUS")) returned 1 [0184.862] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.863] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0184.864] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0184.864] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0184.864] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0184.946] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x18, lpOverlapped=0x0) returned 1 [0184.947] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x20, lpOverlapped=0x0) returned 1 [0184.948] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0184.967] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.977] CloseHandle (hObject=0xdc) returned 1 [0184.977] CloseHandle (hObject=0xf4) returned 1 [0184.977] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms.dvodltmf")) returned 0 [0184.978] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms.dvodltmf")) returned 0x20 [0184.978] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc975e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc975e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="7e4dca80246863e3.customDestinations-ms", cAlternateFileName="7E4DCA~1.CUS")) returned 0x2e8558 [0184.978] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc975e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc975e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="7e4dca80246863e3.customDestinations-ms", cAlternateFileName="7E4DCA~1.CUS")) returned 0 [0184.978] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0184.978] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms")) returned 1 [0184.979] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms")) returned 0xffffffff [0184.980] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cb126c0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5ddd1400, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5ddd1400, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x23ff, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="be71009ff8bb02a2.customDestinations-ms", cAlternateFileName="BE7100~1.CUS")) returned 1 [0184.980] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\be71009ff8bb02a2.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\be71009ff8bb02a2.customdestinations-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0184.981] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\be71009ff8bb02a2.customDestinations-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\be71009ff8bb02a2.customdestinations-ms.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0184.982] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x23ff [0184.982] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0184.982] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0185.076] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x23ff, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x23ff, lpOverlapped=0x0) returned 1 [0185.077] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x2400, lpOverlapped=0x0) returned 1 [0185.078] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0185.098] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.107] CloseHandle (hObject=0xf4) returned 1 [0185.107] CloseHandle (hObject=0xdc) returned 1 [0185.107] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\be71009ff8bb02a2.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\be71009ff8bb02a2.customdestinations-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\be71009ff8bb02a2.customDestinations-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\be71009ff8bb02a2.customdestinations-ms.dvodltmf")) returned 0 [0185.108] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\be71009ff8bb02a2.customDestinations-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\be71009ff8bb02a2.customdestinations-ms.dvodltmf")) returned 0x20 [0185.109] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\be71009ff8bb02a2.customDestinations-ms", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cb126c0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5ddd1400, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5ddd1400, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x23ff, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="be71009ff8bb02a2.customDestinations-ms", cAlternateFileName="BE7100~1.CUS")) returned 0x2e8558 [0185.109] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cb126c0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5ddd1400, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5ddd1400, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x23ff, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="be71009ff8bb02a2.customDestinations-ms", cAlternateFileName="BE7100~1.CUS")) returned 0 [0185.109] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0185.109] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\be71009ff8bb02a2.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\be71009ff8bb02a2.customdestinations-ms")) returned 1 [0185.110] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\be71009ff8bb02a2.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\be71009ff8bb02a2.customdestinations-ms")) returned 0xffffffff [0185.110] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a388960, ftCreationTime.dwHighDateTime=0x1d42023, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="d93f411851d7c929.customDestinations-ms", cAlternateFileName="D93F41~1.CUS")) returned 1 [0185.110] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\d93f411851d7c929.customdestinations-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0185.111] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\d93f411851d7c929.customdestinations-ms.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0185.112] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f68 [0185.112] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0185.113] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0185.198] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1f68, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x1f68, lpOverlapped=0x0) returned 1 [0185.199] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1f70, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x1f70, lpOverlapped=0x0) returned 1 [0185.200] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0185.220] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.229] CloseHandle (hObject=0xdc) returned 1 [0185.230] CloseHandle (hObject=0xf4) returned 1 [0185.230] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\d93f411851d7c929.customdestinations-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\d93f411851d7c929.customdestinations-ms.dvodltmf")) returned 0 [0185.231] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\d93f411851d7c929.customdestinations-ms.dvodltmf")) returned 0x20 [0185.231] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a388960, ftCreationTime.dwHighDateTime=0x1d42023, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="d93f411851d7c929.customDestinations-ms", cAlternateFileName="D93F41~1.CUS")) returned 0x2e8558 [0185.231] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a388960, ftCreationTime.dwHighDateTime=0x1d42023, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="d93f411851d7c929.customDestinations-ms", cAlternateFileName="D93F41~1.CUS")) returned 0 [0185.231] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0185.231] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\d93f411851d7c929.customdestinations-ms")) returned 1 [0185.232] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\d93f411851d7c929.customdestinations-ms")) returned 0xffffffff [0185.232] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a388960, ftCreationTime.dwHighDateTime=0x1d42023, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="d93f411851d7c929.customDestinations-ms", cAlternateFileName="D93F41~1.CUS")) returned 0 [0185.232] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0185.232] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75381440, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75381440, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75381440, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x195a, dwReserved0=0x32396337, dwReserved1=0x75632e39, cFileName="CVGOKKt.lnk", cAlternateFileName="")) returned 1 [0185.233] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CVGOKKt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cvgokkt.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0185.233] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CVGOKKt.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cvgokkt.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0185.234] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x195a [0185.234] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0185.234] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0185.318] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x195a, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x195a, lpOverlapped=0x0) returned 1 [0185.319] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x1960, lpOverlapped=0x0) returned 1 [0185.320] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0185.339] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.348] CloseHandle (hObject=0xf0) returned 1 [0185.349] CloseHandle (hObject=0xf4) returned 1 [0185.349] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CVGOKKt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cvgokkt.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CVGOKKt.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cvgokkt.lnk.dvodltmf")) returned 0 [0185.350] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CVGOKKt.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cvgokkt.lnk.dvodltmf")) returned 0x20 [0185.350] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CVGOKKt.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75381440, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75381440, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75381440, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x195a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="CVGOKKt.lnk", cAlternateFileName="")) returned 0x2e8518 [0185.350] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75381440, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75381440, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75381440, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x195a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="CVGOKKt.lnk", cAlternateFileName="")) returned 0 [0185.350] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0185.350] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CVGOKKt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cvgokkt.lnk")) returned 1 [0185.351] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CVGOKKt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cvgokkt.lnk")) returned 0xffffffff [0185.351] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762d41e0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x762d41e0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x762d41e0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa5d, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="d6KzL_oJsAf LyXW.lnk", cAlternateFileName="D6KZL_~1.LNK")) returned 1 [0185.351] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d6KzL_oJsAf LyXW.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\d6kzl_ojsaf lyxw.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0185.351] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d6KzL_oJsAf LyXW.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\d6kzl_ojsaf lyxw.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0185.352] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa5d [0185.352] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0185.353] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0185.452] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa5d, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xa5d, lpOverlapped=0x0) returned 1 [0185.452] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xa60, lpOverlapped=0x0) returned 1 [0185.453] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0185.473] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.482] CloseHandle (hObject=0xf4) returned 1 [0185.482] CloseHandle (hObject=0xf0) returned 1 [0185.482] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d6KzL_oJsAf LyXW.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\d6kzl_ojsaf lyxw.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d6KzL_oJsAf LyXW.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\d6kzl_ojsaf lyxw.lnk.dvodltmf")) returned 0 [0185.483] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d6KzL_oJsAf LyXW.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\d6kzl_ojsaf lyxw.lnk.dvodltmf")) returned 0x20 [0185.483] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d6KzL_oJsAf LyXW.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762d41e0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x762d41e0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x762d41e0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa5d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="d6KzL_oJsAf LyXW.lnk", cAlternateFileName="D6KZL_~1.LNK")) returned 0x2e8518 [0185.483] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762d41e0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x762d41e0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x762d41e0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa5d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="d6KzL_oJsAf LyXW.lnk", cAlternateFileName="D6KZL_~1.LNK")) returned 0 [0185.484] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0185.484] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d6KzL_oJsAf LyXW.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\d6kzl_ojsaf lyxw.lnk")) returned 1 [0185.484] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d6KzL_oJsAf LyXW.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\d6kzl_ojsaf lyxw.lnk")) returned 0xffffffff [0185.485] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x768eda40, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x768eda40, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x768eda40, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1878, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="dCH4fBzVmdH.ots.lnk", cAlternateFileName="DCH4FB~1.LNK")) returned 1 [0185.485] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dCH4fBzVmdH.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dch4fbzvmdh.ots.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0185.485] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dCH4fBzVmdH.ots.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dch4fbzvmdh.ots.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0185.486] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1878 [0185.486] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0185.486] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0185.571] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1878, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x1878, lpOverlapped=0x0) returned 1 [0185.572] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1880, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x1880, lpOverlapped=0x0) returned 1 [0185.573] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0185.593] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.602] CloseHandle (hObject=0xf0) returned 1 [0185.602] CloseHandle (hObject=0xf4) returned 1 [0185.602] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dCH4fBzVmdH.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dch4fbzvmdh.ots.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dCH4fBzVmdH.ots.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dch4fbzvmdh.ots.lnk.dvodltmf")) returned 0 [0185.603] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dCH4fBzVmdH.ots.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dch4fbzvmdh.ots.lnk.dvodltmf")) returned 0x20 [0185.603] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dCH4fBzVmdH.ots.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x768eda40, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x768eda40, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x768eda40, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1878, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="dCH4fBzVmdH.ots.lnk", cAlternateFileName="DCH4FB~1.LNK")) returned 0x2e8518 [0185.604] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x768eda40, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x768eda40, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x768eda40, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1878, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="dCH4fBzVmdH.ots.lnk", cAlternateFileName="DCH4FB~1.LNK")) returned 0 [0185.604] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0185.604] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dCH4fBzVmdH.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dch4fbzvmdh.ots.lnk")) returned 1 [0185.605] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dCH4fBzVmdH.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dch4fbzvmdh.ots.lnk")) returned 0xffffffff [0185.605] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0185.605] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0185.605] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0185.606] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b0 [0185.606] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0185.606] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0185.692] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1b0, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x1b0, lpOverlapped=0x0) returned 1 [0185.693] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x1c0, lpOverlapped=0x0) returned 1 [0185.694] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0185.714] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.724] CloseHandle (hObject=0xf4) returned 1 [0185.724] CloseHandle (hObject=0xf0) returned 1 [0185.724] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini.dvodltmf")) returned 0 [0185.727] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini.dvodltmf")) returned 0x20 [0185.727] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8518 [0185.727] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0185.727] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0185.728] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini")) returned 1 [0185.729] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini")) returned 0xffffffff [0185.729] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76913ba0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76913ba0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76939d00, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x275, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="djnZYFl1eRGz-4XF4Bnz.lnk", cAlternateFileName="DJNZYF~1.LNK")) returned 1 [0185.729] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\djnZYFl1eRGz-4XF4Bnz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\djnzyfl1ergz-4xf4bnz.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0185.729] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\djnZYFl1eRGz-4XF4Bnz.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\djnzyfl1ergz-4xf4bnz.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0185.730] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x275 [0185.730] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0185.730] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0185.845] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x275, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x275, lpOverlapped=0x0) returned 1 [0185.846] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x280, lpOverlapped=0x0) returned 1 [0185.847] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0185.868] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.877] CloseHandle (hObject=0xf0) returned 1 [0185.878] CloseHandle (hObject=0xf4) returned 1 [0185.878] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\djnZYFl1eRGz-4XF4Bnz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\djnzyfl1ergz-4xf4bnz.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\djnZYFl1eRGz-4XF4Bnz.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\djnzyfl1ergz-4xf4bnz.lnk.dvodltmf")) returned 0 [0185.879] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\djnZYFl1eRGz-4XF4Bnz.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\djnzyfl1ergz-4xf4bnz.lnk.dvodltmf")) returned 0x20 [0185.879] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\djnZYFl1eRGz-4XF4Bnz.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76913ba0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76913ba0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76939d00, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x275, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="djnZYFl1eRGz-4XF4Bnz.lnk", cAlternateFileName="DJNZYF~1.LNK")) returned 0x2e8518 [0185.879] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76913ba0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76913ba0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76939d00, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x275, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="djnZYFl1eRGz-4XF4Bnz.lnk", cAlternateFileName="DJNZYF~1.LNK")) returned 0 [0185.879] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0185.879] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\djnZYFl1eRGz-4XF4Bnz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\djnzyfl1ergz-4xf4bnz.lnk")) returned 1 [0185.880] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\djnZYFl1eRGz-4XF4Bnz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\djnzyfl1ergz-4xf4bnz.lnk")) returned 0xffffffff [0185.880] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x763b8a20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x763b8a20, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x763b8a20, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="dk0FrGz.lnk", cAlternateFileName="")) returned 1 [0185.880] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dk0FrGz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dk0frgz.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0185.880] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dk0FrGz.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dk0frgz.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0185.881] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa16 [0185.881] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0185.881] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0185.968] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa16, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xa16, lpOverlapped=0x0) returned 1 [0185.969] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xa20, lpOverlapped=0x0) returned 1 [0185.970] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0185.990] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.000] CloseHandle (hObject=0xf4) returned 1 [0186.000] CloseHandle (hObject=0xf0) returned 1 [0186.000] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dk0FrGz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dk0frgz.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dk0FrGz.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dk0frgz.lnk.dvodltmf")) returned 0 [0186.001] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dk0FrGz.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dk0frgz.lnk.dvodltmf")) returned 0x20 [0186.001] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dk0FrGz.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x763b8a20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x763b8a20, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x763b8a20, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="dk0FrGz.lnk", cAlternateFileName="")) returned 0x2e8518 [0186.001] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x763b8a20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x763b8a20, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x763b8a20, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="dk0FrGz.lnk", cAlternateFileName="")) returned 0 [0186.001] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0186.001] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dk0FrGz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dk0frgz.lnk")) returned 1 [0186.002] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dk0FrGz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dk0frgz.lnk")) returned 0xffffffff [0186.002] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7604ca80, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7604ca80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7604ca80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x41f, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="DobdDZxx8w_EmcHDxq3.lnk", cAlternateFileName="DOBDDZ~1.LNK")) returned 1 [0186.002] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DobdDZxx8w_EmcHDxq3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dobddzxx8w_emchdxq3.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0186.002] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DobdDZxx8w_EmcHDxq3.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dobddzxx8w_emchdxq3.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0186.003] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x41f [0186.003] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0186.004] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0186.096] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x41f, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x41f, lpOverlapped=0x0) returned 1 [0186.097] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x420, lpOverlapped=0x0) returned 1 [0186.098] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0186.118] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.128] CloseHandle (hObject=0xf0) returned 1 [0186.128] CloseHandle (hObject=0xf4) returned 1 [0186.128] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DobdDZxx8w_EmcHDxq3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dobddzxx8w_emchdxq3.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DobdDZxx8w_EmcHDxq3.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dobddzxx8w_emchdxq3.lnk.dvodltmf")) returned 0 [0186.129] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DobdDZxx8w_EmcHDxq3.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dobddzxx8w_emchdxq3.lnk.dvodltmf")) returned 0x20 [0186.129] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DobdDZxx8w_EmcHDxq3.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7604ca80, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7604ca80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7604ca80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x41f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="DobdDZxx8w_EmcHDxq3.lnk", cAlternateFileName="DOBDDZ~1.LNK")) returned 0x2e8518 [0186.129] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7604ca80, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7604ca80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7604ca80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x41f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="DobdDZxx8w_EmcHDxq3.lnk", cAlternateFileName="DOBDDZ~1.LNK")) returned 0 [0186.129] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0186.129] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DobdDZxx8w_EmcHDxq3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dobddzxx8w_emchdxq3.lnk")) returned 1 [0186.130] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DobdDZxx8w_EmcHDxq3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dobddzxx8w_emchdxq3.lnk")) returned 0xffffffff [0186.130] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75596780, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75596780, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75596780, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe7f, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="dyxnQIlp.lnk", cAlternateFileName="")) returned 1 [0186.130] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dyxnQIlp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dyxnqilp.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0186.130] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dyxnQIlp.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dyxnqilp.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0186.131] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe7f [0186.131] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0186.132] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0186.216] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe7f, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xe7f, lpOverlapped=0x0) returned 1 [0186.217] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xe80, lpOverlapped=0x0) returned 1 [0186.218] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0186.238] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.248] CloseHandle (hObject=0xf4) returned 1 [0186.248] CloseHandle (hObject=0xf0) returned 1 [0186.248] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dyxnQIlp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dyxnqilp.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dyxnQIlp.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dyxnqilp.lnk.dvodltmf")) returned 0 [0186.249] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dyxnQIlp.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dyxnqilp.lnk.dvodltmf")) returned 0x20 [0186.249] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dyxnQIlp.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75596780, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75596780, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75596780, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe7f, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="dyxnQIlp.lnk", cAlternateFileName="")) returned 0x2e8518 [0186.249] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75596780, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75596780, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75596780, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe7f, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="dyxnQIlp.lnk", cAlternateFileName="")) returned 0 [0186.249] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0186.249] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dyxnQIlp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dyxnqilp.lnk")) returned 1 [0186.250] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dyxnQIlp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dyxnqilp.lnk")) returned 0xffffffff [0186.251] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74beae20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76ab6ac0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76ab6ac0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe40, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="FB8ZrXYafps9Z.lnk", cAlternateFileName="FB8ZRX~1.LNK")) returned 1 [0186.251] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FB8ZrXYafps9Z.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fb8zrxyafps9z.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0186.251] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FB8ZrXYafps9Z.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fb8zrxyafps9z.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0186.252] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe40 [0186.252] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0186.252] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0186.337] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe40, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xe40, lpOverlapped=0x0) returned 1 [0186.338] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xe50, lpOverlapped=0x0) returned 1 [0186.339] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0186.364] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.374] CloseHandle (hObject=0xf0) returned 1 [0186.374] CloseHandle (hObject=0xf4) returned 1 [0186.374] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FB8ZrXYafps9Z.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fb8zrxyafps9z.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FB8ZrXYafps9Z.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fb8zrxyafps9z.lnk.dvodltmf")) returned 0 [0186.375] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FB8ZrXYafps9Z.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fb8zrxyafps9z.lnk.dvodltmf")) returned 0x20 [0186.375] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FB8ZrXYafps9Z.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74beae20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76ab6ac0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76ab6ac0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe40, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="FB8ZrXYafps9Z.lnk", cAlternateFileName="FB8ZRX~1.LNK")) returned 0x2e8518 [0186.375] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74beae20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76ab6ac0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76ab6ac0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe40, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="FB8ZrXYafps9Z.lnk", cAlternateFileName="FB8ZRX~1.LNK")) returned 0 [0186.375] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0186.375] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FB8ZrXYafps9Z.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fb8zrxyafps9z.lnk")) returned 1 [0186.376] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FB8ZrXYafps9Z.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fb8zrxyafps9z.lnk")) returned 0xffffffff [0186.376] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762fa340, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x762fa340, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x762fa340, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xed2, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="fqnZE84.lnk", cAlternateFileName="")) returned 1 [0186.376] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fqnZE84.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fqnze84.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0186.376] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fqnZE84.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fqnze84.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0186.377] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xed2 [0186.377] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0186.378] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0186.474] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xed2, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xed2, lpOverlapped=0x0) returned 1 [0186.475] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xee0, lpOverlapped=0x0) returned 1 [0186.475] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0186.495] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.505] CloseHandle (hObject=0xf4) returned 1 [0186.505] CloseHandle (hObject=0xf0) returned 1 [0186.505] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fqnZE84.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fqnze84.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fqnZE84.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fqnze84.lnk.dvodltmf")) returned 0 [0186.506] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fqnZE84.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fqnze84.lnk.dvodltmf")) returned 0x20 [0186.506] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fqnZE84.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762fa340, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x762fa340, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x762fa340, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xed2, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="fqnZE84.lnk", cAlternateFileName="")) returned 0x2e8518 [0186.506] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762fa340, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x762fa340, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x762fa340, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xed2, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="fqnZE84.lnk", cAlternateFileName="")) returned 0 [0186.506] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0186.506] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fqnZE84.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fqnze84.lnk")) returned 1 [0186.507] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fqnZE84.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fqnze84.lnk")) returned 0xffffffff [0186.507] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7617d580, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7617d580, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7617d580, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="F_tFBwHbMGp.lnk", cAlternateFileName="F_TFBW~1.LNK")) returned 1 [0186.507] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F_tFBwHbMGp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\f_tfbwhbmgp.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0186.508] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F_tFBwHbMGp.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\f_tfbwhbmgp.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0186.509] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f7 [0186.509] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0186.509] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0186.593] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3f7, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x3f7, lpOverlapped=0x0) returned 1 [0186.594] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x400, lpOverlapped=0x0) returned 1 [0186.595] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0186.615] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.624] CloseHandle (hObject=0xf0) returned 1 [0186.624] CloseHandle (hObject=0xf4) returned 1 [0186.624] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F_tFBwHbMGp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\f_tfbwhbmgp.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F_tFBwHbMGp.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\f_tfbwhbmgp.lnk.dvodltmf")) returned 0 [0186.626] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F_tFBwHbMGp.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\f_tfbwhbmgp.lnk.dvodltmf")) returned 0x20 [0186.626] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F_tFBwHbMGp.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7617d580, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7617d580, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7617d580, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="F_tFBwHbMGp.lnk", cAlternateFileName="F_TFBW~1.LNK")) returned 0x2e8518 [0186.626] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7617d580, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7617d580, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7617d580, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="F_tFBwHbMGp.lnk", cAlternateFileName="F_TFBW~1.LNK")) returned 0 [0186.626] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0186.626] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F_tFBwHbMGp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\f_tfbwhbmgp.lnk")) returned 1 [0186.627] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F_tFBwHbMGp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\f_tfbwhbmgp.lnk")) returned 0xffffffff [0186.627] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x763204a0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x763204a0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x763204a0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x3dc, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="G7YhK0.flv.lnk", cAlternateFileName="G7YHK0~1.LNK")) returned 1 [0186.627] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\G7YhK0.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\g7yhk0.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0186.627] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\G7YhK0.flv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\g7yhk0.flv.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0186.628] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3dc [0186.628] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0186.629] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0186.715] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3dc, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x3dc, lpOverlapped=0x0) returned 1 [0186.716] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x3e0, lpOverlapped=0x0) returned 1 [0186.716] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0186.736] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.746] CloseHandle (hObject=0xf4) returned 1 [0186.746] CloseHandle (hObject=0xf0) returned 1 [0186.746] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\G7YhK0.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\g7yhk0.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\G7YhK0.flv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\g7yhk0.flv.lnk.dvodltmf")) returned 0 [0186.747] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\G7YhK0.flv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\g7yhk0.flv.lnk.dvodltmf")) returned 0x20 [0186.747] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\G7YhK0.flv.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x763204a0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x763204a0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x763204a0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x3dc, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="G7YhK0.flv.lnk", cAlternateFileName="G7YHK0~1.LNK")) returned 0x2e8518 [0186.747] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x763204a0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x763204a0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x763204a0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x3dc, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="G7YhK0.flv.lnk", cAlternateFileName="G7YHK0~1.LNK")) returned 0 [0186.747] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0186.747] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\G7YhK0.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\g7yhk0.flv.lnk")) returned 1 [0186.748] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\G7YhK0.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\g7yhk0.flv.lnk")) returned 0xffffffff [0186.748] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75902720, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75902720, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75902720, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="g81m6ECGCroGTY.lnk", cAlternateFileName="G81M6E~1.LNK")) returned 1 [0186.748] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g81m6ECGCroGTY.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\g81m6ecgcrogty.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0186.748] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g81m6ECGCroGTY.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\g81m6ecgcrogty.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0186.749] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa63 [0186.749] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0186.750] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0186.835] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa63, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xa63, lpOverlapped=0x0) returned 1 [0186.835] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xa70, lpOverlapped=0x0) returned 1 [0186.836] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0186.856] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.866] CloseHandle (hObject=0xf0) returned 1 [0186.866] CloseHandle (hObject=0xf4) returned 1 [0186.866] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g81m6ECGCroGTY.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\g81m6ecgcrogty.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g81m6ECGCroGTY.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\g81m6ecgcrogty.lnk.dvodltmf")) returned 0 [0186.867] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g81m6ECGCroGTY.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\g81m6ecgcrogty.lnk.dvodltmf")) returned 0x20 [0186.867] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g81m6ECGCroGTY.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75902720, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75902720, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75902720, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="g81m6ECGCroGTY.lnk", cAlternateFileName="G81M6E~1.LNK")) returned 0x2e8518 [0186.868] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75902720, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75902720, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75902720, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="g81m6ECGCroGTY.lnk", cAlternateFileName="G81M6E~1.LNK")) returned 0 [0186.868] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0186.868] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g81m6ECGCroGTY.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\g81m6ecgcrogty.lnk")) returned 1 [0186.869] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g81m6ECGCroGTY.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\g81m6ecgcrogty.lnk")) returned 0xffffffff [0186.869] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76b4f040, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76b4f040, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76b4f040, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xed2, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="gBMJ et.lnk", cAlternateFileName="GBMJET~1.LNK")) returned 1 [0186.869] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gBMJ et.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gbmj et.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0186.869] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gBMJ et.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gbmj et.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0186.870] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xed2 [0186.870] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0186.870] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0186.955] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xed2, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xed2, lpOverlapped=0x0) returned 1 [0186.956] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xee0, lpOverlapped=0x0) returned 1 [0186.957] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0186.977] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.987] CloseHandle (hObject=0xf4) returned 1 [0186.987] CloseHandle (hObject=0xf0) returned 1 [0186.987] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gBMJ et.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gbmj et.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gBMJ et.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gbmj et.lnk.dvodltmf")) returned 0 [0186.988] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gBMJ et.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gbmj et.lnk.dvodltmf")) returned 0x20 [0186.988] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gBMJ et.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76b4f040, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76b4f040, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76b4f040, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xed2, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="gBMJ et.lnk", cAlternateFileName="GBMJET~1.LNK")) returned 0x2e8518 [0186.988] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76b4f040, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76b4f040, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76b4f040, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xed2, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="gBMJ et.lnk", cAlternateFileName="GBMJET~1.LNK")) returned 0 [0186.988] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0186.988] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gBMJ et.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gbmj et.lnk")) returned 1 [0186.989] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gBMJ et.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gbmj et.lnk")) returned 0xffffffff [0186.989] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76cf1f60, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76cf1f60, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76cf1f60, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="GIzzqolE22rY6ywiGA.lnk", cAlternateFileName="GIZZQO~1.LNK")) returned 1 [0186.989] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GIzzqolE22rY6ywiGA.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gizzqole22ry6ywiga.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0186.989] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GIzzqolE22rY6ywiGA.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gizzqole22ry6ywiga.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0186.990] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa8f [0186.990] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0186.991] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0187.075] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa8f, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xa8f, lpOverlapped=0x0) returned 1 [0187.076] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xa90, lpOverlapped=0x0) returned 1 [0187.077] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0187.106] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.116] CloseHandle (hObject=0xf0) returned 1 [0187.116] CloseHandle (hObject=0xf4) returned 1 [0187.116] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GIzzqolE22rY6ywiGA.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gizzqole22ry6ywiga.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GIzzqolE22rY6ywiGA.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gizzqole22ry6ywiga.lnk.dvodltmf")) returned 0 [0187.117] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GIzzqolE22rY6ywiGA.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gizzqole22ry6ywiga.lnk.dvodltmf")) returned 0x20 [0187.117] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GIzzqolE22rY6ywiGA.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76cf1f60, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76cf1f60, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76cf1f60, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="GIzzqolE22rY6ywiGA.lnk", cAlternateFileName="GIZZQO~1.LNK")) returned 0x2e8518 [0187.117] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76cf1f60, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76cf1f60, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76cf1f60, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="GIzzqolE22rY6ywiGA.lnk", cAlternateFileName="GIZZQO~1.LNK")) returned 0 [0187.117] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0187.117] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GIzzqolE22rY6ywiGA.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gizzqole22ry6ywiga.lnk")) returned 1 [0187.118] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GIzzqolE22rY6ywiGA.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gizzqole22ry6ywiga.lnk")) returned 0xffffffff [0187.118] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762ae080, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x762ae080, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x762ae080, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Gm91LIlj.lnk", cAlternateFileName="")) returned 1 [0187.118] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gm91LIlj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gm91lilj.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0187.118] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gm91LIlj.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gm91lilj.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0187.119] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa21 [0187.119] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0187.120] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0187.205] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa21, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xa21, lpOverlapped=0x0) returned 1 [0187.206] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xa30, lpOverlapped=0x0) returned 1 [0187.207] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0187.227] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.236] CloseHandle (hObject=0xf4) returned 1 [0187.236] CloseHandle (hObject=0xf0) returned 1 [0187.237] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gm91LIlj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gm91lilj.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gm91LIlj.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gm91lilj.lnk.dvodltmf")) returned 0 [0187.237] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gm91LIlj.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gm91lilj.lnk.dvodltmf")) returned 0x20 [0187.237] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gm91LIlj.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762ae080, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x762ae080, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x762ae080, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Gm91LIlj.lnk", cAlternateFileName="")) returned 0x2e8518 [0187.238] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762ae080, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x762ae080, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x762ae080, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Gm91LIlj.lnk", cAlternateFileName="")) returned 0 [0187.238] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0187.238] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gm91LIlj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gm91lilj.lnk")) returned 1 [0187.239] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gm91LIlj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gm91lilj.lnk")) returned 0xffffffff [0187.239] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7655b940, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7655b940, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7655b940, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1459, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="gpHSxu6OeEFyb_1eOz.flv.lnk", cAlternateFileName="GPHSXU~1.LNK")) returned 1 [0187.239] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gpHSxu6OeEFyb_1eOz.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gphsxu6oeefyb_1eoz.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0187.239] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gpHSxu6OeEFyb_1eOz.flv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gphsxu6oeefyb_1eoz.flv.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0187.240] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1459 [0187.240] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0187.240] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0187.325] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1459, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x1459, lpOverlapped=0x0) returned 1 [0187.326] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1460, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x1460, lpOverlapped=0x0) returned 1 [0187.327] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0187.347] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.357] CloseHandle (hObject=0xf0) returned 1 [0187.357] CloseHandle (hObject=0xf4) returned 1 [0187.357] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gpHSxu6OeEFyb_1eOz.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gphsxu6oeefyb_1eoz.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gpHSxu6OeEFyb_1eOz.flv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gphsxu6oeefyb_1eoz.flv.lnk.dvodltmf")) returned 0 [0187.358] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gpHSxu6OeEFyb_1eOz.flv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gphsxu6oeefyb_1eoz.flv.lnk.dvodltmf")) returned 0x20 [0187.358] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gpHSxu6OeEFyb_1eOz.flv.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7655b940, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7655b940, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7655b940, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1459, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="gpHSxu6OeEFyb_1eOz.flv.lnk", cAlternateFileName="GPHSXU~1.LNK")) returned 0x2e8518 [0187.358] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7655b940, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7655b940, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7655b940, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1459, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="gpHSxu6OeEFyb_1eOz.flv.lnk", cAlternateFileName="GPHSXU~1.LNK")) returned 0 [0187.358] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0187.358] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gpHSxu6OeEFyb_1eOz.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gphsxu6oeefyb_1eoz.flv.lnk")) returned 1 [0187.359] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gpHSxu6OeEFyb_1eOz.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gphsxu6oeefyb_1eoz.flv.lnk")) returned 0xffffffff [0187.359] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76287f20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76287f20, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76287f20, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x3e1, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="GRi2f2B.lnk", cAlternateFileName="")) returned 1 [0187.359] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GRi2f2B.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gri2f2b.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0187.359] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GRi2f2B.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gri2f2b.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0187.360] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e1 [0187.360] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0187.361] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0187.453] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3e1, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x3e1, lpOverlapped=0x0) returned 1 [0187.454] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x3f0, lpOverlapped=0x0) returned 1 [0187.455] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0187.475] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.499] CloseHandle (hObject=0xf4) returned 1 [0187.499] CloseHandle (hObject=0xf0) returned 1 [0187.499] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GRi2f2B.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gri2f2b.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GRi2f2B.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gri2f2b.lnk.dvodltmf")) returned 0 [0187.500] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GRi2f2B.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gri2f2b.lnk.dvodltmf")) returned 0x20 [0187.500] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GRi2f2B.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76287f20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76287f20, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76287f20, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x3e1, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="GRi2f2B.lnk", cAlternateFileName="")) returned 0x2e8518 [0187.501] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76287f20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76287f20, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76287f20, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x3e1, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="GRi2f2B.lnk", cAlternateFileName="")) returned 0 [0187.501] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0187.501] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GRi2f2B.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gri2f2b.lnk")) returned 1 [0187.502] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GRi2f2B.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gri2f2b.lnk")) returned 0xffffffff [0187.502] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7548bde0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7548bde0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7548bde0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe65, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="hu3HQB.lnk", cAlternateFileName="")) returned 1 [0187.502] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hu3HQB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hu3hqb.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0187.502] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hu3HQB.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hu3hqb.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0187.503] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe65 [0187.503] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0187.504] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0187.587] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe65, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xe65, lpOverlapped=0x0) returned 1 [0187.588] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xe70, lpOverlapped=0x0) returned 1 [0187.589] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0187.609] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.619] CloseHandle (hObject=0xf0) returned 1 [0187.619] CloseHandle (hObject=0xf4) returned 1 [0187.619] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hu3HQB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hu3hqb.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hu3HQB.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hu3hqb.lnk.dvodltmf")) returned 0 [0187.620] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hu3HQB.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hu3hqb.lnk.dvodltmf")) returned 0x20 [0187.620] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hu3HQB.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7548bde0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7548bde0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7548bde0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe65, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="hu3HQB.lnk", cAlternateFileName="")) returned 0x2e8518 [0187.620] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7548bde0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7548bde0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7548bde0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe65, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="hu3HQB.lnk", cAlternateFileName="")) returned 0 [0187.620] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0187.620] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hu3HQB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hu3hqb.lnk")) returned 1 [0187.621] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hu3HQB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hu3hqb.lnk")) returned 0xffffffff [0187.621] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x754b1f40, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x754b1f40, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x754b1f40, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xf56, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="IDakXGLR0FBjl4Pii89.lnk", cAlternateFileName="IDAKXG~1.LNK")) returned 1 [0187.621] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IDakXGLR0FBjl4Pii89.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\idakxglr0fbjl4pii89.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0187.621] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IDakXGLR0FBjl4Pii89.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\idakxglr0fbjl4pii89.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0187.622] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf56 [0187.622] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0187.623] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0187.710] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xf56, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xf56, lpOverlapped=0x0) returned 1 [0187.711] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xf60, lpOverlapped=0x0) returned 1 [0187.712] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0187.731] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.741] CloseHandle (hObject=0xf4) returned 1 [0187.741] CloseHandle (hObject=0xf0) returned 1 [0187.741] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IDakXGLR0FBjl4Pii89.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\idakxglr0fbjl4pii89.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IDakXGLR0FBjl4Pii89.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\idakxglr0fbjl4pii89.lnk.dvodltmf")) returned 0 [0187.742] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IDakXGLR0FBjl4Pii89.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\idakxglr0fbjl4pii89.lnk.dvodltmf")) returned 0x20 [0187.742] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IDakXGLR0FBjl4Pii89.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x754b1f40, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x754b1f40, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x754b1f40, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xf56, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="IDakXGLR0FBjl4Pii89.lnk", cAlternateFileName="IDAKXG~1.LNK")) returned 0x2e8518 [0187.742] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x754b1f40, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x754b1f40, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x754b1f40, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xf56, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="IDakXGLR0FBjl4Pii89.lnk", cAlternateFileName="IDAKXG~1.LNK")) returned 0 [0187.742] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0187.743] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IDakXGLR0FBjl4Pii89.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\idakxglr0fbjl4pii89.lnk")) returned 1 [0187.743] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IDakXGLR0FBjl4Pii89.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\idakxglr0fbjl4pii89.lnk")) returned 0xffffffff [0187.743] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x755e2a40, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76985fc0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76985fc0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x19b5, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="ihS5FJ.lnk", cAlternateFileName="")) returned 1 [0187.744] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihS5FJ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ihs5fj.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0187.744] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihS5FJ.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ihs5fj.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0187.745] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19b5 [0187.745] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0187.745] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0187.839] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x19b5, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x19b5, lpOverlapped=0x0) returned 1 [0187.840] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x19c0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x19c0, lpOverlapped=0x0) returned 1 [0187.841] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0187.861] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.876] CloseHandle (hObject=0xf0) returned 1 [0187.876] CloseHandle (hObject=0xf4) returned 1 [0187.876] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihS5FJ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ihs5fj.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihS5FJ.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ihs5fj.lnk.dvodltmf")) returned 0 [0187.877] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihS5FJ.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ihs5fj.lnk.dvodltmf")) returned 0x20 [0187.877] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihS5FJ.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x755e2a40, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76985fc0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76985fc0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x19b5, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ihS5FJ.lnk", cAlternateFileName="")) returned 0x2e8518 [0187.877] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x755e2a40, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76985fc0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76985fc0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x19b5, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ihS5FJ.lnk", cAlternateFileName="")) returned 0 [0187.877] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0187.877] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihS5FJ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ihs5fj.lnk")) returned 1 [0187.878] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ihS5FJ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ihs5fj.lnk")) returned 0xffffffff [0187.878] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75276aa0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75276aa0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75276aa0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="iT9cS8I.flv.lnk", cAlternateFileName="IT9CS8~1.LNK")) returned 1 [0187.878] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iT9cS8I.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\it9cs8i.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0187.878] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iT9cS8I.flv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\it9cs8i.flv.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0187.879] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe76 [0187.879] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0187.880] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0187.966] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe76, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xe76, lpOverlapped=0x0) returned 1 [0187.966] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xe80, lpOverlapped=0x0) returned 1 [0187.967] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0187.987] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.997] CloseHandle (hObject=0xf4) returned 1 [0187.997] CloseHandle (hObject=0xf0) returned 1 [0187.997] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iT9cS8I.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\it9cs8i.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iT9cS8I.flv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\it9cs8i.flv.lnk.dvodltmf")) returned 0 [0187.998] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iT9cS8I.flv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\it9cs8i.flv.lnk.dvodltmf")) returned 0x20 [0187.998] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iT9cS8I.flv.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75276aa0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75276aa0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75276aa0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="iT9cS8I.flv.lnk", cAlternateFileName="IT9CS8~1.LNK")) returned 0x2e8518 [0187.998] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75276aa0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75276aa0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75276aa0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="iT9cS8I.flv.lnk", cAlternateFileName="IT9CS8~1.LNK")) returned 0 [0187.998] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0187.998] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iT9cS8I.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\it9cs8i.flv.lnk")) returned 1 [0187.999] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iT9cS8I.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\it9cs8i.flv.lnk")) returned 0xffffffff [0187.999] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7695fe60, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7695fe60, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7695fe60, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="jCU5Ya9sOXF7kCd.lnk", cAlternateFileName="JCU5YA~1.LNK")) returned 1 [0187.999] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jCU5Ya9sOXF7kCd.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jcu5ya9soxf7kcd.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0187.999] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jCU5Ya9sOXF7kCd.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jcu5ya9soxf7kcd.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0188.000] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa63 [0188.000] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0188.000] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0188.108] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa63, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xa63, lpOverlapped=0x0) returned 1 [0188.108] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xa70, lpOverlapped=0x0) returned 1 [0188.110] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0188.130] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.140] CloseHandle (hObject=0xf0) returned 1 [0188.140] CloseHandle (hObject=0xf4) returned 1 [0188.140] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jCU5Ya9sOXF7kCd.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jcu5ya9soxf7kcd.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jCU5Ya9sOXF7kCd.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jcu5ya9soxf7kcd.lnk.dvodltmf")) returned 0 [0188.141] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jCU5Ya9sOXF7kCd.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jcu5ya9soxf7kcd.lnk.dvodltmf")) returned 0x20 [0188.141] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jCU5Ya9sOXF7kCd.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7695fe60, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7695fe60, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7695fe60, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="jCU5Ya9sOXF7kCd.lnk", cAlternateFileName="JCU5YA~1.LNK")) returned 0x2e8518 [0188.142] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7695fe60, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7695fe60, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7695fe60, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="jCU5Ya9sOXF7kCd.lnk", cAlternateFileName="JCU5YA~1.LNK")) returned 0 [0188.142] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0188.142] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jCU5Ya9sOXF7kCd.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jcu5ya9soxf7kcd.lnk")) returned 1 [0188.143] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jCU5Ya9sOXF7kCd.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jcu5ya9soxf7kcd.lnk")) returned 0xffffffff [0188.143] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76261dc0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76261dc0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76261dc0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1515, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Jli6CxwuKTOrvs5.lnk", cAlternateFileName="JLI6CX~1.LNK")) returned 1 [0188.143] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jli6CxwuKTOrvs5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jli6cxwuktorvs5.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0188.143] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jli6CxwuKTOrvs5.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jli6cxwuktorvs5.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0188.144] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1515 [0188.144] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0188.145] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0188.232] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1515, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x1515, lpOverlapped=0x0) returned 1 [0188.233] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x1520, lpOverlapped=0x0) returned 1 [0188.234] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0188.254] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.264] CloseHandle (hObject=0xf4) returned 1 [0188.264] CloseHandle (hObject=0xf0) returned 1 [0188.264] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jli6CxwuKTOrvs5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jli6cxwuktorvs5.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jli6CxwuKTOrvs5.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jli6cxwuktorvs5.lnk.dvodltmf")) returned 0 [0188.265] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jli6CxwuKTOrvs5.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jli6cxwuktorvs5.lnk.dvodltmf")) returned 0x20 [0188.265] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jli6CxwuKTOrvs5.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76261dc0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76261dc0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76261dc0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1515, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Jli6CxwuKTOrvs5.lnk", cAlternateFileName="JLI6CX~1.LNK")) returned 0x2e8518 [0188.265] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76261dc0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76261dc0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76261dc0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1515, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Jli6CxwuKTOrvs5.lnk", cAlternateFileName="JLI6CX~1.LNK")) returned 0 [0188.265] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0188.265] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jli6CxwuKTOrvs5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jli6cxwuktorvs5.lnk")) returned 1 [0188.266] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jli6CxwuKTOrvs5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jli6cxwuktorvs5.lnk")) returned 0xffffffff [0188.266] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75fda660, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75fda660, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75fda660, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xde4, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="KFP7T.lnk", cAlternateFileName="")) returned 1 [0188.266] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KFP7T.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kfp7t.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0188.266] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KFP7T.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kfp7t.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0188.267] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde4 [0188.267] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0188.267] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0188.354] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xde4, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xde4, lpOverlapped=0x0) returned 1 [0188.354] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xdf0, lpOverlapped=0x0) returned 1 [0188.355] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0188.383] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.392] CloseHandle (hObject=0xf0) returned 1 [0188.392] CloseHandle (hObject=0xf4) returned 1 [0188.396] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KFP7T.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kfp7t.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KFP7T.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kfp7t.lnk.dvodltmf")) returned 0 [0188.397] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KFP7T.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kfp7t.lnk.dvodltmf")) returned 0x20 [0188.397] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KFP7T.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75fda660, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75fda660, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75fda660, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xde4, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="KFP7T.lnk", cAlternateFileName="")) returned 0x2e8518 [0188.397] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75fda660, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75fda660, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75fda660, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xde4, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="KFP7T.lnk", cAlternateFileName="")) returned 0 [0188.397] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0188.397] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KFP7T.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kfp7t.lnk")) returned 1 [0188.398] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KFP7T.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kfp7t.lnk")) returned 0xffffffff [0188.398] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c0d720, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76c0d720, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76c0d720, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x21ec, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="KguSvtd0LLiS6TzQSZt.flv.lnk", cAlternateFileName="KGUSVT~1.LNK")) returned 1 [0188.398] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KguSvtd0LLiS6TzQSZt.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kgusvtd0llis6tzqszt.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0188.398] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KguSvtd0LLiS6TzQSZt.flv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kgusvtd0llis6tzqszt.flv.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0188.399] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x21ec [0188.399] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0188.400] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0188.489] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x21ec, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x21ec, lpOverlapped=0x0) returned 1 [0188.490] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x21f0, lpOverlapped=0x0) returned 1 [0188.491] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0188.511] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.521] CloseHandle (hObject=0xf4) returned 1 [0188.521] CloseHandle (hObject=0xf0) returned 1 [0188.521] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KguSvtd0LLiS6TzQSZt.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kgusvtd0llis6tzqszt.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KguSvtd0LLiS6TzQSZt.flv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kgusvtd0llis6tzqszt.flv.lnk.dvodltmf")) returned 0 [0188.522] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KguSvtd0LLiS6TzQSZt.flv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kgusvtd0llis6tzqszt.flv.lnk.dvodltmf")) returned 0x20 [0188.522] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KguSvtd0LLiS6TzQSZt.flv.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c0d720, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76c0d720, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76c0d720, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x21ec, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="KguSvtd0LLiS6TzQSZt.flv.lnk", cAlternateFileName="KGUSVT~1.LNK")) returned 0x2e8518 [0188.522] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c0d720, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76c0d720, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76c0d720, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x21ec, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="KguSvtd0LLiS6TzQSZt.flv.lnk", cAlternateFileName="KGUSVT~1.LNK")) returned 0 [0188.523] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0188.523] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KguSvtd0LLiS6TzQSZt.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kgusvtd0llis6tzqszt.flv.lnk")) returned 1 [0188.524] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KguSvtd0LLiS6TzQSZt.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kgusvtd0llis6tzqszt.flv.lnk")) returned 0xffffffff [0188.524] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c7fb40, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76c7fb40, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76c7fb40, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xfb2, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="KjIx1PQMdxo4H6S.lnk", cAlternateFileName="KJIX1P~1.LNK")) returned 1 [0188.524] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KjIx1PQMdxo4H6S.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kjix1pqmdxo4h6s.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0188.524] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KjIx1PQMdxo4H6S.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kjix1pqmdxo4h6s.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0188.525] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfb2 [0188.525] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0188.525] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0188.613] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xfb2, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xfb2, lpOverlapped=0x0) returned 1 [0188.614] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xfc0, lpOverlapped=0x0) returned 1 [0188.615] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0188.638] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.649] CloseHandle (hObject=0xf0) returned 1 [0188.649] CloseHandle (hObject=0xf4) returned 1 [0188.649] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KjIx1PQMdxo4H6S.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kjix1pqmdxo4h6s.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KjIx1PQMdxo4H6S.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kjix1pqmdxo4h6s.lnk.dvodltmf")) returned 0 [0188.650] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KjIx1PQMdxo4H6S.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kjix1pqmdxo4h6s.lnk.dvodltmf")) returned 0x20 [0188.650] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KjIx1PQMdxo4H6S.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c7fb40, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76c7fb40, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76c7fb40, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xfb2, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="KjIx1PQMdxo4H6S.lnk", cAlternateFileName="KJIX1P~1.LNK")) returned 0x2e8518 [0188.650] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c7fb40, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76c7fb40, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76c7fb40, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xfb2, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="KjIx1PQMdxo4H6S.lnk", cAlternateFileName="KJIX1P~1.LNK")) returned 0 [0188.650] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0188.650] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KjIx1PQMdxo4H6S.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kjix1pqmdxo4h6s.lnk")) returned 1 [0188.651] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KjIx1PQMdxo4H6S.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kjix1pqmdxo4h6s.lnk")) returned 0xffffffff [0188.651] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x760007c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x760007c0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x760007c0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x41f, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="kK MhRV-olEoIQ-ANip.mkv.lnk", cAlternateFileName="KKMHRV~1.LNK")) returned 1 [0188.652] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kK MhRV-olEoIQ-ANip.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kk mhrv-oleoiq-anip.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0188.652] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kK MhRV-olEoIQ-ANip.mkv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kk mhrv-oleoiq-anip.mkv.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0188.653] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x41f [0188.653] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0188.653] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0188.739] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x41f, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x41f, lpOverlapped=0x0) returned 1 [0188.740] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x420, lpOverlapped=0x0) returned 1 [0188.741] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0188.764] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.774] CloseHandle (hObject=0xf4) returned 1 [0188.774] CloseHandle (hObject=0xf0) returned 1 [0188.774] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kK MhRV-olEoIQ-ANip.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kk mhrv-oleoiq-anip.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kK MhRV-olEoIQ-ANip.mkv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kk mhrv-oleoiq-anip.mkv.lnk.dvodltmf")) returned 0 [0188.775] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kK MhRV-olEoIQ-ANip.mkv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kk mhrv-oleoiq-anip.mkv.lnk.dvodltmf")) returned 0x20 [0188.775] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kK MhRV-olEoIQ-ANip.mkv.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x760007c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x760007c0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x760007c0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x41f, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="kK MhRV-olEoIQ-ANip.mkv.lnk", cAlternateFileName="KKMHRV~1.LNK")) returned 0x2e8518 [0188.775] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x760007c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x760007c0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x760007c0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x41f, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="kK MhRV-olEoIQ-ANip.mkv.lnk", cAlternateFileName="KKMHRV~1.LNK")) returned 0 [0188.775] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0188.775] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kK MhRV-olEoIQ-ANip.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kk mhrv-oleoiq-anip.mkv.lnk")) returned 1 [0188.776] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kK MhRV-olEoIQ-ANip.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kk mhrv-oleoiq-anip.mkv.lnk")) returned 0xffffffff [0188.776] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7548bde0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7548bde0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7548bde0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Kxt6eA3f0PfQcc1Us.lnk", cAlternateFileName="KXT6EA~1.LNK")) returned 1 [0188.776] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Kxt6eA3f0PfQcc1Us.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kxt6ea3f0pfqcc1us.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0188.777] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Kxt6eA3f0PfQcc1Us.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kxt6ea3f0pfqcc1us.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0188.777] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfc8 [0188.778] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0188.778] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0188.865] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xfc8, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xfc8, lpOverlapped=0x0) returned 1 [0188.865] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xfd0, lpOverlapped=0x0) returned 1 [0188.866] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0188.886] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.895] CloseHandle (hObject=0xf0) returned 1 [0188.895] CloseHandle (hObject=0xf4) returned 1 [0188.896] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Kxt6eA3f0PfQcc1Us.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kxt6ea3f0pfqcc1us.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Kxt6eA3f0PfQcc1Us.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kxt6ea3f0pfqcc1us.lnk.dvodltmf")) returned 0 [0188.897] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Kxt6eA3f0PfQcc1Us.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kxt6ea3f0pfqcc1us.lnk.dvodltmf")) returned 0x20 [0188.897] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Kxt6eA3f0PfQcc1Us.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7548bde0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7548bde0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7548bde0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Kxt6eA3f0PfQcc1Us.lnk", cAlternateFileName="KXT6EA~1.LNK")) returned 0x2e8518 [0188.897] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7548bde0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7548bde0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7548bde0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Kxt6eA3f0PfQcc1Us.lnk", cAlternateFileName="KXT6EA~1.LNK")) returned 0 [0188.897] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0188.897] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Kxt6eA3f0PfQcc1Us.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kxt6ea3f0pfqcc1us.lnk")) returned 1 [0188.898] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Kxt6eA3f0PfQcc1Us.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kxt6ea3f0pfqcc1us.lnk")) returned 0xffffffff [0188.898] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x760007c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x760007c0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x760007c0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x257, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="kZ-Y6eKdk-Bibs.flv.lnk", cAlternateFileName="KZ-Y6E~1.LNK")) returned 1 [0188.898] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kZ-Y6eKdk-Bibs.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kz-y6ekdk-bibs.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0188.898] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kZ-Y6eKdk-Bibs.flv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kz-y6ekdk-bibs.flv.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0188.899] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x257 [0188.899] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0188.899] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0188.984] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x257, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x257, lpOverlapped=0x0) returned 1 [0188.985] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x260, lpOverlapped=0x0) returned 1 [0188.986] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0189.006] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.015] CloseHandle (hObject=0xf4) returned 1 [0189.015] CloseHandle (hObject=0xf0) returned 1 [0189.015] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kZ-Y6eKdk-Bibs.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kz-y6ekdk-bibs.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kZ-Y6eKdk-Bibs.flv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kz-y6ekdk-bibs.flv.lnk.dvodltmf")) returned 0 [0189.016] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kZ-Y6eKdk-Bibs.flv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kz-y6ekdk-bibs.flv.lnk.dvodltmf")) returned 0x20 [0189.016] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kZ-Y6eKdk-Bibs.flv.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x760007c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x760007c0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x760007c0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x257, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="kZ-Y6eKdk-Bibs.flv.lnk", cAlternateFileName="KZ-Y6E~1.LNK")) returned 0x2e8518 [0189.016] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x760007c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x760007c0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x760007c0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x257, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="kZ-Y6eKdk-Bibs.flv.lnk", cAlternateFileName="KZ-Y6E~1.LNK")) returned 0 [0189.016] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0189.016] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kZ-Y6eKdk-Bibs.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kz-y6ekdk-bibs.flv.lnk")) returned 1 [0189.017] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kZ-Y6eKdk-Bibs.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kz-y6ekdk-bibs.flv.lnk")) returned 0xffffffff [0189.017] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76026920, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76026920, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76026920, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="L02tp5dfFU.lnk", cAlternateFileName="L02TP5~1.LNK")) returned 1 [0189.017] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L02tp5dfFU.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l02tp5dffu.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0189.018] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L02tp5dfFU.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l02tp5dffu.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0189.018] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x243 [0189.018] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0189.019] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0189.103] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x243, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x243, lpOverlapped=0x0) returned 1 [0189.103] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x250, lpOverlapped=0x0) returned 1 [0189.104] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0189.136] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.145] CloseHandle (hObject=0xf0) returned 1 [0189.145] CloseHandle (hObject=0xf4) returned 1 [0189.145] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L02tp5dfFU.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l02tp5dffu.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L02tp5dfFU.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l02tp5dffu.lnk.dvodltmf")) returned 0 [0189.146] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L02tp5dfFU.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l02tp5dffu.lnk.dvodltmf")) returned 0x20 [0189.146] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L02tp5dfFU.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76026920, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76026920, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76026920, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="L02tp5dfFU.lnk", cAlternateFileName="L02TP5~1.LNK")) returned 0x2e8518 [0189.147] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76026920, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76026920, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76026920, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="L02tp5dfFU.lnk", cAlternateFileName="L02TP5~1.LNK")) returned 0 [0189.147] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0189.147] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L02tp5dfFU.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l02tp5dffu.lnk")) returned 1 [0189.148] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L02tp5dfFU.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l02tp5dffu.lnk")) returned 0xffffffff [0189.148] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x767249c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x767249c0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x767249c0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1414, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="l1LjkHRO25HgVAKEXl.lnk", cAlternateFileName="L1LJKH~1.LNK")) returned 1 [0189.148] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l1LjkHRO25HgVAKEXl.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l1ljkhro25hgvakexl.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0189.148] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l1LjkHRO25HgVAKEXl.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l1ljkhro25hgvakexl.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0189.149] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1414 [0189.149] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0189.149] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0189.232] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1414, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x1414, lpOverlapped=0x0) returned 1 [0189.233] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1420, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x1420, lpOverlapped=0x0) returned 1 [0189.234] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0189.252] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.262] CloseHandle (hObject=0xf4) returned 1 [0189.262] CloseHandle (hObject=0xf0) returned 1 [0189.262] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l1LjkHRO25HgVAKEXl.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l1ljkhro25hgvakexl.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l1LjkHRO25HgVAKEXl.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l1ljkhro25hgvakexl.lnk.dvodltmf")) returned 0 [0189.263] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l1LjkHRO25HgVAKEXl.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l1ljkhro25hgvakexl.lnk.dvodltmf")) returned 0x20 [0189.263] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l1LjkHRO25HgVAKEXl.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x767249c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x767249c0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x767249c0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1414, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="l1LjkHRO25HgVAKEXl.lnk", cAlternateFileName="L1LJKH~1.LNK")) returned 0x2e8518 [0189.263] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x767249c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x767249c0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x767249c0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1414, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="l1LjkHRO25HgVAKEXl.lnk", cAlternateFileName="L1LJKH~1.LNK")) returned 0 [0189.263] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0189.263] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l1LjkHRO25HgVAKEXl.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l1ljkhro25hgvakexl.lnk")) returned 1 [0189.264] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l1LjkHRO25HgVAKEXl.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l1ljkhro25hgvakexl.lnk")) returned 0xffffffff [0189.264] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76b9b300, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76b9b300, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76b9b300, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xfab, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="l29spcG1OFdeHz.lnk", cAlternateFileName="L29SPC~1.LNK")) returned 1 [0189.264] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l29spcG1OFdeHz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l29spcg1ofdehz.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0189.264] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l29spcG1OFdeHz.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l29spcg1ofdehz.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0189.265] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfab [0189.265] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0189.266] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0189.349] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xfab, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xfab, lpOverlapped=0x0) returned 1 [0189.349] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xfb0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xfb0, lpOverlapped=0x0) returned 1 [0189.350] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0189.463] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.473] CloseHandle (hObject=0xf0) returned 1 [0189.473] CloseHandle (hObject=0xf4) returned 1 [0189.473] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l29spcG1OFdeHz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l29spcg1ofdehz.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l29spcG1OFdeHz.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l29spcg1ofdehz.lnk.dvodltmf")) returned 0 [0189.474] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l29spcG1OFdeHz.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l29spcg1ofdehz.lnk.dvodltmf")) returned 0x20 [0189.474] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l29spcG1OFdeHz.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76b9b300, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76b9b300, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76b9b300, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xfab, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="l29spcG1OFdeHz.lnk", cAlternateFileName="L29SPC~1.LNK")) returned 0x2e8518 [0189.474] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76b9b300, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76b9b300, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76b9b300, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xfab, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="l29spcG1OFdeHz.lnk", cAlternateFileName="L29SPC~1.LNK")) returned 0 [0189.475] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0189.475] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l29spcG1OFdeHz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l29spcg1ofdehz.lnk")) returned 1 [0189.475] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l29spcG1OFdeHz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l29spcg1ofdehz.lnk")) returned 0xffffffff [0189.476] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x750878c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x750878c0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x750878c0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa4d, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="L2XwmTRRwQf6I.lnk", cAlternateFileName="L2XWMT~1.LNK")) returned 1 [0189.476] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L2XwmTRRwQf6I.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l2xwmtrrwqf6i.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0189.476] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L2XwmTRRwQf6I.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l2xwmtrrwqf6i.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0189.477] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa4d [0189.477] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0189.477] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0189.564] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa4d, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xa4d, lpOverlapped=0x0) returned 1 [0189.565] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xa50, lpOverlapped=0x0) returned 1 [0189.566] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0189.586] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.595] CloseHandle (hObject=0xf4) returned 1 [0189.595] CloseHandle (hObject=0xf0) returned 1 [0189.595] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L2XwmTRRwQf6I.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l2xwmtrrwqf6i.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L2XwmTRRwQf6I.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l2xwmtrrwqf6i.lnk.dvodltmf")) returned 0 [0189.597] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L2XwmTRRwQf6I.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l2xwmtrrwqf6i.lnk.dvodltmf")) returned 0x20 [0189.597] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L2XwmTRRwQf6I.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x750878c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x750878c0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x750878c0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa4d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="L2XwmTRRwQf6I.lnk", cAlternateFileName="L2XWMT~1.LNK")) returned 0x2e8518 [0189.597] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x750878c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x750878c0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x750878c0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa4d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="L2XwmTRRwQf6I.lnk", cAlternateFileName="L2XWMT~1.LNK")) returned 0 [0189.597] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0189.597] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L2XwmTRRwQf6I.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l2xwmtrrwqf6i.lnk")) returned 1 [0189.598] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L2XwmTRRwQf6I.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l2xwmtrrwqf6i.lnk")) returned 0xffffffff [0189.598] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7687b620, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76b4f040, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76b4f040, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xdd2, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="l34EmG.lnk", cAlternateFileName="")) returned 1 [0189.598] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l34EmG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l34emg.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0189.598] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l34EmG.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l34emg.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0189.599] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd2 [0189.599] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0189.599] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0189.684] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xdd2, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xdd2, lpOverlapped=0x0) returned 1 [0189.685] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xde0, lpOverlapped=0x0) returned 1 [0189.686] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0189.705] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.714] CloseHandle (hObject=0xf0) returned 1 [0189.714] CloseHandle (hObject=0xf4) returned 1 [0189.715] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l34EmG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l34emg.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l34EmG.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l34emg.lnk.dvodltmf")) returned 0 [0189.715] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l34EmG.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l34emg.lnk.dvodltmf")) returned 0x20 [0189.715] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l34EmG.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7687b620, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76b4f040, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76b4f040, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xdd2, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="l34EmG.lnk", cAlternateFileName="")) returned 0x2e8518 [0189.716] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7687b620, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76b4f040, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76b4f040, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xdd2, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="l34EmG.lnk", cAlternateFileName="")) returned 0 [0189.716] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0189.716] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l34EmG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l34emg.lnk")) returned 1 [0189.717] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l34EmG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l34emg.lnk")) returned 0xffffffff [0189.717] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x763deb80, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x763deb80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x763deb80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x2e4, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="lC-PUX8CoTL1XDIC.lnk", cAlternateFileName="LC-PUX~1.LNK")) returned 1 [0189.717] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lC-PUX8CoTL1XDIC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lc-pux8cotl1xdic.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0189.717] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lC-PUX8CoTL1XDIC.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lc-pux8cotl1xdic.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0189.718] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2e4 [0189.718] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0189.718] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0189.808] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2e4, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x2e4, lpOverlapped=0x0) returned 1 [0189.809] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x2f0, lpOverlapped=0x0) returned 1 [0189.810] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0189.829] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.840] CloseHandle (hObject=0xf4) returned 1 [0189.840] CloseHandle (hObject=0xf0) returned 1 [0189.840] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lC-PUX8CoTL1XDIC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lc-pux8cotl1xdic.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lC-PUX8CoTL1XDIC.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lc-pux8cotl1xdic.lnk.dvodltmf")) returned 0 [0189.841] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lC-PUX8CoTL1XDIC.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lc-pux8cotl1xdic.lnk.dvodltmf")) returned 0x20 [0189.841] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lC-PUX8CoTL1XDIC.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x763deb80, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x763deb80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x763deb80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x2e4, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="lC-PUX8CoTL1XDIC.lnk", cAlternateFileName="LC-PUX~1.LNK")) returned 0x2e8518 [0189.841] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x763deb80, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x763deb80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x763deb80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x2e4, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="lC-PUX8CoTL1XDIC.lnk", cAlternateFileName="LC-PUX~1.LNK")) returned 0 [0189.841] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0189.841] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lC-PUX8CoTL1XDIC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lc-pux8cotl1xdic.lnk")) returned 1 [0189.842] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lC-PUX8CoTL1XDIC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lc-pux8cotl1xdic.lnk")) returned 0xffffffff [0189.842] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75a59380, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75a59380, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75a59380, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe59, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="lzBU.mkv.lnk", cAlternateFileName="LZBUMK~1.LNK")) returned 1 [0189.842] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lzBU.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lzbu.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0189.843] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lzBU.mkv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lzbu.mkv.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0189.844] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe59 [0189.844] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0189.844] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0189.929] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe59, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xe59, lpOverlapped=0x0) returned 1 [0189.930] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xe60, lpOverlapped=0x0) returned 1 [0189.930] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0189.950] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.960] CloseHandle (hObject=0xf0) returned 1 [0189.960] CloseHandle (hObject=0xf4) returned 1 [0189.960] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lzBU.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lzbu.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lzBU.mkv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lzbu.mkv.lnk.dvodltmf")) returned 0 [0189.961] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lzBU.mkv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lzbu.mkv.lnk.dvodltmf")) returned 0x20 [0189.961] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lzBU.mkv.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75a59380, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75a59380, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75a59380, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe59, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="lzBU.mkv.lnk", cAlternateFileName="LZBUMK~1.LNK")) returned 0x2e8518 [0189.961] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75a59380, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75a59380, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75a59380, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe59, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="lzBU.mkv.lnk", cAlternateFileName="LZBUMK~1.LNK")) returned 0 [0189.961] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0189.961] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lzBU.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lzbu.mkv.lnk")) returned 1 [0189.962] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lzBU.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lzbu.mkv.lnk")) returned 0xffffffff [0189.962] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x761312c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76c33880, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76c33880, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe92, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="M319dgKI6zB-lB.lnk", cAlternateFileName="M319DG~1.LNK")) returned 1 [0189.962] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M319dgKI6zB-lB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m319dgki6zb-lb.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0189.962] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M319dgKI6zB-lB.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m319dgki6zb-lb.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0189.963] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe92 [0189.963] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0189.963] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0190.047] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe92, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xe92, lpOverlapped=0x0) returned 1 [0190.047] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xea0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xea0, lpOverlapped=0x0) returned 1 [0190.048] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0190.068] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.077] CloseHandle (hObject=0xf4) returned 1 [0190.077] CloseHandle (hObject=0xf0) returned 1 [0190.078] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M319dgKI6zB-lB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m319dgki6zb-lb.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M319dgKI6zB-lB.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m319dgki6zb-lb.lnk.dvodltmf")) returned 0 [0190.078] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M319dgKI6zB-lB.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m319dgki6zb-lb.lnk.dvodltmf")) returned 0x20 [0190.079] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M319dgKI6zB-lB.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x761312c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76c33880, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76c33880, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe92, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="M319dgKI6zB-lB.lnk", cAlternateFileName="M319DG~1.LNK")) returned 0x2e8518 [0190.079] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x761312c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76c33880, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76c33880, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe92, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="M319dgKI6zB-lB.lnk", cAlternateFileName="M319DG~1.LNK")) returned 0 [0190.079] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0190.079] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M319dgKI6zB-lB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m319dgki6zb-lb.lnk")) returned 1 [0190.080] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M319dgKI6zB-lB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m319dgki6zb-lb.lnk")) returned 0xffffffff [0190.080] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75570620, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75570620, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75570620, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x252, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="mNsVMqc_Q8ILW.ots.lnk", cAlternateFileName="MNSVMQ~1.LNK")) returned 1 [0190.080] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mNsVMqc_Q8ILW.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mnsvmqc_q8ilw.ots.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0190.080] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mNsVMqc_Q8ILW.ots.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mnsvmqc_q8ilw.ots.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0190.081] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x252 [0190.082] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0190.082] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0190.175] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x252, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x252, lpOverlapped=0x0) returned 1 [0190.176] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x260, lpOverlapped=0x0) returned 1 [0190.177] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0190.197] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.206] CloseHandle (hObject=0xf0) returned 1 [0190.206] CloseHandle (hObject=0xf4) returned 1 [0190.206] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mNsVMqc_Q8ILW.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mnsvmqc_q8ilw.ots.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mNsVMqc_Q8ILW.ots.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mnsvmqc_q8ilw.ots.lnk.dvodltmf")) returned 0 [0190.207] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mNsVMqc_Q8ILW.ots.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mnsvmqc_q8ilw.ots.lnk.dvodltmf")) returned 0x20 [0190.207] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mNsVMqc_Q8ILW.ots.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75570620, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75570620, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75570620, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x252, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="mNsVMqc_Q8ILW.ots.lnk", cAlternateFileName="MNSVMQ~1.LNK")) returned 0x2e8518 [0190.208] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75570620, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75570620, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75570620, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x252, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="mNsVMqc_Q8ILW.ots.lnk", cAlternateFileName="MNSVMQ~1.LNK")) returned 0 [0190.208] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0190.208] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mNsVMqc_Q8ILW.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mnsvmqc_q8ilw.ots.lnk")) returned 1 [0190.209] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mNsVMqc_Q8ILW.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mnsvmqc_q8ilw.ots.lnk")) returned 0xffffffff [0190.209] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75570620, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x768eda40, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x768eda40, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="My Music.lnk", cAlternateFileName="MYMUSI~1.LNK")) returned 1 [0190.209] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0190.209] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0190.210] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x52a [0190.210] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0190.210] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0190.307] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x52a, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x52a, lpOverlapped=0x0) returned 1 [0190.308] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x530, lpOverlapped=0x0) returned 1 [0190.308] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0190.328] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.338] CloseHandle (hObject=0xf4) returned 1 [0190.338] CloseHandle (hObject=0xf0) returned 1 [0190.338] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk.dvodltmf")) returned 0 [0190.339] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk.dvodltmf")) returned 0x20 [0190.339] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75570620, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x768eda40, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x768eda40, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="My Music.lnk", cAlternateFileName="MYMUSI~1.LNK")) returned 0x2e8518 [0190.339] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75570620, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x768eda40, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x768eda40, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="My Music.lnk", cAlternateFileName="MYMUSI~1.LNK")) returned 0 [0190.339] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0190.339] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk")) returned 1 [0190.340] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk")) returned 0xffffffff [0190.340] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74f7cf20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76a446a0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76a446a0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x54f, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="My Pictures.lnk", cAlternateFileName="MYPICT~1.LNK")) returned 1 [0190.340] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0190.340] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0190.341] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x54f [0190.341] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0190.342] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0190.449] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x54f, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x54f, lpOverlapped=0x0) returned 1 [0190.450] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x550, lpOverlapped=0x0) returned 1 [0190.451] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0190.471] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.481] CloseHandle (hObject=0xf0) returned 1 [0190.481] CloseHandle (hObject=0xf4) returned 1 [0190.481] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk.dvodltmf")) returned 0 [0190.482] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk.dvodltmf")) returned 0x20 [0190.482] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74f7cf20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76a446a0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76a446a0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x54f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="My Pictures.lnk", cAlternateFileName="MYPICT~1.LNK")) returned 0x2e8518 [0190.482] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74f7cf20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76a446a0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76a446a0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x54f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="My Pictures.lnk", cAlternateFileName="MYPICT~1.LNK")) returned 0 [0190.482] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0190.482] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk")) returned 1 [0190.483] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk")) returned 0xffffffff [0190.483] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75cba980, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76b02d80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76b02d80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x539, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="My Videos.lnk", cAlternateFileName="MYVIDE~1.LNK")) returned 1 [0190.483] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0190.483] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0190.484] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x539 [0190.484] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0190.484] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0190.582] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x539, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x539, lpOverlapped=0x0) returned 1 [0190.582] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x540, lpOverlapped=0x0) returned 1 [0190.583] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0190.603] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.613] CloseHandle (hObject=0xf4) returned 1 [0190.613] CloseHandle (hObject=0xf0) returned 1 [0190.613] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk.dvodltmf")) returned 0 [0190.614] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk.dvodltmf")) returned 0x20 [0190.614] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75cba980, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76b02d80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76b02d80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x539, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="My Videos.lnk", cAlternateFileName="MYVIDE~1.LNK")) returned 0x2e8518 [0190.614] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75cba980, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76b02d80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76b02d80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x539, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="My Videos.lnk", cAlternateFileName="MYVIDE~1.LNK")) returned 0 [0190.614] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0190.615] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk")) returned 1 [0190.615] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk")) returned 0xffffffff [0190.615] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x755bc8e0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x755bc8e0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x755bc8e0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xee4, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="NgUoI04cW-JZfa61y.flv.lnk", cAlternateFileName="NGUOI0~1.LNK")) returned 1 [0190.616] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NgUoI04cW-JZfa61y.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nguoi04cw-jzfa61y.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0190.616] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NgUoI04cW-JZfa61y.flv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nguoi04cw-jzfa61y.flv.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0190.617] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xee4 [0190.617] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0190.617] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0190.703] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xee4, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xee4, lpOverlapped=0x0) returned 1 [0190.704] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xef0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xef0, lpOverlapped=0x0) returned 1 [0190.705] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0190.726] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.736] CloseHandle (hObject=0xf0) returned 1 [0190.736] CloseHandle (hObject=0xf4) returned 1 [0190.736] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NgUoI04cW-JZfa61y.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nguoi04cw-jzfa61y.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NgUoI04cW-JZfa61y.flv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nguoi04cw-jzfa61y.flv.lnk.dvodltmf")) returned 0 [0190.737] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NgUoI04cW-JZfa61y.flv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nguoi04cw-jzfa61y.flv.lnk.dvodltmf")) returned 0x20 [0190.737] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NgUoI04cW-JZfa61y.flv.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x755bc8e0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x755bc8e0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x755bc8e0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xee4, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="NgUoI04cW-JZfa61y.flv.lnk", cAlternateFileName="NGUOI0~1.LNK")) returned 0x2e8518 [0190.737] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x755bc8e0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x755bc8e0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x755bc8e0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xee4, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="NgUoI04cW-JZfa61y.flv.lnk", cAlternateFileName="NGUOI0~1.LNK")) returned 0 [0190.737] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0190.738] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NgUoI04cW-JZfa61y.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nguoi04cw-jzfa61y.flv.lnk")) returned 1 [0190.738] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NgUoI04cW-JZfa61y.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nguoi04cw-jzfa61y.flv.lnk")) returned 0xffffffff [0190.738] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x764e9520, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x764e9520, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x764e9520, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x25c, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="NsKO4YZ3AU1H5XD.lnk", cAlternateFileName="NSKO4Y~1.LNK")) returned 1 [0190.738] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NsKO4YZ3AU1H5XD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nsko4yz3au1h5xd.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0190.739] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NsKO4YZ3AU1H5XD.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nsko4yz3au1h5xd.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0190.739] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x25c [0190.740] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0190.740] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0190.833] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x25c, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x25c, lpOverlapped=0x0) returned 1 [0190.833] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x260, lpOverlapped=0x0) returned 1 [0190.834] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0190.855] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.864] CloseHandle (hObject=0xf4) returned 1 [0190.864] CloseHandle (hObject=0xf0) returned 1 [0190.864] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NsKO4YZ3AU1H5XD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nsko4yz3au1h5xd.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NsKO4YZ3AU1H5XD.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nsko4yz3au1h5xd.lnk.dvodltmf")) returned 0 [0190.865] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NsKO4YZ3AU1H5XD.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nsko4yz3au1h5xd.lnk.dvodltmf")) returned 0x20 [0190.865] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NsKO4YZ3AU1H5XD.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x764e9520, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x764e9520, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x764e9520, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x25c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="NsKO4YZ3AU1H5XD.lnk", cAlternateFileName="NSKO4Y~1.LNK")) returned 0x2e8518 [0190.866] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x764e9520, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x764e9520, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x764e9520, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x25c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="NsKO4YZ3AU1H5XD.lnk", cAlternateFileName="NSKO4Y~1.LNK")) returned 0 [0190.866] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0190.866] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NsKO4YZ3AU1H5XD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nsko4yz3au1h5xd.lnk")) returned 1 [0190.867] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NsKO4YZ3AU1H5XD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nsko4yz3au1h5xd.lnk")) returned 0xffffffff [0190.867] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74e986e0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76a1e540, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76a1e540, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x961, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="o4uP.lnk", cAlternateFileName="")) returned 1 [0190.867] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o4uP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\o4up.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0190.867] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o4uP.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\o4up.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0190.868] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x961 [0190.868] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0190.868] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0190.954] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x961, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x961, lpOverlapped=0x0) returned 1 [0190.955] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x970, lpOverlapped=0x0) returned 1 [0190.966] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0190.986] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.996] CloseHandle (hObject=0xf0) returned 1 [0190.996] CloseHandle (hObject=0xf4) returned 1 [0190.996] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o4uP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\o4up.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o4uP.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\o4up.lnk.dvodltmf")) returned 0 [0190.997] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o4uP.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\o4up.lnk.dvodltmf")) returned 0x20 [0190.997] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o4uP.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74e986e0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76a1e540, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76a1e540, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x961, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="o4uP.lnk", cAlternateFileName="")) returned 0x2e8518 [0190.997] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74e986e0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76a1e540, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76a1e540, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x961, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="o4uP.lnk", cAlternateFileName="")) returned 0 [0190.997] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0190.997] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o4uP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\o4up.lnk")) returned 1 [0190.998] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o4uP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\o4up.lnk")) returned 0xffffffff [0190.998] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x765f3ec0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x765f3ec0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x765f3ec0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x232, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="O9wse7c.lnk", cAlternateFileName="")) returned 1 [0190.998] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O9wse7c.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\o9wse7c.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0190.998] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O9wse7c.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\o9wse7c.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0190.999] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x232 [0190.999] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0191.000] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0191.085] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x232, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x232, lpOverlapped=0x0) returned 1 [0191.086] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x240, lpOverlapped=0x0) returned 1 [0191.086] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0191.106] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.116] CloseHandle (hObject=0xf4) returned 1 [0191.116] CloseHandle (hObject=0xf0) returned 1 [0191.116] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O9wse7c.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\o9wse7c.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O9wse7c.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\o9wse7c.lnk.dvodltmf")) returned 0 [0191.117] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O9wse7c.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\o9wse7c.lnk.dvodltmf")) returned 0x20 [0191.117] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O9wse7c.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x765f3ec0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x765f3ec0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x765f3ec0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x232, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="O9wse7c.lnk", cAlternateFileName="")) returned 0x2e8518 [0191.117] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x765f3ec0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x765f3ec0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x765f3ec0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x232, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="O9wse7c.lnk", cAlternateFileName="")) returned 0 [0191.117] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0191.118] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O9wse7c.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\o9wse7c.lnk")) returned 1 [0191.118] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O9wse7c.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\o9wse7c.lnk")) returned 0xffffffff [0191.118] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x763deb80, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x763deb80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x763deb80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x14ff, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Ob5W_v1Bl4U7Y.lnk", cAlternateFileName="OB5W_V~1.LNK")) returned 1 [0191.119] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ob5W_v1Bl4U7Y.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ob5w_v1bl4u7y.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0191.119] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ob5W_v1Bl4U7Y.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ob5w_v1bl4u7y.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0191.120] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14ff [0191.121] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0191.121] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0191.215] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x14ff, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x14ff, lpOverlapped=0x0) returned 1 [0191.216] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x1500, lpOverlapped=0x0) returned 1 [0191.217] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0191.237] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.246] CloseHandle (hObject=0xf0) returned 1 [0191.247] CloseHandle (hObject=0xf4) returned 1 [0191.247] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ob5W_v1Bl4U7Y.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ob5w_v1bl4u7y.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ob5W_v1Bl4U7Y.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ob5w_v1bl4u7y.lnk.dvodltmf")) returned 0 [0191.248] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ob5W_v1Bl4U7Y.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ob5w_v1bl4u7y.lnk.dvodltmf")) returned 0x20 [0191.248] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ob5W_v1Bl4U7Y.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x763deb80, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x763deb80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x763deb80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x14ff, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Ob5W_v1Bl4U7Y.lnk", cAlternateFileName="OB5W_V~1.LNK")) returned 0x2e8518 [0191.248] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x763deb80, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x763deb80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x763deb80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x14ff, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Ob5W_v1Bl4U7Y.lnk", cAlternateFileName="OB5W_V~1.LNK")) returned 0 [0191.248] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0191.248] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ob5W_v1Bl4U7Y.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ob5w_v1bl4u7y.lnk")) returned 1 [0191.249] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ob5W_v1Bl4U7Y.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ob5w_v1bl4u7y.lnk")) returned 0xffffffff [0191.249] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75a33220, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75a33220, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75a59380, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xecb, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="OcPkNI8w.lnk", cAlternateFileName="")) returned 1 [0191.249] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OcPkNI8w.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ocpkni8w.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0191.249] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OcPkNI8w.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ocpkni8w.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0191.250] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xecb [0191.250] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0191.250] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0191.336] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xecb, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xecb, lpOverlapped=0x0) returned 1 [0191.337] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xed0, lpOverlapped=0x0) returned 1 [0191.338] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0191.358] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.372] CloseHandle (hObject=0xf4) returned 1 [0191.372] CloseHandle (hObject=0xf0) returned 1 [0191.373] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OcPkNI8w.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ocpkni8w.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OcPkNI8w.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ocpkni8w.lnk.dvodltmf")) returned 0 [0191.373] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OcPkNI8w.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ocpkni8w.lnk.dvodltmf")) returned 0x20 [0191.373] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OcPkNI8w.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75a33220, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75a33220, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75a59380, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xecb, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="OcPkNI8w.lnk", cAlternateFileName="")) returned 0x2e8518 [0191.374] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75a33220, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75a33220, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75a59380, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xecb, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="OcPkNI8w.lnk", cAlternateFileName="")) returned 0 [0191.374] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0191.374] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OcPkNI8w.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ocpkni8w.lnk")) returned 1 [0191.375] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OcPkNI8w.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ocpkni8w.lnk")) returned 0xffffffff [0191.375] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x750f9ce0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76796de0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76796de0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x97b, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="oh9QTp.lnk", cAlternateFileName="")) returned 1 [0191.375] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oh9QTp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oh9qtp.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0191.375] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oh9QTp.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oh9qtp.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0191.376] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x97b [0191.376] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0191.376] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0191.466] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x97b, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x97b, lpOverlapped=0x0) returned 1 [0191.469] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x980, lpOverlapped=0x0) returned 1 [0191.469] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0191.491] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.500] CloseHandle (hObject=0xf0) returned 1 [0191.500] CloseHandle (hObject=0xf4) returned 1 [0191.500] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oh9QTp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oh9qtp.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oh9QTp.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oh9qtp.lnk.dvodltmf")) returned 0 [0191.501] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oh9QTp.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oh9qtp.lnk.dvodltmf")) returned 0x20 [0191.501] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oh9QTp.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x750f9ce0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76796de0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76796de0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x97b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="oh9QTp.lnk", cAlternateFileName="")) returned 0x2e8518 [0191.502] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x750f9ce0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76796de0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76796de0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x97b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="oh9QTp.lnk", cAlternateFileName="")) returned 0 [0191.502] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0191.502] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oh9QTp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oh9qtp.lnk")) returned 1 [0191.503] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oh9QTp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oh9qtp.lnk")) returned 0xffffffff [0191.503] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76adcc20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76adcc20, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76adcc20, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xf7f, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="oo-zD5V-B8.lnk", cAlternateFileName="OO-ZD5~1.LNK")) returned 1 [0191.503] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oo-zD5V-B8.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oo-zd5v-b8.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0191.503] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oo-zD5V-B8.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oo-zd5v-b8.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0191.504] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf7f [0191.504] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0191.504] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0191.590] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xf7f, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xf7f, lpOverlapped=0x0) returned 1 [0191.591] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xf80, lpOverlapped=0x0) returned 1 [0191.592] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0191.613] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.622] CloseHandle (hObject=0xf4) returned 1 [0191.622] CloseHandle (hObject=0xf0) returned 1 [0191.623] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oo-zD5V-B8.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oo-zd5v-b8.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oo-zD5V-B8.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oo-zd5v-b8.lnk.dvodltmf")) returned 0 [0191.623] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oo-zD5V-B8.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oo-zd5v-b8.lnk.dvodltmf")) returned 0x20 [0191.623] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oo-zD5V-B8.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76adcc20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76adcc20, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76adcc20, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xf7f, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="oo-zD5V-B8.lnk", cAlternateFileName="OO-ZD5~1.LNK")) returned 0x2e8518 [0191.624] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76adcc20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76adcc20, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76adcc20, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xf7f, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="oo-zD5V-B8.lnk", cAlternateFileName="OO-ZD5~1.LNK")) returned 0 [0191.624] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0191.624] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oo-zD5V-B8.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oo-zd5v-b8.lnk")) returned 1 [0191.626] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oo-zD5V-B8.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oo-zd5v-b8.lnk")) returned 0xffffffff [0191.626] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75a0d0c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x769f83e0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x769f83e0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x9a5, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="oR7aQet32uvMvWnf.lnk", cAlternateFileName="OR7AQE~1.LNK")) returned 1 [0191.626] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oR7aQet32uvMvWnf.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\or7aqet32uvmvwnf.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0191.627] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oR7aQet32uvMvWnf.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\or7aqet32uvmvwnf.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0191.627] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9a5 [0191.628] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0191.628] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0191.713] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x9a5, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x9a5, lpOverlapped=0x0) returned 1 [0191.714] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x9b0, lpOverlapped=0x0) returned 1 [0191.715] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0191.735] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.745] CloseHandle (hObject=0xf0) returned 1 [0191.745] CloseHandle (hObject=0xf4) returned 1 [0191.745] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oR7aQet32uvMvWnf.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\or7aqet32uvmvwnf.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oR7aQet32uvMvWnf.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\or7aqet32uvmvwnf.lnk.dvodltmf")) returned 0 [0191.746] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oR7aQet32uvMvWnf.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\or7aqet32uvmvwnf.lnk.dvodltmf")) returned 0x20 [0191.746] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oR7aQet32uvMvWnf.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75a0d0c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x769f83e0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x769f83e0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x9a5, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="oR7aQet32uvMvWnf.lnk", cAlternateFileName="OR7AQE~1.LNK")) returned 0x2e8518 [0191.746] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75a0d0c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x769f83e0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x769f83e0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x9a5, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="oR7aQet32uvMvWnf.lnk", cAlternateFileName="OR7AQE~1.LNK")) returned 0 [0191.746] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0191.746] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oR7aQet32uvMvWnf.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\or7aqet32uvmvwnf.lnk")) returned 1 [0191.747] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oR7aQet32uvMvWnf.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\or7aqet32uvmvwnf.lnk")) returned 0xffffffff [0191.747] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x765357e0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x765357e0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x765357e0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xeb0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="oX-YtH9a.lnk", cAlternateFileName="")) returned 1 [0191.747] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oX-YtH9a.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ox-yth9a.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0191.747] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oX-YtH9a.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ox-yth9a.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0191.748] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xeb0 [0191.748] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0191.748] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0191.839] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xeb0, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xeb0, lpOverlapped=0x0) returned 1 [0191.840] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xec0, lpOverlapped=0x0) returned 1 [0191.841] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0191.861] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.871] CloseHandle (hObject=0xf4) returned 1 [0191.871] CloseHandle (hObject=0xf0) returned 1 [0191.871] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oX-YtH9a.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ox-yth9a.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oX-YtH9a.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ox-yth9a.lnk.dvodltmf")) returned 0 [0191.872] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oX-YtH9a.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ox-yth9a.lnk.dvodltmf")) returned 0x20 [0191.872] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oX-YtH9a.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x765357e0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x765357e0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x765357e0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xeb0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="oX-YtH9a.lnk", cAlternateFileName="")) returned 0x2e8518 [0191.872] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x765357e0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x765357e0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x765357e0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xeb0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="oX-YtH9a.lnk", cAlternateFileName="")) returned 0 [0191.872] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0191.872] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oX-YtH9a.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ox-yth9a.lnk")) returned 1 [0191.873] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oX-YtH9a.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ox-yth9a.lnk")) returned 0xffffffff [0191.873] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76026920, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76026920, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7604ca80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="OYA_AmX-oJaA35K4.lnk", cAlternateFileName="OYA_AM~1.LNK")) returned 1 [0191.873] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OYA_AmX-oJaA35K4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oya_amx-ojaa35k4.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0191.873] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OYA_AmX-oJaA35K4.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oya_amx-ojaa35k4.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0191.874] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x410 [0191.874] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0191.875] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0191.971] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x410, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x410, lpOverlapped=0x0) returned 1 [0191.972] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x420, lpOverlapped=0x0) returned 1 [0191.973] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0191.995] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.005] CloseHandle (hObject=0xf0) returned 1 [0192.005] CloseHandle (hObject=0xf4) returned 1 [0192.005] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OYA_AmX-oJaA35K4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oya_amx-ojaa35k4.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OYA_AmX-oJaA35K4.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oya_amx-ojaa35k4.lnk.dvodltmf")) returned 0 [0192.006] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OYA_AmX-oJaA35K4.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oya_amx-ojaa35k4.lnk.dvodltmf")) returned 0x20 [0192.006] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OYA_AmX-oJaA35K4.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76026920, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76026920, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7604ca80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="OYA_AmX-oJaA35K4.lnk", cAlternateFileName="OYA_AM~1.LNK")) returned 0x2e8518 [0192.006] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76026920, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76026920, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7604ca80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="OYA_AmX-oJaA35K4.lnk", cAlternateFileName="OYA_AM~1.LNK")) returned 0 [0192.006] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0192.006] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OYA_AmX-oJaA35K4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oya_amx-ojaa35k4.lnk")) returned 1 [0192.007] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OYA_AmX-oJaA35K4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oya_amx-ojaa35k4.lnk")) returned 0xffffffff [0192.007] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a6a800, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76a6a800, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76a6a800, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="P14cuiSl.lnk", cAlternateFileName="")) returned 1 [0192.007] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P14cuiSl.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p14cuisl.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0192.008] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P14cuiSl.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p14cuisl.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0192.008] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa21 [0192.009] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0192.009] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0192.095] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa21, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xa21, lpOverlapped=0x0) returned 1 [0192.095] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xa30, lpOverlapped=0x0) returned 1 [0192.096] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0192.116] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.126] CloseHandle (hObject=0xf4) returned 1 [0192.126] CloseHandle (hObject=0xf0) returned 1 [0192.127] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P14cuiSl.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p14cuisl.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P14cuiSl.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p14cuisl.lnk.dvodltmf")) returned 0 [0192.127] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P14cuiSl.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p14cuisl.lnk.dvodltmf")) returned 0x20 [0192.127] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P14cuiSl.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a6a800, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76a6a800, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76a6a800, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="P14cuiSl.lnk", cAlternateFileName="")) returned 0x2e8518 [0192.128] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a6a800, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76a6a800, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76a6a800, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="P14cuiSl.lnk", cAlternateFileName="")) returned 0 [0192.128] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0192.128] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P14cuiSl.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p14cuisl.lnk")) returned 1 [0192.129] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P14cuiSl.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p14cuisl.lnk")) returned 0xffffffff [0192.129] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x763928c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x763928c0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x763928c0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xea7, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="P5HgB-k6NjG.lnk", cAlternateFileName="P5HGB-~1.LNK")) returned 1 [0192.129] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P5HgB-k6NjG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p5hgb-k6njg.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0192.129] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P5HgB-k6NjG.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p5hgb-k6njg.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0192.130] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xea7 [0192.130] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0192.130] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0192.225] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xea7, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xea7, lpOverlapped=0x0) returned 1 [0192.225] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xeb0, lpOverlapped=0x0) returned 1 [0192.226] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0192.246] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.256] CloseHandle (hObject=0xf0) returned 1 [0192.256] CloseHandle (hObject=0xf4) returned 1 [0192.256] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P5HgB-k6NjG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p5hgb-k6njg.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P5HgB-k6NjG.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p5hgb-k6njg.lnk.dvodltmf")) returned 0 [0192.257] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P5HgB-k6NjG.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p5hgb-k6njg.lnk.dvodltmf")) returned 0x20 [0192.257] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P5HgB-k6NjG.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x763928c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x763928c0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x763928c0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xea7, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="P5HgB-k6NjG.lnk", cAlternateFileName="P5HGB-~1.LNK")) returned 0x2e8518 [0192.257] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x763928c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x763928c0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x763928c0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xea7, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="P5HgB-k6NjG.lnk", cAlternateFileName="P5HGB-~1.LNK")) returned 0 [0192.257] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0192.257] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P5HgB-k6NjG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p5hgb-k6njg.lnk")) returned 1 [0192.258] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P5HgB-k6NjG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p5hgb-k6njg.lnk")) returned 0xffffffff [0192.258] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x768a1780, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x768a1780, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x768a1780, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1899, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="pM0CwGS1-lc.lnk", cAlternateFileName="PM0CWG~1.LNK")) returned 1 [0192.258] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pM0CwGS1-lc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pm0cwgs1-lc.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0192.258] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pM0CwGS1-lc.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pm0cwgs1-lc.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0192.259] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1899 [0192.259] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0192.260] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0192.344] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1899, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x1899, lpOverlapped=0x0) returned 1 [0192.345] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x18a0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x18a0, lpOverlapped=0x0) returned 1 [0192.346] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0192.371] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.380] CloseHandle (hObject=0xf4) returned 1 [0192.380] CloseHandle (hObject=0xf0) returned 1 [0192.381] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pM0CwGS1-lc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pm0cwgs1-lc.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pM0CwGS1-lc.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pm0cwgs1-lc.lnk.dvodltmf")) returned 0 [0192.381] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pM0CwGS1-lc.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pm0cwgs1-lc.lnk.dvodltmf")) returned 0x20 [0192.382] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pM0CwGS1-lc.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x768a1780, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x768a1780, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x768a1780, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1899, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="pM0CwGS1-lc.lnk", cAlternateFileName="PM0CWG~1.LNK")) returned 0x2e8518 [0192.382] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x768a1780, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x768a1780, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x768a1780, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1899, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="pM0CwGS1-lc.lnk", cAlternateFileName="PM0CWG~1.LNK")) returned 0 [0192.382] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0192.382] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pM0CwGS1-lc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pm0cwgs1-lc.lnk")) returned 1 [0192.383] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pM0CwGS1-lc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pm0cwgs1-lc.lnk")) returned 0xffffffff [0192.383] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74f7cf20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x74f7cf20, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x74f7cf20, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa47, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="pww5JHL18GeJ_4.lnk", cAlternateFileName="PWW5JH~1.LNK")) returned 1 [0192.383] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pww5JHL18GeJ_4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pww5jhl18gej_4.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0192.383] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pww5JHL18GeJ_4.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pww5jhl18gej_4.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0192.384] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa47 [0192.384] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0192.384] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0192.474] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa47, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xa47, lpOverlapped=0x0) returned 1 [0192.475] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xa50, lpOverlapped=0x0) returned 1 [0192.476] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0192.496] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.505] CloseHandle (hObject=0xf0) returned 1 [0192.505] CloseHandle (hObject=0xf4) returned 1 [0192.505] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pww5JHL18GeJ_4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pww5jhl18gej_4.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pww5JHL18GeJ_4.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pww5jhl18gej_4.lnk.dvodltmf")) returned 0 [0192.506] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pww5JHL18GeJ_4.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pww5jhl18gej_4.lnk.dvodltmf")) returned 0x20 [0192.506] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pww5JHL18GeJ_4.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74f7cf20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x74f7cf20, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x74f7cf20, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa47, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="pww5JHL18GeJ_4.lnk", cAlternateFileName="PWW5JH~1.LNK")) returned 0x2e8518 [0192.507] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74f7cf20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x74f7cf20, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x74f7cf20, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa47, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="pww5JHL18GeJ_4.lnk", cAlternateFileName="PWW5JH~1.LNK")) returned 0 [0192.507] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0192.507] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pww5JHL18GeJ_4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pww5jhl18gej_4.lnk")) returned 1 [0192.508] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pww5JHL18GeJ_4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pww5jhl18gej_4.lnk")) returned 0xffffffff [0192.508] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76215b00, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76215b00, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76215b00, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xec7, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="p_KzsX.lnk", cAlternateFileName="")) returned 1 [0192.508] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p_KzsX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p_kzsx.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0192.508] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p_KzsX.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p_kzsx.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0192.509] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xec7 [0192.509] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0192.509] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0192.595] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xec7, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xec7, lpOverlapped=0x0) returned 1 [0192.595] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xed0, lpOverlapped=0x0) returned 1 [0192.596] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0192.616] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.626] CloseHandle (hObject=0xf4) returned 1 [0192.626] CloseHandle (hObject=0xf0) returned 1 [0192.626] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p_KzsX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p_kzsx.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p_KzsX.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p_kzsx.lnk.dvodltmf")) returned 0 [0192.627] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p_KzsX.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p_kzsx.lnk.dvodltmf")) returned 0x20 [0192.627] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p_KzsX.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76215b00, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76215b00, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76215b00, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xec7, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="p_KzsX.lnk", cAlternateFileName="")) returned 0x2e8518 [0192.628] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76215b00, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76215b00, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76215b00, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xec7, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="p_KzsX.lnk", cAlternateFileName="")) returned 0 [0192.628] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0192.628] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p_KzsX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p_kzsx.lnk")) returned 1 [0192.629] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p_KzsX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p_kzsx.lnk")) returned 0xffffffff [0192.629] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7617d580, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7617d580, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7617d580, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x191b, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Q8s3Cbpihf9JdPqZEpa.lnk", cAlternateFileName="Q8S3CB~1.LNK")) returned 1 [0192.629] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q8s3Cbpihf9JdPqZEpa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\q8s3cbpihf9jdpqzepa.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0192.629] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q8s3Cbpihf9JdPqZEpa.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\q8s3cbpihf9jdpqzepa.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0192.630] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x191b [0192.630] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0192.630] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0192.714] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x191b, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x191b, lpOverlapped=0x0) returned 1 [0192.715] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x1920, lpOverlapped=0x0) returned 1 [0192.716] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0192.736] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.745] CloseHandle (hObject=0xf0) returned 1 [0192.745] CloseHandle (hObject=0xf4) returned 1 [0192.746] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q8s3Cbpihf9JdPqZEpa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\q8s3cbpihf9jdpqzepa.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q8s3Cbpihf9JdPqZEpa.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\q8s3cbpihf9jdpqzepa.lnk.dvodltmf")) returned 0 [0192.747] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q8s3Cbpihf9JdPqZEpa.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\q8s3cbpihf9jdpqzepa.lnk.dvodltmf")) returned 0x20 [0192.747] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q8s3Cbpihf9JdPqZEpa.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7617d580, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7617d580, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7617d580, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x191b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Q8s3Cbpihf9JdPqZEpa.lnk", cAlternateFileName="Q8S3CB~1.LNK")) returned 0x2e8518 [0192.747] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7617d580, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7617d580, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7617d580, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x191b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Q8s3Cbpihf9JdPqZEpa.lnk", cAlternateFileName="Q8S3CB~1.LNK")) returned 0 [0192.747] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0192.747] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q8s3Cbpihf9JdPqZEpa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\q8s3cbpihf9jdpqzepa.lnk")) returned 1 [0192.748] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q8s3Cbpihf9JdPqZEpa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\q8s3cbpihf9jdpqzepa.lnk")) returned 0xffffffff [0192.748] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75d79060, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75d79060, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75d79060, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1a5c, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="qaKFTKFT.mkv.lnk", cAlternateFileName="QAKFTK~1.LNK")) returned 1 [0192.748] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qaKFTKFT.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qakftkft.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0192.748] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qaKFTKFT.mkv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qakftkft.mkv.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0192.749] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a5c [0192.749] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0192.750] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0192.836] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1a5c, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x1a5c, lpOverlapped=0x0) returned 1 [0192.837] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1a60, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x1a60, lpOverlapped=0x0) returned 1 [0192.838] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0192.859] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.868] CloseHandle (hObject=0xf4) returned 1 [0192.868] CloseHandle (hObject=0xf0) returned 1 [0192.868] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qaKFTKFT.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qakftkft.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qaKFTKFT.mkv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qakftkft.mkv.lnk.dvodltmf")) returned 0 [0192.869] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qaKFTKFT.mkv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qakftkft.mkv.lnk.dvodltmf")) returned 0x20 [0192.869] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qaKFTKFT.mkv.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75d79060, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75d79060, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75d79060, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1a5c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="qaKFTKFT.mkv.lnk", cAlternateFileName="QAKFTK~1.LNK")) returned 0x2e8518 [0192.870] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75d79060, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75d79060, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75d79060, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1a5c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="qaKFTKFT.mkv.lnk", cAlternateFileName="QAKFTK~1.LNK")) returned 0 [0192.870] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0192.870] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qaKFTKFT.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qakftkft.mkv.lnk")) returned 1 [0192.871] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qaKFTKFT.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qakftkft.mkv.lnk")) returned 0xffffffff [0192.871] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762ae080, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x762ae080, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x762ae080, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="QP97VClzdId.lnk", cAlternateFileName="QP97VC~1.LNK")) returned 1 [0192.871] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QP97VClzdId.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qp97vclzdid.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0192.871] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QP97VClzdId.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qp97vclzdid.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0192.872] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa42 [0192.872] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0192.872] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0192.958] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa42, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xa42, lpOverlapped=0x0) returned 1 [0192.959] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xa50, lpOverlapped=0x0) returned 1 [0192.960] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0192.981] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.991] CloseHandle (hObject=0xf0) returned 1 [0192.991] CloseHandle (hObject=0xf4) returned 1 [0192.991] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QP97VClzdId.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qp97vclzdid.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QP97VClzdId.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qp97vclzdid.lnk.dvodltmf")) returned 0 [0192.992] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QP97VClzdId.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qp97vclzdid.lnk.dvodltmf")) returned 0x20 [0192.992] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QP97VClzdId.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762ae080, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x762ae080, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x762ae080, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="QP97VClzdId.lnk", cAlternateFileName="QP97VC~1.LNK")) returned 0x2e8518 [0192.992] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762ae080, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x762ae080, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x762ae080, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="QP97VClzdId.lnk", cAlternateFileName="QP97VC~1.LNK")) returned 0 [0192.992] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0192.992] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QP97VClzdId.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qp97vclzdid.lnk")) returned 1 [0192.993] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QP97VClzdId.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qp97vclzdid.lnk")) returned 0xffffffff [0192.993] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76287f20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76287f20, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76287f20, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="R2fXTgH_d0P8aJ.lnk", cAlternateFileName="R2FXTG~1.LNK")) returned 1 [0192.993] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R2fXTgH_d0P8aJ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\r2fxtgh_d0p8aj.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0192.993] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R2fXTgH_d0P8aJ.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\r2fxtgh_d0p8aj.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0192.994] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa5c [0192.994] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0192.994] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0193.083] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa5c, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xa5c, lpOverlapped=0x0) returned 1 [0193.084] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xa60, lpOverlapped=0x0) returned 1 [0193.085] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0193.105] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.115] CloseHandle (hObject=0xf4) returned 1 [0193.115] CloseHandle (hObject=0xf0) returned 1 [0193.115] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R2fXTgH_d0P8aJ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\r2fxtgh_d0p8aj.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R2fXTgH_d0P8aJ.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\r2fxtgh_d0p8aj.lnk.dvodltmf")) returned 0 [0193.116] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R2fXTgH_d0P8aJ.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\r2fxtgh_d0p8aj.lnk.dvodltmf")) returned 0x20 [0193.116] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R2fXTgH_d0P8aJ.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76287f20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76287f20, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76287f20, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="R2fXTgH_d0P8aJ.lnk", cAlternateFileName="R2FXTG~1.LNK")) returned 0x2e8518 [0193.116] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76287f20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76287f20, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76287f20, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="R2fXTgH_d0P8aJ.lnk", cAlternateFileName="R2FXTG~1.LNK")) returned 0 [0193.116] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0193.116] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R2fXTgH_d0P8aJ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\r2fxtgh_d0p8aj.lnk")) returned 1 [0193.117] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R2fXTgH_d0P8aJ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\r2fxtgh_d0p8aj.lnk")) returned 0xffffffff [0193.117] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x750ada20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x750ada20, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x750ada20, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x22d, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="rje0DX.lnk", cAlternateFileName="")) returned 1 [0193.117] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rje0DX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rje0dx.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0193.117] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rje0DX.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rje0dx.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0193.118] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x22d [0193.118] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0193.119] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0193.223] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x22d, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x22d, lpOverlapped=0x0) returned 1 [0193.224] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x230, lpOverlapped=0x0) returned 1 [0193.225] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0193.246] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.256] CloseHandle (hObject=0xf0) returned 1 [0193.256] CloseHandle (hObject=0xf4) returned 1 [0193.256] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rje0DX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rje0dx.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rje0DX.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rje0dx.lnk.dvodltmf")) returned 0 [0193.257] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rje0DX.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rje0dx.lnk.dvodltmf")) returned 0x20 [0193.257] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rje0DX.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x750ada20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x750ada20, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x750ada20, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x22d, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="rje0DX.lnk", cAlternateFileName="")) returned 0x2e8518 [0193.258] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x750ada20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x750ada20, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x750ada20, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x22d, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="rje0DX.lnk", cAlternateFileName="")) returned 0 [0193.258] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0193.258] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rje0DX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rje0dx.lnk")) returned 1 [0193.259] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rje0DX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rje0dx.lnk")) returned 0xffffffff [0193.259] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7650f680, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7650f680, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7650f680, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x25c, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="RkROO3lHIfdWH3G.lnk", cAlternateFileName="RKROO3~1.LNK")) returned 1 [0193.259] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RkROO3lHIfdWH3G.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rkroo3lhifdwh3g.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0193.259] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RkROO3lHIfdWH3G.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rkroo3lhifdwh3g.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0193.260] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x25c [0193.260] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0193.260] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0193.346] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x25c, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x25c, lpOverlapped=0x0) returned 1 [0193.346] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x260, lpOverlapped=0x0) returned 1 [0193.347] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0193.373] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.382] CloseHandle (hObject=0xf4) returned 1 [0193.382] CloseHandle (hObject=0xf0) returned 1 [0193.382] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RkROO3lHIfdWH3G.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rkroo3lhifdwh3g.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RkROO3lHIfdWH3G.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rkroo3lhifdwh3g.lnk.dvodltmf")) returned 0 [0193.383] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RkROO3lHIfdWH3G.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rkroo3lhifdwh3g.lnk.dvodltmf")) returned 0x20 [0193.383] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RkROO3lHIfdWH3G.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7650f680, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7650f680, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7650f680, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x25c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="RkROO3lHIfdWH3G.lnk", cAlternateFileName="RKROO3~1.LNK")) returned 0x2e8518 [0193.384] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7650f680, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7650f680, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7650f680, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x25c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="RkROO3lHIfdWH3G.lnk", cAlternateFileName="RKROO3~1.LNK")) returned 0 [0193.384] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0193.384] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RkROO3lHIfdWH3G.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rkroo3lhifdwh3g.lnk")) returned 1 [0193.385] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RkROO3lHIfdWH3G.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rkroo3lhifdwh3g.lnk")) returned 0xffffffff [0193.385] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76bc1460, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76bc1460, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76bc1460, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1853, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="RMcql.lnk", cAlternateFileName="")) returned 1 [0193.385] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RMcql.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rmcql.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0193.385] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RMcql.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rmcql.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0193.386] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1853 [0193.386] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0193.386] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0193.477] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1853, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x1853, lpOverlapped=0x0) returned 1 [0193.477] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1860, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x1860, lpOverlapped=0x0) returned 1 [0193.478] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0193.498] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.508] CloseHandle (hObject=0xf0) returned 1 [0193.508] CloseHandle (hObject=0xf4) returned 1 [0193.508] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RMcql.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rmcql.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RMcql.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rmcql.lnk.dvodltmf")) returned 0 [0193.509] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RMcql.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rmcql.lnk.dvodltmf")) returned 0x20 [0193.509] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RMcql.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76bc1460, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76bc1460, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76bc1460, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1853, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="RMcql.lnk", cAlternateFileName="")) returned 0x2e8518 [0193.509] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76bc1460, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76bc1460, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76bc1460, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1853, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="RMcql.lnk", cAlternateFileName="")) returned 0 [0193.509] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0193.509] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RMcql.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rmcql.lnk")) returned 1 [0193.510] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RMcql.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rmcql.lnk")) returned 0xffffffff [0193.510] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74db3ea0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76ca5ca0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76ca5ca0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x303, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Roaming.lnk", cAlternateFileName="")) returned 1 [0193.510] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0193.511] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0193.515] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x303 [0193.515] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0193.516] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0193.602] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x303, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x303, lpOverlapped=0x0) returned 1 [0193.603] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x310, lpOverlapped=0x0) returned 1 [0193.604] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0193.624] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.635] CloseHandle (hObject=0xf4) returned 1 [0193.635] CloseHandle (hObject=0xf0) returned 1 [0193.635] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk.dvodltmf")) returned 0 [0193.636] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk.dvodltmf")) returned 0x20 [0193.636] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74db3ea0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76ca5ca0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76ca5ca0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x303, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Roaming.lnk", cAlternateFileName="")) returned 0x2e8518 [0193.636] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74db3ea0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76ca5ca0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76ca5ca0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x303, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Roaming.lnk", cAlternateFileName="")) returned 0 [0193.636] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0193.636] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk")) returned 1 [0193.638] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk")) returned 0xffffffff [0193.638] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74db3ea0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x74db3ea0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x74db3ea0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x24d, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="RqnFuFX3oHfx.lnk", cAlternateFileName="RQNFUF~1.LNK")) returned 1 [0193.638] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RqnFuFX3oHfx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rqnfufx3ohfx.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0193.638] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RqnFuFX3oHfx.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rqnfufx3ohfx.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0193.639] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x24d [0193.639] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0193.639] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0193.725] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x24d, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x24d, lpOverlapped=0x0) returned 1 [0193.726] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x250, lpOverlapped=0x0) returned 1 [0193.727] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0193.747] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.757] CloseHandle (hObject=0xf0) returned 1 [0193.757] CloseHandle (hObject=0xf4) returned 1 [0193.757] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RqnFuFX3oHfx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rqnfufx3ohfx.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RqnFuFX3oHfx.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rqnfufx3ohfx.lnk.dvodltmf")) returned 0 [0193.758] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RqnFuFX3oHfx.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rqnfufx3ohfx.lnk.dvodltmf")) returned 0x20 [0193.758] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RqnFuFX3oHfx.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74db3ea0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x74db3ea0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x74db3ea0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x24d, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="RqnFuFX3oHfx.lnk", cAlternateFileName="RQNFUF~1.LNK")) returned 0x2e8518 [0193.758] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74db3ea0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x74db3ea0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x74db3ea0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x24d, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="RqnFuFX3oHfx.lnk", cAlternateFileName="RQNFUF~1.LNK")) returned 0 [0193.758] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0193.758] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RqnFuFX3oHfx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rqnfufx3ohfx.lnk")) returned 1 [0193.759] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RqnFuFX3oHfx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rqnfufx3ohfx.lnk")) returned 0xffffffff [0193.759] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76346600, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76346600, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76346600, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa6e, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="RTRpDDHHvWqeVWn.lnk", cAlternateFileName="RTRPDD~1.LNK")) returned 1 [0193.759] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RTRpDDHHvWqeVWn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rtrpddhhvwqevwn.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0193.759] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RTRpDDHHvWqeVWn.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rtrpddhhvwqevwn.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0193.760] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa6e [0193.760] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0193.760] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0193.851] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa6e, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xa6e, lpOverlapped=0x0) returned 1 [0193.852] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xa70, lpOverlapped=0x0) returned 1 [0193.855] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0193.875] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.884] CloseHandle (hObject=0xf4) returned 1 [0193.885] CloseHandle (hObject=0xf0) returned 1 [0193.885] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RTRpDDHHvWqeVWn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rtrpddhhvwqevwn.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RTRpDDHHvWqeVWn.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rtrpddhhvwqevwn.lnk.dvodltmf")) returned 0 [0193.886] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RTRpDDHHvWqeVWn.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rtrpddhhvwqevwn.lnk.dvodltmf")) returned 0x20 [0193.886] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RTRpDDHHvWqeVWn.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76346600, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76346600, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76346600, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa6e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="RTRpDDHHvWqeVWn.lnk", cAlternateFileName="RTRPDD~1.LNK")) returned 0x2e8518 [0193.886] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76346600, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76346600, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76346600, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa6e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="RTRpDDHHvWqeVWn.lnk", cAlternateFileName="RTRPDD~1.LNK")) returned 0 [0193.887] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0193.887] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RTRpDDHHvWqeVWn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rtrpddhhvwqevwn.lnk")) returned 1 [0193.888] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RTRpDDHHvWqeVWn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rtrpddhhvwqevwn.lnk")) returned 0xffffffff [0193.888] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x755bc8e0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x755bc8e0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x755bc8e0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="RxG jFiGSA1Wy.lnk", cAlternateFileName="RXGJFI~1.LNK")) returned 1 [0193.888] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RxG jFiGSA1Wy.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rxg jfigsa1wy.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0193.888] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RxG jFiGSA1Wy.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rxg jfigsa1wy.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0193.889] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x401 [0193.889] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0193.889] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0193.974] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x401, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x401, lpOverlapped=0x0) returned 1 [0193.975] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x410, lpOverlapped=0x0) returned 1 [0193.976] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0194.001] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.012] CloseHandle (hObject=0xf0) returned 1 [0194.012] CloseHandle (hObject=0xf4) returned 1 [0194.012] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RxG jFiGSA1Wy.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rxg jfigsa1wy.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RxG jFiGSA1Wy.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rxg jfigsa1wy.lnk.dvodltmf")) returned 0 [0194.013] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RxG jFiGSA1Wy.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rxg jfigsa1wy.lnk.dvodltmf")) returned 0x20 [0194.013] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RxG jFiGSA1Wy.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x755bc8e0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x755bc8e0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x755bc8e0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="RxG jFiGSA1Wy.lnk", cAlternateFileName="RXGJFI~1.LNK")) returned 0x2e8518 [0194.013] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x755bc8e0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x755bc8e0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x755bc8e0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="RxG jFiGSA1Wy.lnk", cAlternateFileName="RXGJFI~1.LNK")) returned 0 [0194.013] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0194.014] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RxG jFiGSA1Wy.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rxg jfigsa1wy.lnk")) returned 1 [0194.014] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RxG jFiGSA1Wy.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rxg jfigsa1wy.lnk")) returned 0xffffffff [0194.014] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76581aa0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76581aa0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76581aa0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x19a0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="sfQH6A2H0uM5a.lnk", cAlternateFileName="SFQH6A~1.LNK")) returned 1 [0194.015] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sfQH6A2H0uM5a.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sfqh6a2h0um5a.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0194.015] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sfQH6A2H0uM5a.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sfqh6a2h0um5a.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0194.016] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19a0 [0194.016] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0194.016] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0194.102] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x19a0, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x19a0, lpOverlapped=0x0) returned 1 [0194.103] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x19b0, lpOverlapped=0x0) returned 1 [0194.104] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0194.124] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.134] CloseHandle (hObject=0xf4) returned 1 [0194.134] CloseHandle (hObject=0xf0) returned 1 [0194.134] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sfQH6A2H0uM5a.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sfqh6a2h0um5a.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sfQH6A2H0uM5a.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sfqh6a2h0um5a.lnk.dvodltmf")) returned 0 [0194.135] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sfQH6A2H0uM5a.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sfqh6a2h0um5a.lnk.dvodltmf")) returned 0x20 [0194.135] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sfQH6A2H0uM5a.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76581aa0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76581aa0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76581aa0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x19a0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="sfQH6A2H0uM5a.lnk", cAlternateFileName="SFQH6A~1.LNK")) returned 0x2e8518 [0194.135] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76581aa0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76581aa0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76581aa0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x19a0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="sfQH6A2H0uM5a.lnk", cAlternateFileName="SFQH6A~1.LNK")) returned 0 [0194.135] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0194.135] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sfQH6A2H0uM5a.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sfqh6a2h0um5a.lnk")) returned 1 [0194.136] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sfQH6A2H0uM5a.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sfqh6a2h0um5a.lnk")) returned 0xffffffff [0194.136] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75b89e80, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76985fc0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76985fc0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="SGH-QuStiq.lnk", cAlternateFileName="SGH-QU~1.LNK")) returned 1 [0194.136] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SGH-QuStiq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sgh-qustiq.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0194.136] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SGH-QuStiq.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sgh-qustiq.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0194.137] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xed4 [0194.137] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0194.138] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0194.232] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xed4, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xed4, lpOverlapped=0x0) returned 1 [0194.233] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xee0, lpOverlapped=0x0) returned 1 [0194.234] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0194.254] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.264] CloseHandle (hObject=0xf0) returned 1 [0194.264] CloseHandle (hObject=0xf4) returned 1 [0194.264] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SGH-QuStiq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sgh-qustiq.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SGH-QuStiq.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sgh-qustiq.lnk.dvodltmf")) returned 0 [0194.265] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SGH-QuStiq.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sgh-qustiq.lnk.dvodltmf")) returned 0x20 [0194.265] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SGH-QuStiq.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75b89e80, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76985fc0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76985fc0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="SGH-QuStiq.lnk", cAlternateFileName="SGH-QU~1.LNK")) returned 0x2e8518 [0194.265] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75b89e80, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76985fc0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76985fc0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="SGH-QuStiq.lnk", cAlternateFileName="SGH-QU~1.LNK")) returned 0 [0194.265] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0194.265] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SGH-QuStiq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sgh-qustiq.lnk")) returned 1 [0194.266] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SGH-QuStiq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sgh-qustiq.lnk")) returned 0xffffffff [0194.267] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75f8e3a0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75f8e3a0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75f8e3a0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xebb, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="SO5Gg xGozv6CUDTj4U.lnk", cAlternateFileName="SO5GGX~1.LNK")) returned 1 [0194.267] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SO5Gg xGozv6CUDTj4U.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\so5gg xgozv6cudtj4u.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0194.267] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SO5Gg xGozv6CUDTj4U.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\so5gg xgozv6cudtj4u.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0194.268] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xebb [0194.268] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0194.268] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0194.451] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xebb, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xebb, lpOverlapped=0x0) returned 1 [0194.452] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xec0, lpOverlapped=0x0) returned 1 [0194.454] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0194.481] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.494] CloseHandle (hObject=0xf4) returned 1 [0194.494] CloseHandle (hObject=0xf0) returned 1 [0194.494] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SO5Gg xGozv6CUDTj4U.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\so5gg xgozv6cudtj4u.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SO5Gg xGozv6CUDTj4U.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\so5gg xgozv6cudtj4u.lnk.dvodltmf")) returned 0 [0194.495] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SO5Gg xGozv6CUDTj4U.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\so5gg xgozv6cudtj4u.lnk.dvodltmf")) returned 0x20 [0194.495] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SO5Gg xGozv6CUDTj4U.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75f8e3a0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75f8e3a0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75f8e3a0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xebb, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="SO5Gg xGozv6CUDTj4U.lnk", cAlternateFileName="SO5GGX~1.LNK")) returned 0x2e8518 [0194.495] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75f8e3a0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75f8e3a0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75f8e3a0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xebb, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="SO5Gg xGozv6CUDTj4U.lnk", cAlternateFileName="SO5GGX~1.LNK")) returned 0 [0194.495] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0194.496] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SO5Gg xGozv6CUDTj4U.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\so5gg xgozv6cudtj4u.lnk")) returned 1 [0194.497] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SO5Gg xGozv6CUDTj4U.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\so5gg xgozv6cudtj4u.lnk")) returned 0xffffffff [0194.497] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c33880, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76c33880, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76c33880, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa84, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="SRKICHLSz3vxLCuPI.lnk", cAlternateFileName="SRKICH~1.LNK")) returned 1 [0194.497] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SRKICHLSz3vxLCuPI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\srkichlsz3vxlcupi.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0194.497] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SRKICHLSz3vxLCuPI.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\srkichlsz3vxlcupi.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0194.498] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa84 [0194.498] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0194.499] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0194.595] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa84, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xa84, lpOverlapped=0x0) returned 1 [0194.596] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xa90, lpOverlapped=0x0) returned 1 [0194.596] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0194.617] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.627] CloseHandle (hObject=0xf0) returned 1 [0194.627] CloseHandle (hObject=0xf4) returned 1 [0194.627] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SRKICHLSz3vxLCuPI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\srkichlsz3vxlcupi.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SRKICHLSz3vxLCuPI.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\srkichlsz3vxlcupi.lnk.dvodltmf")) returned 0 [0194.628] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SRKICHLSz3vxLCuPI.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\srkichlsz3vxlcupi.lnk.dvodltmf")) returned 0x20 [0194.628] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SRKICHLSz3vxLCuPI.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c33880, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76c33880, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76c33880, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa84, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="SRKICHLSz3vxLCuPI.lnk", cAlternateFileName="SRKICH~1.LNK")) returned 0x2e8518 [0194.629] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c33880, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76c33880, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76c33880, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa84, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="SRKICHLSz3vxLCuPI.lnk", cAlternateFileName="SRKICH~1.LNK")) returned 0 [0194.629] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0194.629] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SRKICHLSz3vxLCuPI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\srkichlsz3vxlcupi.lnk")) returned 1 [0194.630] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SRKICHLSz3vxLCuPI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\srkichlsz3vxlcupi.lnk")) returned 0xffffffff [0194.630] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76261dc0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76261dc0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76261dc0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1491, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="StJACC4 ObpLCWS.flv.lnk", cAlternateFileName="STJACC~1.LNK")) returned 1 [0194.630] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\StJACC4 ObpLCWS.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\stjacc4 obplcws.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0194.630] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\StJACC4 ObpLCWS.flv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\stjacc4 obplcws.flv.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0194.631] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1491 [0194.631] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0194.631] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0194.722] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1491, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x1491, lpOverlapped=0x0) returned 1 [0194.722] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x14a0, lpOverlapped=0x0) returned 1 [0194.723] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0194.743] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.754] CloseHandle (hObject=0xf4) returned 1 [0194.754] CloseHandle (hObject=0xf0) returned 1 [0194.754] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\StJACC4 ObpLCWS.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\stjacc4 obplcws.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\StJACC4 ObpLCWS.flv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\stjacc4 obplcws.flv.lnk.dvodltmf")) returned 0 [0194.755] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\StJACC4 ObpLCWS.flv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\stjacc4 obplcws.flv.lnk.dvodltmf")) returned 0x20 [0194.755] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\StJACC4 ObpLCWS.flv.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76261dc0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76261dc0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76261dc0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1491, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="StJACC4 ObpLCWS.flv.lnk", cAlternateFileName="STJACC~1.LNK")) returned 0x2e8518 [0194.755] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76261dc0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76261dc0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76261dc0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1491, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="StJACC4 ObpLCWS.flv.lnk", cAlternateFileName="STJACC~1.LNK")) returned 0 [0194.755] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0194.755] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\StJACC4 ObpLCWS.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\stjacc4 obplcws.flv.lnk")) returned 1 [0194.756] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\StJACC4 ObpLCWS.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\stjacc4 obplcws.flv.lnk")) returned 0xffffffff [0194.756] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74ccf660, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76c0d720, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76c0d720, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1a40, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="sVfTBTyNMNlPOziIoPg.lnk", cAlternateFileName="SVFTBT~1.LNK")) returned 1 [0194.756] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sVfTBTyNMNlPOziIoPg.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\svftbtynmnlpoziiopg.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0194.756] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sVfTBTyNMNlPOziIoPg.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\svftbtynmnlpoziiopg.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0194.757] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a40 [0194.757] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0194.758] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0194.850] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1a40, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x1a40, lpOverlapped=0x0) returned 1 [0194.851] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1a50, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x1a50, lpOverlapped=0x0) returned 1 [0194.852] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0194.879] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.892] CloseHandle (hObject=0xf0) returned 1 [0194.892] CloseHandle (hObject=0xf4) returned 1 [0194.892] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sVfTBTyNMNlPOziIoPg.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\svftbtynmnlpoziiopg.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sVfTBTyNMNlPOziIoPg.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\svftbtynmnlpoziiopg.lnk.dvodltmf")) returned 0 [0194.896] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sVfTBTyNMNlPOziIoPg.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\svftbtynmnlpoziiopg.lnk.dvodltmf")) returned 0x20 [0194.896] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sVfTBTyNMNlPOziIoPg.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74ccf660, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76c0d720, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76c0d720, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1a40, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="sVfTBTyNMNlPOziIoPg.lnk", cAlternateFileName="SVFTBT~1.LNK")) returned 0x2e8518 [0194.896] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74ccf660, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76c0d720, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76c0d720, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1a40, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="sVfTBTyNMNlPOziIoPg.lnk", cAlternateFileName="SVFTBT~1.LNK")) returned 0 [0194.896] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0194.896] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sVfTBTyNMNlPOziIoPg.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\svftbtynmnlpoziiopg.lnk")) returned 1 [0194.897] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sVfTBTyNMNlPOziIoPg.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\svftbtynmnlpoziiopg.lnk")) returned 0xffffffff [0194.897] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x751b83c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76c7fb40, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76ca5ca0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x9f7, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="t0Gj66L300JmUfmf6Kv.lnk", cAlternateFileName="T0GJ66~1.LNK")) returned 1 [0194.897] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\t0Gj66L300JmUfmf6Kv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\t0gj66l300jmufmf6kv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0194.898] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\t0Gj66L300JmUfmf6Kv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\t0gj66l300jmufmf6kv.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0194.899] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9f7 [0194.899] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0194.899] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0194.989] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x9f7, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x9f7, lpOverlapped=0x0) returned 1 [0194.990] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xa00, lpOverlapped=0x0) returned 1 [0194.991] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0195.011] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.021] CloseHandle (hObject=0xf4) returned 1 [0195.021] CloseHandle (hObject=0xf0) returned 1 [0195.021] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\t0Gj66L300JmUfmf6Kv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\t0gj66l300jmufmf6kv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\t0Gj66L300JmUfmf6Kv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\t0gj66l300jmufmf6kv.lnk.dvodltmf")) returned 0 [0195.022] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\t0Gj66L300JmUfmf6Kv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\t0gj66l300jmufmf6kv.lnk.dvodltmf")) returned 0x20 [0195.022] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\t0Gj66L300JmUfmf6Kv.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x751b83c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76c7fb40, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76ca5ca0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x9f7, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="t0Gj66L300JmUfmf6Kv.lnk", cAlternateFileName="T0GJ66~1.LNK")) returned 0x2e8518 [0195.022] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x751b83c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76c7fb40, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76ca5ca0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x9f7, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="t0Gj66L300JmUfmf6Kv.lnk", cAlternateFileName="T0GJ66~1.LNK")) returned 0 [0195.022] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0195.022] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\t0Gj66L300JmUfmf6Kv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\t0gj66l300jmufmf6kv.lnk")) returned 1 [0195.023] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\t0Gj66L300JmUfmf6Kv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\t0gj66l300jmufmf6kv.lnk")) returned 0xffffffff [0195.023] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76770c80, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76770c80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76770c80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x18c2, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="ToDmkBSUVqEx5k.lnk", cAlternateFileName="TODMKB~1.LNK")) returned 1 [0195.023] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ToDmkBSUVqEx5k.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\todmkbsuvqex5k.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0195.023] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ToDmkBSUVqEx5k.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\todmkbsuvqex5k.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0195.024] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18c2 [0195.024] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0195.024] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0195.109] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x18c2, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x18c2, lpOverlapped=0x0) returned 1 [0195.110] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x18d0, lpOverlapped=0x0) returned 1 [0195.111] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0195.131] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.141] CloseHandle (hObject=0xf0) returned 1 [0195.141] CloseHandle (hObject=0xf4) returned 1 [0195.141] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ToDmkBSUVqEx5k.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\todmkbsuvqex5k.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ToDmkBSUVqEx5k.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\todmkbsuvqex5k.lnk.dvodltmf")) returned 0 [0195.142] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ToDmkBSUVqEx5k.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\todmkbsuvqex5k.lnk.dvodltmf")) returned 0x20 [0195.142] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ToDmkBSUVqEx5k.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76770c80, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76770c80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76770c80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x18c2, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ToDmkBSUVqEx5k.lnk", cAlternateFileName="TODMKB~1.LNK")) returned 0x2e8518 [0195.142] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76770c80, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76770c80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76770c80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x18c2, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ToDmkBSUVqEx5k.lnk", cAlternateFileName="TODMKB~1.LNK")) returned 0 [0195.142] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0195.142] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ToDmkBSUVqEx5k.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\todmkbsuvqex5k.lnk")) returned 1 [0195.143] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ToDmkBSUVqEx5k.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\todmkbsuvqex5k.lnk")) returned 0xffffffff [0195.143] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x757abac0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x757abac0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x757abac0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xefe, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="twPPIMyU4z4b.lnk", cAlternateFileName="TWPPIM~1.LNK")) returned 1 [0195.143] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\twPPIMyU4z4b.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\twppimyu4z4b.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0195.144] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\twPPIMyU4z4b.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\twppimyu4z4b.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0195.144] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xefe [0195.144] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0195.145] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0195.236] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xefe, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xefe, lpOverlapped=0x0) returned 1 [0195.237] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xf00, lpOverlapped=0x0) returned 1 [0195.238] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0195.258] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.267] CloseHandle (hObject=0xf4) returned 1 [0195.267] CloseHandle (hObject=0xf0) returned 1 [0195.268] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\twPPIMyU4z4b.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\twppimyu4z4b.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\twPPIMyU4z4b.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\twppimyu4z4b.lnk.dvodltmf")) returned 0 [0195.268] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\twPPIMyU4z4b.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\twppimyu4z4b.lnk.dvodltmf")) returned 0x20 [0195.269] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\twPPIMyU4z4b.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x757abac0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x757abac0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x757abac0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xefe, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="twPPIMyU4z4b.lnk", cAlternateFileName="TWPPIM~1.LNK")) returned 0x2e8518 [0195.269] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x757abac0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x757abac0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x757abac0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xefe, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="twPPIMyU4z4b.lnk", cAlternateFileName="TWPPIM~1.LNK")) returned 0 [0195.269] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0195.269] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\twPPIMyU4z4b.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\twppimyu4z4b.lnk")) returned 1 [0195.270] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\twPPIMyU4z4b.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\twppimyu4z4b.lnk")) returned 0xffffffff [0195.270] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x758dc5c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76bc1460, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76bc1460, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1290, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="tYMP8.lnk", cAlternateFileName="")) returned 1 [0195.270] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tYMP8.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tymp8.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0195.270] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tYMP8.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tymp8.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0195.271] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1290 [0195.271] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0195.271] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0195.403] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1290, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x1290, lpOverlapped=0x0) returned 1 [0195.404] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x12a0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x12a0, lpOverlapped=0x0) returned 1 [0195.405] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0195.425] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.435] CloseHandle (hObject=0xf0) returned 1 [0195.435] CloseHandle (hObject=0xf4) returned 1 [0195.435] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tYMP8.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tymp8.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tYMP8.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tymp8.lnk.dvodltmf")) returned 0 [0195.436] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tYMP8.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tymp8.lnk.dvodltmf")) returned 0x20 [0195.436] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tYMP8.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x758dc5c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76bc1460, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76bc1460, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1290, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="tYMP8.lnk", cAlternateFileName="")) returned 0x2e8518 [0195.436] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x758dc5c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76bc1460, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76bc1460, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1290, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="tYMP8.lnk", cAlternateFileName="")) returned 0 [0195.436] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0195.436] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tYMP8.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tymp8.lnk")) returned 1 [0195.437] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tYMP8.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tymp8.lnk")) returned 0xffffffff [0195.437] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a90960, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76a90960, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76a90960, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="U7OayEQ.lnk", cAlternateFileName="")) returned 1 [0195.437] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U7OayEQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\u7oayeq.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0195.437] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U7OayEQ.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\u7oayeq.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0195.438] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b5 [0195.438] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0195.438] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0195.529] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2b5, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x2b5, lpOverlapped=0x0) returned 1 [0195.530] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x2c0, lpOverlapped=0x0) returned 1 [0195.531] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0195.551] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.561] CloseHandle (hObject=0xf4) returned 1 [0195.561] CloseHandle (hObject=0xf0) returned 1 [0195.561] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U7OayEQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\u7oayeq.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U7OayEQ.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\u7oayeq.lnk.dvodltmf")) returned 0 [0195.562] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U7OayEQ.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\u7oayeq.lnk.dvodltmf")) returned 0x20 [0195.562] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U7OayEQ.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a90960, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76a90960, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76a90960, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="U7OayEQ.lnk", cAlternateFileName="")) returned 0x2e8518 [0195.562] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a90960, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76a90960, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76a90960, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="U7OayEQ.lnk", cAlternateFileName="")) returned 0 [0195.562] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0195.562] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U7OayEQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\u7oayeq.lnk")) returned 1 [0195.563] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U7OayEQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\u7oayeq.lnk")) returned 0xffffffff [0195.563] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7687b620, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7687b620, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7687b620, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x13cc, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="uiX5BdPsFMDFbsKCrR.lnk", cAlternateFileName="UIX5BD~1.LNK")) returned 1 [0195.563] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uiX5BdPsFMDFbsKCrR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uix5bdpsfmdfbskcrr.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0195.564] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uiX5BdPsFMDFbsKCrR.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uix5bdpsfmdfbskcrr.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0195.564] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13cc [0195.564] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0195.565] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0195.651] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x13cc, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x13cc, lpOverlapped=0x0) returned 1 [0195.651] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x13d0, lpOverlapped=0x0) returned 1 [0195.652] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0195.672] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.682] CloseHandle (hObject=0xf0) returned 1 [0195.682] CloseHandle (hObject=0xf4) returned 1 [0195.683] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uiX5BdPsFMDFbsKCrR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uix5bdpsfmdfbskcrr.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uiX5BdPsFMDFbsKCrR.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uix5bdpsfmdfbskcrr.lnk.dvodltmf")) returned 0 [0195.683] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uiX5BdPsFMDFbsKCrR.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uix5bdpsfmdfbskcrr.lnk.dvodltmf")) returned 0x20 [0195.683] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uiX5BdPsFMDFbsKCrR.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7687b620, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7687b620, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7687b620, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x13cc, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="uiX5BdPsFMDFbsKCrR.lnk", cAlternateFileName="UIX5BD~1.LNK")) returned 0x2e8518 [0195.684] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7687b620, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x7687b620, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7687b620, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x13cc, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="uiX5BdPsFMDFbsKCrR.lnk", cAlternateFileName="UIX5BD~1.LNK")) returned 0 [0195.684] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0195.684] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uiX5BdPsFMDFbsKCrR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uix5bdpsfmdfbskcrr.lnk")) returned 1 [0195.685] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uiX5BdPsFMDFbsKCrR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uix5bdpsfmdfbskcrr.lnk")) returned 0xffffffff [0195.685] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x763204a0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x763204a0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x763204a0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x14d3, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="uM9tnb qK.lnk", cAlternateFileName="UM9TNB~1.LNK")) returned 1 [0195.685] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uM9tnb qK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\um9tnb qk.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0195.685] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uM9tnb qK.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\um9tnb qk.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0195.686] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14d3 [0195.686] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0195.686] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0195.772] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x14d3, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x14d3, lpOverlapped=0x0) returned 1 [0195.773] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x14e0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x14e0, lpOverlapped=0x0) returned 1 [0195.792] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0195.811] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.820] CloseHandle (hObject=0xf4) returned 1 [0195.820] CloseHandle (hObject=0xf0) returned 1 [0195.820] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uM9tnb qK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\um9tnb qk.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uM9tnb qK.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\um9tnb qk.lnk.dvodltmf")) returned 0 [0195.821] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uM9tnb qK.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\um9tnb qk.lnk.dvodltmf")) returned 0x20 [0195.822] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uM9tnb qK.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x763204a0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x763204a0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x763204a0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x14d3, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="uM9tnb qK.lnk", cAlternateFileName="UM9TNB~1.LNK")) returned 0x2e8518 [0195.822] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x763204a0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x763204a0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x763204a0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x14d3, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="uM9tnb qK.lnk", cAlternateFileName="UM9TNB~1.LNK")) returned 0 [0195.822] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0195.822] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uM9tnb qK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\um9tnb qk.lnk")) returned 1 [0195.823] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uM9tnb qK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\um9tnb qk.lnk")) returned 0xffffffff [0195.823] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75dc5320, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75dc5320, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75dc5320, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa04, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="usgjtq.lnk", cAlternateFileName="")) returned 1 [0195.823] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\usgjtq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\usgjtq.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0195.823] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\usgjtq.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\usgjtq.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0195.824] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa04 [0195.824] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0195.825] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0195.909] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa04, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xa04, lpOverlapped=0x0) returned 1 [0195.910] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xa10, lpOverlapped=0x0) returned 1 [0195.910] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0195.932] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.941] CloseHandle (hObject=0xf0) returned 1 [0195.942] CloseHandle (hObject=0xf4) returned 1 [0195.942] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\usgjtq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\usgjtq.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\usgjtq.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\usgjtq.lnk.dvodltmf")) returned 0 [0195.943] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\usgjtq.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\usgjtq.lnk.dvodltmf")) returned 0x20 [0195.943] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\usgjtq.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75dc5320, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75dc5320, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75dc5320, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa04, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="usgjtq.lnk", cAlternateFileName="")) returned 0x2e8518 [0195.943] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75dc5320, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75dc5320, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75dc5320, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa04, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="usgjtq.lnk", cAlternateFileName="")) returned 0 [0195.943] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0195.943] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\usgjtq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\usgjtq.lnk")) returned 1 [0195.944] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\usgjtq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\usgjtq.lnk")) returned 0xffffffff [0195.944] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75e83a00, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75e83a00, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75e83a00, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x26b8, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="V8dZzoq2O8osR.lnk", cAlternateFileName="V8DZZO~1.LNK")) returned 1 [0195.945] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V8dZzoq2O8osR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\v8dzzoq2o8osr.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0195.945] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V8dZzoq2O8osR.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\v8dzzoq2o8osr.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0195.946] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x26b8 [0195.947] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0195.947] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0196.033] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x26b8, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x26b8, lpOverlapped=0x0) returned 1 [0196.034] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x26c0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x26c0, lpOverlapped=0x0) returned 1 [0196.035] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0196.055] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.065] CloseHandle (hObject=0xf4) returned 1 [0196.065] CloseHandle (hObject=0xf0) returned 1 [0196.065] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V8dZzoq2O8osR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\v8dzzoq2o8osr.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V8dZzoq2O8osR.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\v8dzzoq2o8osr.lnk.dvodltmf")) returned 0 [0196.066] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V8dZzoq2O8osR.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\v8dzzoq2o8osr.lnk.dvodltmf")) returned 0x20 [0196.066] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V8dZzoq2O8osR.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75e83a00, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75e83a00, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75e83a00, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x26b8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="V8dZzoq2O8osR.lnk", cAlternateFileName="V8DZZO~1.LNK")) returned 0x2e8518 [0196.066] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75e83a00, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75e83a00, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75e83a00, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x26b8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="V8dZzoq2O8osR.lnk", cAlternateFileName="V8DZZO~1.LNK")) returned 0 [0196.066] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0196.066] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V8dZzoq2O8osR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\v8dzzoq2o8osr.lnk")) returned 1 [0196.067] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V8dZzoq2O8osR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\v8dzzoq2o8osr.lnk")) returned 0xffffffff [0196.067] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75596780, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75596780, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75596780, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x3dc, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="VwxOP6.lnk", cAlternateFileName="")) returned 1 [0196.067] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VwxOP6.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vwxop6.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0196.067] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VwxOP6.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vwxop6.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0196.068] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3dc [0196.068] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0196.069] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0196.154] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3dc, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x3dc, lpOverlapped=0x0) returned 1 [0196.155] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x3e0, lpOverlapped=0x0) returned 1 [0196.156] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0196.176] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.186] CloseHandle (hObject=0xf0) returned 1 [0196.186] CloseHandle (hObject=0xf4) returned 1 [0196.186] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VwxOP6.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vwxop6.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VwxOP6.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vwxop6.lnk.dvodltmf")) returned 0 [0196.187] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VwxOP6.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vwxop6.lnk.dvodltmf")) returned 0x20 [0196.187] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VwxOP6.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75596780, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75596780, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75596780, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x3dc, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="VwxOP6.lnk", cAlternateFileName="")) returned 0x2e8518 [0196.188] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75596780, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75596780, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75596780, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x3dc, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="VwxOP6.lnk", cAlternateFileName="")) returned 0 [0196.188] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0196.188] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VwxOP6.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vwxop6.lnk")) returned 1 [0196.189] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VwxOP6.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vwxop6.lnk")) returned 0xffffffff [0196.189] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c599e0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76c599e0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76c599e0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x3d5, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="VzhSp.lnk", cAlternateFileName="")) returned 1 [0196.189] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VzhSp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vzhsp.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0196.189] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VzhSp.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vzhsp.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0196.190] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d5 [0196.190] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0196.190] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0196.283] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3d5, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x3d5, lpOverlapped=0x0) returned 1 [0196.284] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x3e0, lpOverlapped=0x0) returned 1 [0196.285] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0196.305] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.315] CloseHandle (hObject=0xf4) returned 1 [0196.315] CloseHandle (hObject=0xf0) returned 1 [0196.315] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VzhSp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vzhsp.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VzhSp.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vzhsp.lnk.dvodltmf")) returned 0 [0196.316] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VzhSp.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vzhsp.lnk.dvodltmf")) returned 0x20 [0196.316] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VzhSp.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c599e0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76c599e0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76c599e0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x3d5, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="VzhSp.lnk", cAlternateFileName="")) returned 0x2e8518 [0196.316] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c599e0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76c599e0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76c599e0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x3d5, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="VzhSp.lnk", cAlternateFileName="")) returned 0 [0196.316] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0196.316] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VzhSp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vzhsp.lnk")) returned 1 [0196.317] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VzhSp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vzhsp.lnk")) returned 0xffffffff [0196.317] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x768eda40, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x768eda40, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x768eda40, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe53, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="W5noju-.lnk", cAlternateFileName="")) returned 1 [0196.317] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W5noju-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w5noju-.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0196.317] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W5noju-.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w5noju-.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0196.318] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe53 [0196.318] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0196.318] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0196.410] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe53, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xe53, lpOverlapped=0x0) returned 1 [0196.410] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xe60, lpOverlapped=0x0) returned 1 [0196.411] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0196.432] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.441] CloseHandle (hObject=0xf0) returned 1 [0196.441] CloseHandle (hObject=0xf4) returned 1 [0196.442] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W5noju-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w5noju-.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W5noju-.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w5noju-.lnk.dvodltmf")) returned 0 [0196.442] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W5noju-.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w5noju-.lnk.dvodltmf")) returned 0x20 [0196.442] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W5noju-.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x768eda40, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x768eda40, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x768eda40, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe53, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="W5noju-.lnk", cAlternateFileName="")) returned 0x2e8518 [0196.443] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x768eda40, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x768eda40, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x768eda40, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xe53, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="W5noju-.lnk", cAlternateFileName="")) returned 0 [0196.443] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0196.443] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W5noju-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w5noju-.lnk")) returned 1 [0196.444] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W5noju-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w5noju-.lnk")) returned 0xffffffff [0196.444] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x758dc5c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x758dc5c0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x758dc5c0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1850, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="whvR.lnk", cAlternateFileName="")) returned 1 [0196.444] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\whvR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\whvr.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0196.444] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\whvR.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\whvr.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0196.445] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1850 [0196.445] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0196.445] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0196.533] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1850, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x1850, lpOverlapped=0x0) returned 1 [0196.534] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1860, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x1860, lpOverlapped=0x0) returned 1 [0196.535] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0196.555] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.565] CloseHandle (hObject=0xf4) returned 1 [0196.565] CloseHandle (hObject=0xf0) returned 1 [0196.565] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\whvR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\whvr.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\whvR.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\whvr.lnk.dvodltmf")) returned 0 [0196.566] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\whvR.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\whvr.lnk.dvodltmf")) returned 0x20 [0196.566] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\whvR.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x758dc5c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x758dc5c0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x758dc5c0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1850, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="whvR.lnk", cAlternateFileName="")) returned 0x2e8518 [0196.566] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x758dc5c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x758dc5c0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x758dc5c0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1850, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="whvR.lnk", cAlternateFileName="")) returned 0 [0196.566] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0196.566] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\whvR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\whvr.lnk")) returned 1 [0196.567] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\whvR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\whvr.lnk")) returned 0xffffffff [0196.567] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x757d1c20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x757d1c20, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x757d1c20, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xf0f, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="wPGoGpK0u9zAIveQT.lnk", cAlternateFileName="WPGOGP~1.LNK")) returned 1 [0196.567] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wPGoGpK0u9zAIveQT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wpgogpk0u9zaiveqt.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0196.567] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wPGoGpK0u9zAIveQT.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wpgogpk0u9zaiveqt.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0196.568] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf0f [0196.569] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0196.569] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0196.657] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xf0f, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xf0f, lpOverlapped=0x0) returned 1 [0196.657] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xf10, lpOverlapped=0x0) returned 1 [0196.658] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0196.678] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.688] CloseHandle (hObject=0xf0) returned 1 [0196.688] CloseHandle (hObject=0xf4) returned 1 [0196.688] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wPGoGpK0u9zAIveQT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wpgogpk0u9zaiveqt.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wPGoGpK0u9zAIveQT.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wpgogpk0u9zaiveqt.lnk.dvodltmf")) returned 0 [0196.689] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wPGoGpK0u9zAIveQT.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wpgogpk0u9zaiveqt.lnk.dvodltmf")) returned 0x20 [0196.689] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wPGoGpK0u9zAIveQT.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x757d1c20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x757d1c20, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x757d1c20, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xf0f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="wPGoGpK0u9zAIveQT.lnk", cAlternateFileName="WPGOGP~1.LNK")) returned 0x2e8518 [0196.689] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x757d1c20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x757d1c20, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x757d1c20, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xf0f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="wPGoGpK0u9zAIveQT.lnk", cAlternateFileName="WPGOGP~1.LNK")) returned 0 [0196.690] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0196.690] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wPGoGpK0u9zAIveQT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wpgogpk0u9zaiveqt.lnk")) returned 1 [0196.690] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wPGoGpK0u9zAIveQT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wpgogpk0u9zaiveqt.lnk")) returned 0xffffffff [0196.691] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76346600, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76346600, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76346600, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa37, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="W_6oxCtCN-.lnk", cAlternateFileName="W_6OXC~1.LNK")) returned 1 [0196.691] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W_6oxCtCN-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w_6oxctcn-.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0196.691] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W_6oxCtCN-.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w_6oxctcn-.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0196.692] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa37 [0196.692] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0196.692] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0196.778] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa37, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xa37, lpOverlapped=0x0) returned 1 [0196.779] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xa40, lpOverlapped=0x0) returned 1 [0196.780] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0196.800] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.810] CloseHandle (hObject=0xf4) returned 1 [0196.810] CloseHandle (hObject=0xf0) returned 1 [0196.810] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W_6oxCtCN-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w_6oxctcn-.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W_6oxCtCN-.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w_6oxctcn-.lnk.dvodltmf")) returned 0 [0196.811] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W_6oxCtCN-.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w_6oxctcn-.lnk.dvodltmf")) returned 0x20 [0196.811] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W_6oxCtCN-.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76346600, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76346600, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76346600, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa37, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="W_6oxCtCN-.lnk", cAlternateFileName="W_6OXC~1.LNK")) returned 0x2e8518 [0196.812] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76346600, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76346600, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76346600, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa37, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="W_6oxCtCN-.lnk", cAlternateFileName="W_6OXC~1.LNK")) returned 0 [0196.812] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0196.812] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W_6oxCtCN-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w_6oxctcn-.lnk")) returned 1 [0196.813] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W_6oxCtCN-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w_6oxctcn-.lnk")) returned 0xffffffff [0196.813] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75ecfcc0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75ecfcc0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75ecfcc0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x232, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Xc_az0A.lnk", cAlternateFileName="")) returned 1 [0196.813] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Xc_az0A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xc_az0a.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0196.813] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Xc_az0A.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xc_az0a.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0196.814] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x232 [0196.814] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0196.814] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0196.899] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x232, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x232, lpOverlapped=0x0) returned 1 [0196.899] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x240, lpOverlapped=0x0) returned 1 [0196.900] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0196.922] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.931] CloseHandle (hObject=0xf0) returned 1 [0196.931] CloseHandle (hObject=0xf4) returned 1 [0196.931] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Xc_az0A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xc_az0a.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Xc_az0A.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xc_az0a.lnk.dvodltmf")) returned 0 [0196.932] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Xc_az0A.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xc_az0a.lnk.dvodltmf")) returned 0x20 [0196.932] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Xc_az0A.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75ecfcc0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75ecfcc0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75ecfcc0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x232, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Xc_az0A.lnk", cAlternateFileName="")) returned 0x2e8518 [0196.933] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75ecfcc0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75ecfcc0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75ecfcc0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x232, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Xc_az0A.lnk", cAlternateFileName="")) returned 0 [0196.933] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0196.933] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Xc_az0A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xc_az0a.lnk")) returned 1 [0196.933] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Xc_az0A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xc_az0a.lnk")) returned 0xffffffff [0196.934] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x761ef9a0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x761ef9a0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x761ef9a0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x26b, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="XDXf5ELkjgk ntWCWo.lnk", cAlternateFileName="XDXF5E~1.LNK")) returned 1 [0196.934] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XDXf5ELkjgk ntWCWo.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xdxf5elkjgk ntwcwo.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0196.934] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XDXf5ELkjgk ntWCWo.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xdxf5elkjgk ntwcwo.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0196.934] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x26b [0196.935] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0196.935] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0197.019] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x26b, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x26b, lpOverlapped=0x0) returned 1 [0197.020] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x270, lpOverlapped=0x0) returned 1 [0197.021] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0197.042] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.051] CloseHandle (hObject=0xf4) returned 1 [0197.051] CloseHandle (hObject=0xf0) returned 1 [0197.051] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XDXf5ELkjgk ntWCWo.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xdxf5elkjgk ntwcwo.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XDXf5ELkjgk ntWCWo.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xdxf5elkjgk ntwcwo.lnk.dvodltmf")) returned 0 [0197.052] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XDXf5ELkjgk ntWCWo.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xdxf5elkjgk ntwcwo.lnk.dvodltmf")) returned 0x20 [0197.052] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XDXf5ELkjgk ntWCWo.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x761ef9a0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x761ef9a0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x761ef9a0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x26b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="XDXf5ELkjgk ntWCWo.lnk", cAlternateFileName="XDXF5E~1.LNK")) returned 0x2e8518 [0197.053] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x761ef9a0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x761ef9a0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x761ef9a0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x26b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="XDXf5ELkjgk ntWCWo.lnk", cAlternateFileName="XDXF5E~1.LNK")) returned 0 [0197.053] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0197.053] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XDXf5ELkjgk ntWCWo.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xdxf5elkjgk ntwcwo.lnk")) returned 1 [0197.054] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XDXf5ELkjgk ntWCWo.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xdxf5elkjgk ntwcwo.lnk")) returned 0xffffffff [0197.054] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x750ada20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x750ada20, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x750ada20, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="XGXcLAkDayu9dYpJRN.lnk", cAlternateFileName="XGXCLA~1.LNK")) returned 1 [0197.054] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XGXcLAkDayu9dYpJRN.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xgxclakdayu9dypjrn.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0197.054] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XGXcLAkDayu9dYpJRN.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xgxclakdayu9dypjrn.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0197.055] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa8f [0197.055] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0197.055] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0197.157] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa8f, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xa8f, lpOverlapped=0x0) returned 1 [0197.158] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xa90, lpOverlapped=0x0) returned 1 [0197.159] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0197.179] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.189] CloseHandle (hObject=0xf0) returned 1 [0197.189] CloseHandle (hObject=0xf4) returned 1 [0197.189] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XGXcLAkDayu9dYpJRN.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xgxclakdayu9dypjrn.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XGXcLAkDayu9dYpJRN.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xgxclakdayu9dypjrn.lnk.dvodltmf")) returned 0 [0197.190] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XGXcLAkDayu9dYpJRN.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xgxclakdayu9dypjrn.lnk.dvodltmf")) returned 0x20 [0197.190] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XGXcLAkDayu9dYpJRN.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x750ada20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x750ada20, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x750ada20, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="XGXcLAkDayu9dYpJRN.lnk", cAlternateFileName="XGXCLA~1.LNK")) returned 0x2e8518 [0197.190] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x750ada20, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x750ada20, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x750ada20, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="XGXcLAkDayu9dYpJRN.lnk", cAlternateFileName="XGXCLA~1.LNK")) returned 0 [0197.190] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0197.190] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XGXcLAkDayu9dYpJRN.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xgxclakdayu9dypjrn.lnk")) returned 1 [0197.191] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XGXcLAkDayu9dYpJRN.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xgxclakdayu9dypjrn.lnk")) returned 0xffffffff [0197.191] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76b751a0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76b751a0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76b751a0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x3d0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="xLRB.lnk", cAlternateFileName="")) returned 1 [0197.191] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xLRB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xlrb.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0197.192] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xLRB.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xlrb.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0197.192] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d0 [0197.193] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0197.193] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0197.285] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3d0, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x3d0, lpOverlapped=0x0) returned 1 [0197.286] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x3e0, lpOverlapped=0x0) returned 1 [0197.287] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0197.307] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.317] CloseHandle (hObject=0xf4) returned 1 [0197.317] CloseHandle (hObject=0xf0) returned 1 [0197.317] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xLRB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xlrb.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xLRB.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xlrb.lnk.dvodltmf")) returned 0 [0197.318] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xLRB.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xlrb.lnk.dvodltmf")) returned 0x20 [0197.318] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xLRB.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76b751a0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76b751a0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76b751a0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x3d0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="xLRB.lnk", cAlternateFileName="")) returned 0x2e8518 [0197.318] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76b751a0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76b751a0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76b751a0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x3d0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="xLRB.lnk", cAlternateFileName="")) returned 0 [0197.318] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0197.318] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xLRB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xlrb.lnk")) returned 1 [0197.319] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xLRB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xlrb.lnk")) returned 0xffffffff [0197.319] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74728220, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76ab6ac0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76ab6ac0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1d5, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="xmySE9uE.lnk", cAlternateFileName="")) returned 1 [0197.319] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xmySE9uE.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xmyse9ue.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0197.320] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xmySE9uE.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xmyse9ue.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0197.320] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d5 [0197.321] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0197.321] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0197.411] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1d5, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x1d5, lpOverlapped=0x0) returned 1 [0197.412] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x1e0, lpOverlapped=0x0) returned 1 [0197.413] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0197.433] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.442] CloseHandle (hObject=0xf0) returned 1 [0197.442] CloseHandle (hObject=0xf4) returned 1 [0197.442] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xmySE9uE.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xmyse9ue.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xmySE9uE.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xmyse9ue.lnk.dvodltmf")) returned 0 [0197.444] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xmySE9uE.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xmyse9ue.lnk.dvodltmf")) returned 0x20 [0197.444] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xmySE9uE.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74728220, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76ab6ac0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76ab6ac0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1d5, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="xmySE9uE.lnk", cAlternateFileName="")) returned 0x2e8518 [0197.444] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74728220, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76ab6ac0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76ab6ac0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1d5, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="xmySE9uE.lnk", cAlternateFileName="")) returned 0 [0197.444] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0197.444] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xmySE9uE.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xmyse9ue.lnk")) returned 1 [0197.445] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xmySE9uE.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xmyse9ue.lnk")) returned 0xffffffff [0197.445] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74fa3080, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x769ac120, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x769ac120, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xddc, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="XqCuxh.lnk", cAlternateFileName="")) returned 1 [0197.445] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XqCuxh.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xqcuxh.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0197.445] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XqCuxh.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xqcuxh.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0197.446] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xddc [0197.446] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0197.446] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0197.535] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xddc, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xddc, lpOverlapped=0x0) returned 1 [0197.535] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xde0, lpOverlapped=0x0) returned 1 [0197.536] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0197.557] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.566] CloseHandle (hObject=0xf4) returned 1 [0197.566] CloseHandle (hObject=0xf0) returned 1 [0197.566] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XqCuxh.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xqcuxh.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XqCuxh.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xqcuxh.lnk.dvodltmf")) returned 0 [0197.567] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XqCuxh.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xqcuxh.lnk.dvodltmf")) returned 0x20 [0197.567] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XqCuxh.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74fa3080, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x769ac120, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x769ac120, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xddc, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="XqCuxh.lnk", cAlternateFileName="")) returned 0x2e8518 [0197.567] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74fa3080, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x769ac120, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x769ac120, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xddc, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="XqCuxh.lnk", cAlternateFileName="")) returned 0 [0197.567] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0197.568] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XqCuxh.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xqcuxh.lnk")) returned 1 [0197.569] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XqCuxh.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xqcuxh.lnk")) returned 0xffffffff [0197.569] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76026920, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76026920, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76026920, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="XVdPHUlLm7.lnk", cAlternateFileName="XVDPHU~1.LNK")) returned 1 [0197.569] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XVdPHUlLm7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xvdphullm7.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0197.569] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XVdPHUlLm7.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xvdphullm7.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0197.570] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c6 [0197.570] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0197.570] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0197.656] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2c6, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x2c6, lpOverlapped=0x0) returned 1 [0197.656] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x2d0, lpOverlapped=0x0) returned 1 [0197.657] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0197.677] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.687] CloseHandle (hObject=0xf0) returned 1 [0197.687] CloseHandle (hObject=0xf4) returned 1 [0197.687] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XVdPHUlLm7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xvdphullm7.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XVdPHUlLm7.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xvdphullm7.lnk.dvodltmf")) returned 0 [0197.688] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XVdPHUlLm7.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xvdphullm7.lnk.dvodltmf")) returned 0x20 [0197.688] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XVdPHUlLm7.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76026920, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76026920, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76026920, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="XVdPHUlLm7.lnk", cAlternateFileName="XVDPHU~1.LNK")) returned 0x2e8518 [0197.688] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76026920, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76026920, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76026920, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="XVdPHUlLm7.lnk", cAlternateFileName="XVDPHU~1.LNK")) returned 0 [0197.688] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0197.688] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XVdPHUlLm7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xvdphullm7.lnk")) returned 1 [0197.689] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XVdPHUlLm7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xvdphullm7.lnk")) returned 0xffffffff [0197.689] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x764e9520, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x768eda40, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x768eda40, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x952, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="XYiG.lnk", cAlternateFileName="")) returned 1 [0197.689] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XYiG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xyig.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0197.689] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XYiG.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xyig.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0197.690] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x952 [0197.690] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0197.690] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0197.811] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x952, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x952, lpOverlapped=0x0) returned 1 [0197.812] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x960, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x960, lpOverlapped=0x0) returned 1 [0197.813] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0197.833] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.842] CloseHandle (hObject=0xf4) returned 1 [0197.842] CloseHandle (hObject=0xf0) returned 1 [0197.842] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XYiG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xyig.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XYiG.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xyig.lnk.dvodltmf")) returned 0 [0197.843] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XYiG.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xyig.lnk.dvodltmf")) returned 0x20 [0197.843] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XYiG.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x764e9520, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x768eda40, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x768eda40, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x952, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="XYiG.lnk", cAlternateFileName="")) returned 0x2e8518 [0197.844] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x764e9520, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x768eda40, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x768eda40, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x952, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="XYiG.lnk", cAlternateFileName="")) returned 0 [0197.844] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0197.844] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XYiG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xyig.lnk")) returned 1 [0197.845] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XYiG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xyig.lnk")) returned 0xffffffff [0197.845] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75b89e80, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75b89e80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75b89e80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x9f1, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="y693.lnk", cAlternateFileName="")) returned 1 [0197.845] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y693.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\y693.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0197.845] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y693.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\y693.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0197.846] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9f1 [0197.846] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0197.846] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0197.932] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x9f1, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x9f1, lpOverlapped=0x0) returned 1 [0197.932] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xa00, lpOverlapped=0x0) returned 1 [0197.933] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0197.953] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.965] CloseHandle (hObject=0xf0) returned 1 [0197.965] CloseHandle (hObject=0xf4) returned 1 [0197.965] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y693.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\y693.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y693.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\y693.lnk.dvodltmf")) returned 0 [0197.966] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y693.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\y693.lnk.dvodltmf")) returned 0x20 [0197.966] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y693.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75b89e80, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75b89e80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75b89e80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x9f1, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="y693.lnk", cAlternateFileName="")) returned 0x2e8518 [0197.967] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75b89e80, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75b89e80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75b89e80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x9f1, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="y693.lnk", cAlternateFileName="")) returned 0 [0197.967] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0197.967] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y693.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\y693.lnk")) returned 1 [0197.968] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y693.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\y693.lnk")) returned 0xffffffff [0197.968] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76dd67a0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76dd67a0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76dd67a0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x19e5, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="yc9JRcGYnx.lnk", cAlternateFileName="YC9JRC~1.LNK")) returned 1 [0197.968] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yc9JRcGYnx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yc9jrcgynx.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0197.968] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yc9JRcGYnx.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yc9jrcgynx.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0197.969] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19e5 [0197.969] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0197.969] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0198.074] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x19e5, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x19e5, lpOverlapped=0x0) returned 1 [0198.075] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x19f0, lpOverlapped=0x0) returned 1 [0198.080] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0198.100] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.109] CloseHandle (hObject=0xf4) returned 1 [0198.109] CloseHandle (hObject=0xf0) returned 1 [0198.110] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yc9JRcGYnx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yc9jrcgynx.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yc9JRcGYnx.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yc9jrcgynx.lnk.dvodltmf")) returned 0 [0198.111] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yc9JRcGYnx.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yc9jrcgynx.lnk.dvodltmf")) returned 0x20 [0198.111] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yc9JRcGYnx.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76dd67a0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76dd67a0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76dd67a0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x19e5, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="yc9JRcGYnx.lnk", cAlternateFileName="YC9JRC~1.LNK")) returned 0x2e8518 [0198.111] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76dd67a0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76dd67a0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76dd67a0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x19e5, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="yc9JRcGYnx.lnk", cAlternateFileName="YC9JRC~1.LNK")) returned 0 [0198.111] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0198.111] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yc9JRcGYnx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yc9jrcgynx.lnk")) returned 1 [0198.112] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yc9JRcGYnx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yc9jrcgynx.lnk")) returned 0xffffffff [0198.112] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x747e6900, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x747e6900, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x747e6900, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x22d, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="YlfWlu.flv.lnk", cAlternateFileName="YLFWLU~1.LNK")) returned 1 [0198.112] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YlfWlu.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ylfwlu.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0198.112] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YlfWlu.flv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ylfwlu.flv.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0198.113] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x22d [0198.113] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0198.113] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0198.203] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x22d, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x22d, lpOverlapped=0x0) returned 1 [0198.204] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x230, lpOverlapped=0x0) returned 1 [0198.205] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0198.226] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.236] CloseHandle (hObject=0xf0) returned 1 [0198.236] CloseHandle (hObject=0xf4) returned 1 [0198.236] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YlfWlu.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ylfwlu.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YlfWlu.flv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ylfwlu.flv.lnk.dvodltmf")) returned 0 [0198.237] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YlfWlu.flv.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ylfwlu.flv.lnk.dvodltmf")) returned 0x20 [0198.237] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YlfWlu.flv.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x747e6900, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x747e6900, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x747e6900, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x22d, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="YlfWlu.flv.lnk", cAlternateFileName="YLFWLU~1.LNK")) returned 0x2e8518 [0198.237] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x747e6900, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x747e6900, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x747e6900, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x22d, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="YlfWlu.flv.lnk", cAlternateFileName="YLFWLU~1.LNK")) returned 0 [0198.237] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0198.237] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YlfWlu.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ylfwlu.flv.lnk")) returned 1 [0198.238] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YlfWlu.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ylfwlu.flv.lnk")) returned 0xffffffff [0198.238] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x769d2280, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x769d2280, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x769d2280, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa58, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Yrpi3Do S4R5x.lnk", cAlternateFileName="YRPI3D~1.LNK")) returned 1 [0198.238] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Yrpi3Do S4R5x.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yrpi3do s4r5x.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0198.238] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Yrpi3Do S4R5x.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yrpi3do s4r5x.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0198.248] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa58 [0198.248] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0198.248] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0198.333] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa58, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xa58, lpOverlapped=0x0) returned 1 [0198.334] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xa60, lpOverlapped=0x0) returned 1 [0198.335] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0198.355] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.369] CloseHandle (hObject=0xf4) returned 1 [0198.369] CloseHandle (hObject=0xf0) returned 1 [0198.370] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Yrpi3Do S4R5x.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yrpi3do s4r5x.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Yrpi3Do S4R5x.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yrpi3do s4r5x.lnk.dvodltmf")) returned 0 [0198.370] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Yrpi3Do S4R5x.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yrpi3do s4r5x.lnk.dvodltmf")) returned 0x20 [0198.371] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Yrpi3Do S4R5x.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x769d2280, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x769d2280, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x769d2280, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa58, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Yrpi3Do S4R5x.lnk", cAlternateFileName="YRPI3D~1.LNK")) returned 0x2e8518 [0198.371] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x769d2280, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x769d2280, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x769d2280, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa58, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Yrpi3Do S4R5x.lnk", cAlternateFileName="YRPI3D~1.LNK")) returned 0 [0198.371] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0198.371] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Yrpi3Do S4R5x.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yrpi3do s4r5x.lnk")) returned 1 [0198.372] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Yrpi3Do S4R5x.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yrpi3do s4r5x.lnk")) returned 0xffffffff [0198.372] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75276aa0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76be75c0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76be75c0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="z3blHvjoX1.lnk", cAlternateFileName="Z3BLHV~1.LNK")) returned 1 [0198.372] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z3blHvjoX1.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\z3blhvjox1.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0198.372] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z3blHvjoX1.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\z3blhvjox1.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0198.373] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x976 [0198.373] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0198.373] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0198.461] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x976, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x976, lpOverlapped=0x0) returned 1 [0198.461] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x980, lpOverlapped=0x0) returned 1 [0198.462] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0198.482] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.492] CloseHandle (hObject=0xf0) returned 1 [0198.492] CloseHandle (hObject=0xf4) returned 1 [0198.492] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z3blHvjoX1.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\z3blhvjox1.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z3blHvjoX1.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\z3blhvjox1.lnk.dvodltmf")) returned 0 [0198.493] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z3blHvjoX1.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\z3blhvjox1.lnk.dvodltmf")) returned 0x20 [0198.493] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z3blHvjoX1.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75276aa0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76be75c0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76be75c0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="z3blHvjoX1.lnk", cAlternateFileName="Z3BLHV~1.LNK")) returned 0x2e8518 [0198.493] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75276aa0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76be75c0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76be75c0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="z3blHvjoX1.lnk", cAlternateFileName="Z3BLHV~1.LNK")) returned 0 [0198.493] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0198.493] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z3blHvjoX1.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\z3blhvjox1.lnk")) returned 1 [0198.494] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z3blHvjoX1.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\z3blhvjox1.lnk")) returned 0xffffffff [0198.494] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ca5ca0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76ca5ca0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76ca5ca0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa0b, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="ZMlAsg.lnk", cAlternateFileName="")) returned 1 [0198.494] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZMlAsg.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zmlasg.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0198.494] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZMlAsg.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zmlasg.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0198.495] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa0b [0198.495] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0198.496] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0198.580] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa0b, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xa0b, lpOverlapped=0x0) returned 1 [0198.581] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xa10, lpOverlapped=0x0) returned 1 [0198.581] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0198.601] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.611] CloseHandle (hObject=0xf4) returned 1 [0198.611] CloseHandle (hObject=0xf0) returned 1 [0198.611] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZMlAsg.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zmlasg.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZMlAsg.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zmlasg.lnk.dvodltmf")) returned 0 [0198.612] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZMlAsg.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zmlasg.lnk.dvodltmf")) returned 0x20 [0198.612] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZMlAsg.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ca5ca0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76ca5ca0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76ca5ca0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa0b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="ZMlAsg.lnk", cAlternateFileName="")) returned 0x2e8518 [0198.612] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ca5ca0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76ca5ca0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76ca5ca0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa0b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="ZMlAsg.lnk", cAlternateFileName="")) returned 0 [0198.612] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0198.613] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZMlAsg.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zmlasg.lnk")) returned 1 [0198.614] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZMlAsg.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zmlasg.lnk")) returned 0xffffffff [0198.614] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x769f83e0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x769f83e0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x769f83e0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x18c5, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="zVFGNQwrF5RuQW7.lnk", cAlternateFileName="ZVFGNQ~1.LNK")) returned 1 [0198.614] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zVFGNQwrF5RuQW7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zvfgnqwrf5ruqw7.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0198.614] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zVFGNQwrF5RuQW7.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zvfgnqwrf5ruqw7.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0198.615] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18c5 [0198.615] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0198.615] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0198.702] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x18c5, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x18c5, lpOverlapped=0x0) returned 1 [0198.702] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x18d0, lpOverlapped=0x0) returned 1 [0198.703] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0198.724] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.733] CloseHandle (hObject=0xf0) returned 1 [0198.733] CloseHandle (hObject=0xf4) returned 1 [0198.733] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zVFGNQwrF5RuQW7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zvfgnqwrf5ruqw7.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zVFGNQwrF5RuQW7.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zvfgnqwrf5ruqw7.lnk.dvodltmf")) returned 0 [0198.734] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zVFGNQwrF5RuQW7.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zvfgnqwrf5ruqw7.lnk.dvodltmf")) returned 0x20 [0198.734] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zVFGNQwrF5RuQW7.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x769f83e0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x769f83e0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x769f83e0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x18c5, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="zVFGNQwrF5RuQW7.lnk", cAlternateFileName="ZVFGNQ~1.LNK")) returned 0x2e8518 [0198.734] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x769f83e0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x769f83e0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x769f83e0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x18c5, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="zVFGNQwrF5RuQW7.lnk", cAlternateFileName="ZVFGNQ~1.LNK")) returned 0 [0198.734] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0198.735] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zVFGNQwrF5RuQW7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zvfgnqwrf5ruqw7.lnk")) returned 1 [0198.735] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zVFGNQwrF5RuQW7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zvfgnqwrf5ruqw7.lnk")) returned 0xffffffff [0198.735] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x754b1f40, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76b4f040, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76b751a0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x99f, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="zyLW8gkkgWn.lnk", cAlternateFileName="ZYLW8G~1.LNK")) returned 1 [0198.736] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zyLW8gkkgWn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zylw8gkkgwn.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0198.736] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zyLW8gkkgWn.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zylw8gkkgwn.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0198.736] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x99f [0198.737] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0198.737] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0198.822] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x99f, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x99f, lpOverlapped=0x0) returned 1 [0198.823] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x9a0, lpOverlapped=0x0) returned 1 [0198.824] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0198.844] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.853] CloseHandle (hObject=0xf4) returned 1 [0198.854] CloseHandle (hObject=0xf0) returned 1 [0198.854] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zyLW8gkkgWn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zylw8gkkgwn.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zyLW8gkkgWn.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zylw8gkkgwn.lnk.dvodltmf")) returned 0 [0198.854] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zyLW8gkkgWn.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zylw8gkkgwn.lnk.dvodltmf")) returned 0x20 [0198.855] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zyLW8gkkgWn.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x754b1f40, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76b4f040, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76b751a0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x99f, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="zyLW8gkkgWn.lnk", cAlternateFileName="ZYLW8G~1.LNK")) returned 0x2e8518 [0198.855] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x754b1f40, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x76b4f040, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x76b751a0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x99f, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="zyLW8gkkgWn.lnk", cAlternateFileName="ZYLW8G~1.LNK")) returned 0 [0198.855] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0198.855] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zyLW8gkkgWn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zylw8gkkgwn.lnk")) returned 1 [0198.856] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zyLW8gkkgWn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zylw8gkkgwn.lnk")) returned 0xffffffff [0198.856] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x761ef9a0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x761ef9a0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x761ef9a0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xf40, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="z_li2.lnk", cAlternateFileName="")) returned 1 [0198.856] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z_li2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\z_li2.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0198.856] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z_li2.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\z_li2.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0198.857] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf40 [0198.857] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0198.857] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0198.942] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xf40, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xf40, lpOverlapped=0x0) returned 1 [0198.943] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf50, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xf50, lpOverlapped=0x0) returned 1 [0198.944] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0198.964] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.974] CloseHandle (hObject=0xf0) returned 1 [0198.974] CloseHandle (hObject=0xf4) returned 1 [0198.974] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z_li2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\z_li2.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z_li2.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\z_li2.lnk.dvodltmf")) returned 0 [0198.975] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z_li2.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\z_li2.lnk.dvodltmf")) returned 0x20 [0198.975] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z_li2.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x761ef9a0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x761ef9a0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x761ef9a0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xf40, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="z_li2.lnk", cAlternateFileName="")) returned 0x2e8518 [0198.975] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x761ef9a0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x761ef9a0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x761ef9a0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xf40, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="z_li2.lnk", cAlternateFileName="")) returned 0 [0198.975] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0198.975] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z_li2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\z_li2.lnk")) returned 1 [0198.976] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z_li2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\z_li2.lnk")) returned 0xffffffff [0198.976] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x750878c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x750878c0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x750878c0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa04, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="_dHmiU.lnk", cAlternateFileName="")) returned 1 [0198.976] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_dHmiU.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_dhmiu.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0198.976] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_dHmiU.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_dhmiu.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0198.977] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa04 [0198.977] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0198.977] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0199.062] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa04, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xa04, lpOverlapped=0x0) returned 1 [0199.063] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xa10, lpOverlapped=0x0) returned 1 [0199.064] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0199.084] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.093] CloseHandle (hObject=0xf4) returned 1 [0199.094] CloseHandle (hObject=0xf0) returned 1 [0199.094] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_dHmiU.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_dhmiu.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_dHmiU.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_dhmiu.lnk.dvodltmf")) returned 0 [0199.095] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_dHmiU.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_dhmiu.lnk.dvodltmf")) returned 0x20 [0199.095] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_dHmiU.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x750878c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x750878c0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x750878c0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa04, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="_dHmiU.lnk", cAlternateFileName="")) returned 0x2e8518 [0199.095] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x750878c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x750878c0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x750878c0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa04, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="_dHmiU.lnk", cAlternateFileName="")) returned 0 [0199.095] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0199.095] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_dHmiU.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_dhmiu.lnk")) returned 1 [0199.096] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_dHmiU.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_dhmiu.lnk")) returned 0xffffffff [0199.096] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75e83a00, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75e83a00, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75e83a00, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1f17, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="_mJ1tFH.lnk", cAlternateFileName="")) returned 1 [0199.096] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_mJ1tFH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_mj1tfh.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0199.096] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_mJ1tFH.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_mj1tfh.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0199.097] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f17 [0199.097] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0199.097] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0199.183] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1f17, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x1f17, lpOverlapped=0x0) returned 1 [0199.184] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x1f20, lpOverlapped=0x0) returned 1 [0199.185] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0199.205] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.214] CloseHandle (hObject=0xf0) returned 1 [0199.214] CloseHandle (hObject=0xf4) returned 1 [0199.215] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_mJ1tFH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_mj1tfh.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_mJ1tFH.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_mj1tfh.lnk.dvodltmf")) returned 0 [0199.215] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_mJ1tFH.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_mj1tfh.lnk.dvodltmf")) returned 0x20 [0199.216] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_mJ1tFH.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75e83a00, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75e83a00, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75e83a00, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1f17, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="_mJ1tFH.lnk", cAlternateFileName="")) returned 0x2e8518 [0199.216] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75e83a00, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75e83a00, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75e83a00, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1f17, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="_mJ1tFH.lnk", cAlternateFileName="")) returned 0 [0199.216] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0199.216] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_mJ1tFH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_mj1tfh.lnk")) returned 1 [0199.217] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_mJ1tFH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_mj1tfh.lnk")) returned 0xffffffff [0199.217] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75e83a00, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x75e83a00, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x75e83a00, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x1f17, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="_mJ1tFH.lnk", cAlternateFileName="")) returned 0 [0199.217] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0199.217] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6b6e6c2e, dwReserved1=0x6b6e6c2e, cFileName="SendTo", cAlternateFileName="")) returned 1 [0199.217] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0199.219] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="..", cAlternateFileName="")) returned 1 [0199.219] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x639ff80f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Compressed (zipped) Folder.ZFSendToTarget", cAlternateFileName="COMPRE~1.ZFS")) returned 1 [0199.219] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\compressed (zipped) folder.zfsendtotarget"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0199.219] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\compressed (zipped) folder.zfsendtotarget.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0199.220] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3 [0199.220] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0199.220] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0199.314] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x3, lpOverlapped=0x0) returned 1 [0199.314] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x10, lpOverlapped=0x0) returned 1 [0199.315] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0199.336] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.345] CloseHandle (hObject=0xf4) returned 1 [0199.345] CloseHandle (hObject=0xf0) returned 1 [0199.345] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\compressed (zipped) folder.zfsendtotarget"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\compressed (zipped) folder.zfsendtotarget.dvodltmf")) returned 0 [0199.347] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\compressed (zipped) folder.zfsendtotarget.dvodltmf")) returned 0x2020 [0199.347] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x639ff80f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Compressed (zipped) Folder.ZFSendToTarget", cAlternateFileName="COMPRE~1.ZFS")) returned 0x2e8518 [0199.347] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x639ff80f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Compressed (zipped) Folder.ZFSendToTarget", cAlternateFileName="COMPRE~1.ZFS")) returned 0 [0199.347] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0199.347] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\compressed (zipped) folder.zfsendtotarget")) returned 1 [0199.348] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\compressed (zipped) folder.zfsendtotarget")) returned 0xffffffff [0199.348] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3bb52ab9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop (create shortcut).DeskLink", cAlternateFileName="DESKTO~1.DES")) returned 1 [0199.348] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop (create shortcut).desklink"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0199.349] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop (create shortcut).desklink.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0199.349] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7 [0199.349] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0199.350] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0199.561] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x7, lpOverlapped=0x0) returned 1 [0199.562] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x10, lpOverlapped=0x0) returned 1 [0199.563] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0199.583] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.593] CloseHandle (hObject=0xf0) returned 1 [0199.593] CloseHandle (hObject=0xf4) returned 1 [0199.593] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop (create shortcut).desklink"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop (create shortcut).desklink.dvodltmf")) returned 0 [0199.594] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop (create shortcut).desklink.dvodltmf")) returned 0x2020 [0199.594] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3bb52ab9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Desktop (create shortcut).DeskLink", cAlternateFileName="DESKTO~1.DES")) returned 0x2e8518 [0199.594] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3bb52ab9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Desktop (create shortcut).DeskLink", cAlternateFileName="DESKTO~1.DES")) returned 0 [0199.594] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0199.594] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop (create shortcut).desklink")) returned 1 [0199.595] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop (create shortcut).desklink")) returned 0xffffffff [0199.595] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d828fa3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0199.595] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0199.596] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0199.596] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x22e [0199.596] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0199.597] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0199.684] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x22e, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x22e, lpOverlapped=0x0) returned 1 [0199.685] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x230, lpOverlapped=0x0) returned 1 [0199.686] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0199.706] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.715] CloseHandle (hObject=0xf4) returned 1 [0199.715] CloseHandle (hObject=0xf0) returned 1 [0199.715] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini.dvodltmf")) returned 0 [0199.716] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini.dvodltmf")) returned 0x2020 [0199.716] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d828fa3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x2e8518 [0199.716] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d828fa3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0199.716] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0199.716] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini")) returned 1 [0199.717] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini")) returned 0xffffffff [0199.717] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Documents.mydocs", cAlternateFileName="DOCUME~1.MYD")) returned 1 [0199.717] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\documents.mydocs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0199.717] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\documents.mydocs.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0199.718] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0199.718] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0199.718] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0199.848] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x10, lpOverlapped=0x0) returned 1 [0199.849] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0199.869] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.879] CloseHandle (hObject=0xf0) returned 1 [0199.879] CloseHandle (hObject=0xf4) returned 1 [0199.879] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\documents.mydocs"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\documents.mydocs.dvodltmf")) returned 0 [0199.880] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\documents.mydocs.dvodltmf")) returned 0x2020 [0199.880] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Documents.mydocs", cAlternateFileName="DOCUME~1.MYD")) returned 0x2e8518 [0199.880] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Documents.mydocs", cAlternateFileName="DOCUME~1.MYD")) returned 0 [0199.880] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0199.880] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\documents.mydocs")) returned 1 [0199.880] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\documents.mydocs")) returned 0xffffffff [0199.880] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d802e42, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Fax Recipient.lnk", cAlternateFileName="FAXREC~1.LNK")) returned 1 [0199.880] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0199.881] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0199.881] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4d6 [0199.881] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0199.881] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0199.967] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4d6, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x4d6, lpOverlapped=0x0) returned 1 [0199.968] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x4e0, lpOverlapped=0x0) returned 1 [0199.969] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0199.991] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.000] CloseHandle (hObject=0xf4) returned 1 [0200.000] CloseHandle (hObject=0xf0) returned 1 [0200.000] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk.dvodltmf")) returned 0 [0200.001] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk.dvodltmf")) returned 0x2020 [0200.001] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d802e42, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Fax Recipient.lnk", cAlternateFileName="FAXREC~1.LNK")) returned 0x2e8518 [0200.002] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d802e42, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Fax Recipient.lnk", cAlternateFileName="FAXREC~1.LNK")) returned 0 [0200.002] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0200.002] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk")) returned 1 [0200.003] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk")) returned 0xffffffff [0200.003] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3bb9ed75, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 1 [0200.003] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\mail recipient.mapimail"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0200.003] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\mail recipient.mapimail.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0200.004] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4 [0200.004] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0200.004] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0200.089] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x4, lpOverlapped=0x0) returned 1 [0200.090] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x10, lpOverlapped=0x0) returned 1 [0200.091] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0200.111] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.121] CloseHandle (hObject=0xf0) returned 1 [0200.121] CloseHandle (hObject=0xf4) returned 1 [0200.121] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\mail recipient.mapimail"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\mail recipient.mapimail.dvodltmf")) returned 0 [0200.122] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\mail recipient.mapimail.dvodltmf")) returned 0x2020 [0200.122] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3bb9ed75, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 0x2e8518 [0200.122] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3bb9ed75, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 0 [0200.123] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0200.123] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\mail recipient.mapimail")) returned 1 [0200.123] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\mail recipient.mapimail")) returned 0xffffffff [0200.124] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3bb9ed75, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 0 [0200.124] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0200.124] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e746e65, dwReserved1=0x4950414d, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0200.124] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0200.124] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="..", cAlternateFileName="")) returned 1 [0200.124] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0200.124] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0200.124] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0200.126] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae [0200.126] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0200.126] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0200.222] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xae, lpOverlapped=0x0) returned 1 [0200.223] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xb0, lpOverlapped=0x0) returned 1 [0200.224] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0200.244] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.254] CloseHandle (hObject=0xf4) returned 1 [0200.254] CloseHandle (hObject=0xf0) returned 1 [0200.254] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini.dvodltmf")) returned 0 [0200.255] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini.dvodltmf")) returned 0x20 [0200.255] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8518 [0200.255] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0200.255] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0200.255] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini")) returned 1 [0200.256] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini")) returned 0xffffffff [0200.257] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Programs", cAlternateFileName="")) returned 1 [0200.257] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0200.257] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0200.257] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0200.257] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0200.257] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0200.257] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility", cAlternateFileName="ACCESS~1")) returned 1 [0200.257] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8598 [0200.257] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0200.257] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0200.257] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0200.257] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0200.259] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c0 [0200.259] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0200.259] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0200.367] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2c0, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2c0, lpOverlapped=0x0) returned 1 [0200.368] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2d0, lpOverlapped=0x0) returned 1 [0200.370] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0200.390] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.400] CloseHandle (hObject=0xe0) returned 1 [0200.400] CloseHandle (hObject=0xe8) returned 1 [0200.401] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini.dvodltmf")) returned 0 [0200.403] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini.dvodltmf")) returned 0x20 [0200.403] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x2e85d8 [0200.403] FindNextFileA (in: hFindFile=0x2e85d8, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0200.403] FindClose (in: hFindFile=0x2e85d8 | out: hFindFile=0x2e85d8) returned 1 [0200.403] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini")) returned 1 [0200.404] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini")) returned 0xffffffff [0200.404] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1ab4d101, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x54e, dwReserved0=0x2dcc40, dwReserved1=0x18e44c, cFileName="Ease of Access.lnk", cAlternateFileName="EASEOF~1.LNK")) returned 1 [0200.405] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0200.407] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0200.409] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x54e [0200.409] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0200.409] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0200.495] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x54e, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x54e, lpOverlapped=0x0) returned 1 [0200.508] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x550, lpOverlapped=0x0) returned 1 [0200.509] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0200.537] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.547] CloseHandle (hObject=0xe8) returned 1 [0200.547] CloseHandle (hObject=0xe0) returned 1 [0200.549] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk.dvodltmf")) returned 0 [0200.550] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk.dvodltmf")) returned 0x20 [0200.550] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1ab4d101, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x54e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Ease of Access.lnk", cAlternateFileName="EASEOF~1.LNK")) returned 0x2e85d8 [0200.550] FindNextFileA (in: hFindFile=0x2e85d8, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1ab4d101, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x54e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Ease of Access.lnk", cAlternateFileName="EASEOF~1.LNK")) returned 0 [0200.550] FindClose (in: hFindFile=0x2e85d8 | out: hFindFile=0x2e85d8) returned 1 [0200.550] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk")) returned 1 [0200.552] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk")) returned 0xffffffff [0200.552] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1a98407e, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ea, dwReserved0=0x2dcc40, dwReserved1=0x18e44c, cFileName="Magnify.lnk", cAlternateFileName="")) returned 1 [0200.552] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0200.553] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0200.554] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ea [0200.554] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0200.554] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0200.644] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4ea, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x4ea, lpOverlapped=0x0) returned 1 [0200.645] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x4f0, lpOverlapped=0x0) returned 1 [0200.646] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0200.666] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.676] CloseHandle (hObject=0xe0) returned 1 [0200.676] CloseHandle (hObject=0xe8) returned 1 [0200.677] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk.dvodltmf")) returned 0 [0200.678] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk.dvodltmf")) returned 0x20 [0200.678] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1a98407e, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ea, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Magnify.lnk", cAlternateFileName="")) returned 0x2e85d8 [0200.678] FindNextFileA (in: hFindFile=0x2e85d8, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1a98407e, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ea, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Magnify.lnk", cAlternateFileName="")) returned 0 [0200.678] FindClose (in: hFindFile=0x2e85d8 | out: hFindFile=0x2e85d8) returned 1 [0200.678] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk")) returned 1 [0200.679] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk")) returned 0xffffffff [0200.679] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b733f17, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x2dcc40, dwReserved1=0x18e44c, cFileName="Narrator.lnk", cAlternateFileName="")) returned 1 [0200.679] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0200.680] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0200.681] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ee [0200.682] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0200.682] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0200.777] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4ee, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x4ee, lpOverlapped=0x0) returned 1 [0200.778] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x4f0, lpOverlapped=0x0) returned 1 [0200.779] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0200.799] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.809] CloseHandle (hObject=0xe8) returned 1 [0200.809] CloseHandle (hObject=0xe0) returned 1 [0200.809] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk.dvodltmf")) returned 0 [0200.810] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk.dvodltmf")) returned 0x20 [0200.810] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b733f17, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Narrator.lnk", cAlternateFileName="")) returned 0x2e85d8 [0200.810] FindNextFileA (in: hFindFile=0x2e85d8, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b733f17, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Narrator.lnk", cAlternateFileName="")) returned 0 [0200.810] FindClose (in: hFindFile=0x2e85d8 | out: hFindFile=0x2e85d8) returned 1 [0200.810] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk")) returned 1 [0200.811] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk")) returned 0xffffffff [0200.811] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1aa4275f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x2dcc40, dwReserved1=0x18e44c, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="ON-SCR~1.LNK")) returned 1 [0200.811] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0200.812] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0200.814] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4e2 [0200.814] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0200.814] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0200.900] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4e2, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x4e2, lpOverlapped=0x0) returned 1 [0200.917] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x4f0, lpOverlapped=0x0) returned 1 [0200.918] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0200.938] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.947] CloseHandle (hObject=0xe0) returned 1 [0200.947] CloseHandle (hObject=0xe8) returned 1 [0200.948] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk.dvodltmf")) returned 0 [0200.949] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk.dvodltmf")) returned 0x20 [0200.949] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1aa4275f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="ON-SCR~1.LNK")) returned 0x2e85d8 [0200.949] FindNextFileA (in: hFindFile=0x2e85d8, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1aa4275f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="ON-SCR~1.LNK")) returned 0 [0200.949] FindClose (in: hFindFile=0x2e85d8 | out: hFindFile=0x2e85d8) returned 1 [0200.949] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk")) returned 1 [0200.950] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk")) returned 0xffffffff [0200.950] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1aa4275f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x2dcc40, dwReserved1=0x18e44c, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="ON-SCR~1.LNK")) returned 0 [0200.950] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0200.950] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2a53d8cd, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0x6f627965, dwReserved1=0x2e647261, cFileName="Command Prompt.lnk", cAlternateFileName="COMMAN~1.LNK")) returned 1 [0200.950] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0200.951] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0200.952] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x500 [0200.952] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0200.952] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0201.042] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x500, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x500, lpOverlapped=0x0) returned 1 [0201.043] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x510, lpOverlapped=0x0) returned 1 [0201.044] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0201.065] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.074] CloseHandle (hObject=0xdc) returned 1 [0201.074] CloseHandle (hObject=0xe8) returned 1 [0201.075] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk.dvodltmf")) returned 0 [0201.076] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk.dvodltmf")) returned 0x20 [0201.076] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2a53d8cd, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Command Prompt.lnk", cAlternateFileName="COMMAN~1.LNK")) returned 0x2e8598 [0201.076] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2a53d8cd, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Command Prompt.lnk", cAlternateFileName="COMMAN~1.LNK")) returned 0 [0201.076] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0201.076] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk")) returned 1 [0201.078] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk")) returned 0xffffffff [0201.078] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0201.078] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0201.078] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0201.079] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2a6 [0201.079] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0201.080] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0201.171] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2a6, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x2a6, lpOverlapped=0x0) returned 1 [0201.172] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x2b0, lpOverlapped=0x0) returned 1 [0201.173] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0201.193] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.202] CloseHandle (hObject=0xe8) returned 1 [0201.202] CloseHandle (hObject=0xdc) returned 1 [0201.203] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini.dvodltmf")) returned 0 [0201.204] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini.dvodltmf")) returned 0x20 [0201.204] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2a6, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x2e8598 [0201.204] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2a6, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0201.204] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0201.204] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini")) returned 1 [0201.205] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini")) returned 0xffffffff [0201.205] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d73a72a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x2dcc40, dwReserved1=0x18e6b4, cFileName="Notepad.lnk", cAlternateFileName="")) returned 1 [0201.205] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0201.206] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0201.207] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x518 [0201.207] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0201.208] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0201.304] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x518, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x518, lpOverlapped=0x0) returned 1 [0201.305] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x520, lpOverlapped=0x0) returned 1 [0201.306] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0201.326] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.335] CloseHandle (hObject=0xdc) returned 1 [0201.335] CloseHandle (hObject=0xe8) returned 1 [0201.336] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk.dvodltmf")) returned 0 [0201.336] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk.dvodltmf")) returned 0x20 [0201.337] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d73a72a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Notepad.lnk", cAlternateFileName="")) returned 0x2e8598 [0201.337] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d73a72a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Notepad.lnk", cAlternateFileName="")) returned 0 [0201.337] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0201.337] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk")) returned 1 [0201.338] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk")) returned 0xffffffff [0201.338] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfec52d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x2dcc40, dwReserved1=0x18e6b4, cFileName="Run.lnk", cAlternateFileName="")) returned 1 [0201.338] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0201.338] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0201.339] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x106 [0201.340] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0201.340] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0201.431] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x106, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x106, lpOverlapped=0x0) returned 1 [0201.432] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x110, lpOverlapped=0x0) returned 1 [0201.433] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0201.453] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.463] CloseHandle (hObject=0xe8) returned 1 [0201.463] CloseHandle (hObject=0xdc) returned 1 [0201.463] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk.dvodltmf")) returned 0 [0201.464] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk.dvodltmf")) returned 0x20 [0201.464] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfec52d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Run.lnk", cAlternateFileName="")) returned 0x2e8598 [0201.464] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfec52d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Run.lnk", cAlternateFileName="")) returned 0 [0201.464] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0201.464] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk")) returned 1 [0201.465] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk")) returned 0xffffffff [0201.465] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18e6b4, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0201.465] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xce, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8598 [0201.465] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xce, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0201.465] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0d0d6f, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0xce, dwReserved1=0x0, cFileName="computer.lnk", cAlternateFileName="")) returned 1 [0201.465] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0201.466] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0201.467] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x106 [0201.467] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0201.468] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0201.572] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x106, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x106, lpOverlapped=0x0) returned 1 [0201.573] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x110, lpOverlapped=0x0) returned 1 [0201.574] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0201.594] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.603] CloseHandle (hObject=0xe8) returned 1 [0201.603] CloseHandle (hObject=0xe0) returned 1 [0201.603] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk.dvodltmf")) returned 0 [0201.604] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk.dvodltmf")) returned 0x20 [0201.604] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0d0d6f, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="computer.lnk", cAlternateFileName="")) returned 0x2e85d8 [0201.605] FindNextFileA (in: hFindFile=0x2e85d8, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0d0d6f, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="computer.lnk", cAlternateFileName="")) returned 0 [0201.605] FindClose (in: hFindFile=0x2e85d8 | out: hFindFile=0x2e85d8) returned 1 [0201.605] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk")) returned 1 [0201.606] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk")) returned 0xffffffff [0201.606] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e084aaf, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x2dcc40, dwReserved1=0x18e44c, cFileName="Control Panel.lnk", cAlternateFileName="CONTRO~1.LNK")) returned 1 [0201.606] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0201.607] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0201.607] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x106 [0201.608] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0201.608] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0201.745] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x106, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x106, lpOverlapped=0x0) returned 1 [0201.746] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x110, lpOverlapped=0x0) returned 1 [0201.747] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0201.767] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.776] CloseHandle (hObject=0xe0) returned 1 [0201.776] CloseHandle (hObject=0xe8) returned 1 [0201.815] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk.dvodltmf")) returned 0 [0201.816] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk.dvodltmf")) returned 0x20 [0201.816] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e084aaf, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Control Panel.lnk", cAlternateFileName="CONTRO~1.LNK")) returned 0x2e85d8 [0201.816] FindNextFileA (in: hFindFile=0x2e85d8, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e084aaf, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Control Panel.lnk", cAlternateFileName="CONTRO~1.LNK")) returned 0 [0201.816] FindClose (in: hFindFile=0x2e85d8 | out: hFindFile=0x2e85d8) returned 1 [0201.816] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk")) returned 1 [0201.817] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk")) returned 0xffffffff [0201.817] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x2dcc40, dwReserved1=0x18e44c, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0201.817] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0201.817] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0201.818] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2e2 [0201.818] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0201.819] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0201.912] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2e2, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x2e2, lpOverlapped=0x0) returned 1 [0201.913] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x2f0, lpOverlapped=0x0) returned 1 [0201.914] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0201.934] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.943] CloseHandle (hObject=0xe8) returned 1 [0201.943] CloseHandle (hObject=0xe0) returned 1 [0201.944] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini.dvodltmf")) returned 0 [0201.945] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini.dvodltmf")) returned 0x20 [0201.945] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x2e85d8 [0201.945] FindNextFileA (in: hFindFile=0x2e85d8, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0201.945] FindClose (in: hFindFile=0x2e85d8 | out: hFindFile=0x2e85d8) returned 1 [0201.946] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini")) returned 1 [0201.947] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini")) returned 0xffffffff [0201.947] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5df, dwReserved0=0x2dcc40, dwReserved1=0x18e44c, cFileName="Internet Explorer (No Add-ons).lnk", cAlternateFileName="INTERN~1.LNK")) returned 1 [0201.947] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0201.948] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0201.949] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5df [0201.949] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0201.949] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0202.051] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x5df, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x5df, lpOverlapped=0x0) returned 1 [0202.052] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x5e0, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x5e0, lpOverlapped=0x0) returned 1 [0202.053] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0202.073] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.084] CloseHandle (hObject=0xe0) returned 1 [0202.084] CloseHandle (hObject=0xe8) returned 1 [0202.084] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk.dvodltmf")) returned 0 [0202.085] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk.dvodltmf")) returned 0x20 [0202.085] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5df, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Internet Explorer (No Add-ons).lnk", cAlternateFileName="INTERN~1.LNK")) returned 0x2e85d8 [0202.085] FindNextFileA (in: hFindFile=0x2e85d8, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5df, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Internet Explorer (No Add-ons).lnk", cAlternateFileName="INTERN~1.LNK")) returned 0 [0202.085] FindClose (in: hFindFile=0x2e85d8 | out: hFindFile=0x2e85d8) returned 1 [0202.085] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk")) returned 1 [0202.086] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk")) returned 0xffffffff [0202.086] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d424a7b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x51a, dwReserved0=0x2dcc40, dwReserved1=0x18e44c, cFileName="Private Character Editor.lnk", cAlternateFileName="PRIVAT~1.LNK")) returned 1 [0202.086] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0202.087] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0202.088] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x51a [0202.088] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0202.088] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0202.175] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x51a, lpNumberOfBytesRead=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e440*=0x51a, lpOverlapped=0x0) returned 1 [0202.176] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x520, lpOverlapped=0x0) returned 1 [0202.177] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0202.197] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.206] CloseHandle (hObject=0xe8) returned 1 [0202.206] CloseHandle (hObject=0xe0) returned 1 [0202.206] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk.dvodltmf")) returned 0 [0202.207] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk.dvodltmf")) returned 0x20 [0202.207] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d424a7b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x51a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Private Character Editor.lnk", cAlternateFileName="PRIVAT~1.LNK")) returned 0x2e85d8 [0202.208] FindNextFileA (in: hFindFile=0x2e85d8, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d424a7b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x51a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Private Character Editor.lnk", cAlternateFileName="PRIVAT~1.LNK")) returned 0 [0202.208] FindClose (in: hFindFile=0x2e85d8 | out: hFindFile=0x2e85d8) returned 1 [0202.208] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk")) returned 1 [0202.209] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk")) returned 0xffffffff [0202.209] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d424a7b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x51a, dwReserved0=0x2dcc40, dwReserved1=0x18e44c, cFileName="Private Character Editor.lnk", cAlternateFileName="PRIVAT~1.LNK")) returned 0 [0202.209] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0202.210] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x74636172, dwReserved1=0x45207265, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0202.210] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0202.210] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0202.212] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4cc [0202.212] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0202.212] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0202.306] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4cc, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x4cc, lpOverlapped=0x0) returned 1 [0202.308] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x4d0, lpOverlapped=0x0) returned 1 [0202.309] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0202.329] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.338] CloseHandle (hObject=0xdc) returned 1 [0202.338] CloseHandle (hObject=0xe0) returned 1 [0202.339] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk.dvodltmf")) returned 0 [0202.340] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk.dvodltmf")) returned 0x20 [0202.340] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0x2e8598 [0202.340] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0202.340] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0202.340] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk")) returned 1 [0202.341] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk")) returned 0xffffffff [0202.341] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x74636172, dwReserved1=0x45207265, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0202.341] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0202.342] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65726f6c, dwReserved1=0x6e6c2e72, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1 [0202.342] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18e6b4, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0202.342] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18e6b4, cFileName="..", cAlternateFileName="")) returned 1 [0202.342] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x2dcc40, dwReserved1=0x18e6b4, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0202.342] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0202.342] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0202.344] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae [0202.344] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0202.344] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0202.431] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0xae, lpOverlapped=0x0) returned 1 [0202.432] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0xb0, lpOverlapped=0x0) returned 1 [0202.433] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0202.453] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.462] CloseHandle (hObject=0xe0) returned 1 [0202.462] CloseHandle (hObject=0xdc) returned 1 [0202.463] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini.dvodltmf")) returned 0 [0202.464] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini.dvodltmf")) returned 0x20 [0202.464] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8598 [0202.464] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0202.464] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0202.464] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini")) returned 1 [0202.465] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini")) returned 0xffffffff [0202.465] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x2dcc40, dwReserved1=0x18e6b4, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0202.465] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0202.466] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x65726f6c, dwReserved1=0x6e6c2e72, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0202.466] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0202.466] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0202.468] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1dc [0202.468] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0202.468] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0202.567] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1dc, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x1dc, lpOverlapped=0x0) returned 1 [0202.567] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x1e0, lpOverlapped=0x0) returned 1 [0202.568] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0202.594] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.604] CloseHandle (hObject=0xf4) returned 1 [0202.604] CloseHandle (hObject=0xdc) returned 1 [0202.604] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini.dvodltmf")) returned 0 [0202.605] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini.dvodltmf")) returned 0x20 [0202.605] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8558 [0202.606] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0202.606] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0202.606] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini")) returned 1 [0202.607] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini")) returned 0xffffffff [0202.607] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x58b, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="Internet Explorer (64-bit).lnk", cAlternateFileName="INTERN~2.LNK")) returned 1 [0202.607] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0202.608] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0202.609] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x58b [0202.609] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0202.609] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0202.699] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x58b, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x58b, lpOverlapped=0x0) returned 1 [0202.700] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x590, lpOverlapped=0x0) returned 1 [0202.701] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0202.721] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.731] CloseHandle (hObject=0xdc) returned 1 [0202.731] CloseHandle (hObject=0xf4) returned 1 [0202.731] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk.dvodltmf")) returned 0 [0202.732] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk.dvodltmf")) returned 0x20 [0202.732] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x58b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Internet Explorer (64-bit).lnk", cAlternateFileName="INTERN~2.LNK")) returned 0x2e8558 [0202.732] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x58b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Internet Explorer (64-bit).lnk", cAlternateFileName="INTERN~2.LNK")) returned 0 [0202.733] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0202.733] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk")) returned 1 [0202.734] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk")) returned 0xffffffff [0202.734] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 1 [0202.734] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0202.735] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0202.736] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5ad [0202.736] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0202.736] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0202.826] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x5ad, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x5ad, lpOverlapped=0x0) returned 1 [0202.827] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x5b0, lpOverlapped=0x0) returned 1 [0202.828] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0202.848] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.858] CloseHandle (hObject=0xf4) returned 1 [0202.858] CloseHandle (hObject=0xdc) returned 1 [0202.858] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk.dvodltmf")) returned 0 [0202.859] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk.dvodltmf")) returned 0x20 [0202.859] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 0x2e8558 [0202.859] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 0 [0202.859] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0202.859] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk")) returned 1 [0202.860] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk")) returned 0xffffffff [0202.860] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0202.860] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0202.860] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0202.860] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0xd2, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0202.860] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0202.860] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0202.861] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13e [0202.861] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0202.862] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0202.962] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x13e, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x13e, lpOverlapped=0x0) returned 1 [0202.963] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x140, lpOverlapped=0x0) returned 1 [0202.964] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0202.984] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.994] CloseHandle (hObject=0xf4) returned 1 [0202.994] CloseHandle (hObject=0xe0) returned 1 [0202.994] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini.dvodltmf")) returned 0 [0202.995] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini.dvodltmf")) returned 0x20 [0202.995] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x2e8598 [0202.995] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0202.995] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0202.995] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini")) returned 1 [0202.996] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini")) returned 0xffffffff [0202.996] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0387ee, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x2dcc40, dwReserved1=0x18e6b4, cFileName="Help.lnk", cAlternateFileName="")) returned 1 [0202.996] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0202.997] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0203.000] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x106 [0203.000] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0203.000] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0203.086] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x106, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x106, lpOverlapped=0x0) returned 1 [0203.087] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x110, lpOverlapped=0x0) returned 1 [0203.088] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0203.108] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.118] CloseHandle (hObject=0xe0) returned 1 [0203.118] CloseHandle (hObject=0xf4) returned 1 [0203.118] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk.dvodltmf")) returned 0 [0203.119] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk.dvodltmf")) returned 0x20 [0203.119] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0387ee, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Help.lnk", cAlternateFileName="")) returned 0x2e8598 [0203.119] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0387ee, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Help.lnk", cAlternateFileName="")) returned 0 [0203.119] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0203.119] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk")) returned 1 [0203.120] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk")) returned 0xffffffff [0203.120] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0387ee, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x2dcc40, dwReserved1=0x18e6b4, cFileName="Help.lnk", cAlternateFileName="")) returned 0 [0203.120] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0203.120] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="Startup", cAlternateFileName="")) returned 1 [0203.120] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18e6b4, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0203.120] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18e6b4, cFileName="..", cAlternateFileName="")) returned 1 [0203.120] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x2dcc40, dwReserved1=0x18e6b4, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0203.120] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0203.120] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0203.132] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae [0203.132] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0203.132] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0203.219] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0xae, lpOverlapped=0x0) returned 1 [0203.220] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0xb0, lpOverlapped=0x0) returned 1 [0203.221] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0203.242] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.251] CloseHandle (hObject=0xf4) returned 1 [0203.252] CloseHandle (hObject=0xe0) returned 1 [0203.252] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini.dvodltmf")) returned 0 [0203.253] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini.dvodltmf")) returned 0x20 [0203.253] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8598 [0203.253] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0203.253] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0203.253] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini")) returned 1 [0203.254] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini")) returned 0xffffffff [0203.254] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x2dcc40, dwReserved1=0x18e6b4, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0203.254] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0203.254] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="Startup", cAlternateFileName="")) returned 0 [0203.254] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0203.254] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="Programs", cAlternateFileName="")) returned 0 [0203.254] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0203.254] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef15879, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e746e65, dwReserved1=0x4950414d, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0203.255] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef15879, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x726f6c70, dwReserved1=0x6c2e7265, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0203.255] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef15879, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x726f6c70, dwReserved1=0x6c2e7265, cFileName="..", cAlternateFileName="")) returned 1 [0203.255] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef15879, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x726f6c70, dwReserved1=0x6c2e7265, cFileName="..", cAlternateFileName="")) returned 0 [0203.255] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0203.255] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xef632f84, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e746e65, dwReserved1=0x4950414d, cFileName="Themes", cAlternateFileName="")) returned 1 [0203.255] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xef632f84, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x726f6c70, dwReserved1=0x6c2e7265, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0203.256] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xef632f84, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x726f6c70, dwReserved1=0x6c2e7265, cFileName="..", cAlternateFileName="")) returned 1 [0203.256] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd9d7d3c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x9cfab, dwReserved0=0x726f6c70, dwReserved1=0x6c2e7265, cFileName="TranscodedWallpaper.jpg", cAlternateFileName="TRANSC~1.JPG")) returned 1 [0203.256] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0203.256] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0203.257] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9cfab [0203.257] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0203.257] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0203.384] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x9cfab, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x9cfab, lpOverlapped=0x0) returned 1 [0203.395] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x9cfb0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x9cfb0, lpOverlapped=0x0) returned 1 [0203.407] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0203.427] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.437] CloseHandle (hObject=0xf0) returned 1 [0203.437] CloseHandle (hObject=0xdc) returned 1 [0203.437] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg.dvodltmf")) returned 0 [0203.438] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg.dvodltmf")) returned 0x2020 [0203.438] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd9d7d3c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x9cfab, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="TranscodedWallpaper.jpg", cAlternateFileName="TRANSC~1.JPG")) returned 0x2e8518 [0203.438] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd9d7d3c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x9cfab, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="TranscodedWallpaper.jpg", cAlternateFileName="TRANSC~1.JPG")) returned 0 [0203.438] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0203.438] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg")) returned 1 [0203.444] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg")) returned 0xffffffff [0203.444] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd9d7d3c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x9cfab, dwReserved0=0x726f6c70, dwReserved1=0x6c2e7265, cFileName="TranscodedWallpaper.jpg", cAlternateFileName="TRANSC~1.JPG")) returned 0 [0203.444] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0203.444] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xef632f84, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e746e65, dwReserved1=0x4950414d, cFileName="Themes", cAlternateFileName="")) returned 0 [0203.444] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0203.444] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f71aa70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75637472, dwReserved1=0x33377374, cFileName="Word", cAlternateFileName="")) returned 1 [0203.444] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f71aa70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706c6c61, dwReserved1=0x72657061, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0203.458] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f71aa70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706c6c61, dwReserved1=0x72657061, cFileName="..", cAlternateFileName="")) returned 1 [0203.458] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27c7d150, ftCreationTime.dwHighDateTime=0x1d3aaba, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706c6c61, dwReserved1=0x72657061, cFileName="STARTUP", cAlternateFileName="")) returned 1 [0203.458] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27c7d150, ftCreationTime.dwHighDateTime=0x1d3aaba, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0203.458] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27c7d150, ftCreationTime.dwHighDateTime=0x1d3aaba, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="..", cAlternateFileName="")) returned 1 [0203.458] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27c7d150, ftCreationTime.dwHighDateTime=0x1d3aaba, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18eb84, cFileName="..", cAlternateFileName="")) returned 0 [0203.458] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0203.458] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27c7d150, ftCreationTime.dwHighDateTime=0x1d3aaba, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706c6c61, dwReserved1=0x72657061, cFileName="STARTUP", cAlternateFileName="")) returned 0 [0203.459] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0203.459] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f71aa70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75637472, dwReserved1=0x33377374, cFileName="Word", cAlternateFileName="")) returned 0 [0203.459] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0203.459] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61636966, dwReserved1=0x20736574, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0203.459] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75637472, dwReserved1=0x33377374, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0203.459] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75637472, dwReserved1=0x33377374, cFileName="..", cAlternateFileName="")) returned 1 [0203.459] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb458e750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75637472, dwReserved1=0x33377374, cFileName="Extensions", cAlternateFileName="EXTENS~1")) returned 1 [0203.459] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb458e750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706c6c61, dwReserved1=0x72657061, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0203.460] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb458e750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706c6c61, dwReserved1=0x72657061, cFileName="..", cAlternateFileName="")) returned 1 [0203.460] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb458e750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706c6c61, dwReserved1=0x72657061, cFileName="..", cAlternateFileName="")) returned 0 [0203.460] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0203.460] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75637472, dwReserved1=0x33377374, cFileName="Firefox", cAlternateFileName="")) returned 1 [0203.460] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706c6c61, dwReserved1=0x72657061, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0203.461] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706c6c61, dwReserved1=0x72657061, cFileName="..", cAlternateFileName="")) returned 1 [0203.461] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706c6c61, dwReserved1=0x72657061, cFileName="Crash Reports", cAlternateFileName="CRASHR~1")) returned 1 [0203.461] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0203.462] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0203.462] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x0, cFileName="InstallTime20131025151332", cAlternateFileName="INSTAL~1")) returned 1 [0203.462] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x0, cFileName="InstallTime20131025151332", cAlternateFileName="INSTAL~1")) returned 0 [0203.462] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0203.462] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x33313032, dwReserved1=0x35323031, cFileName="Profiles", cAlternateFileName="")) returned 1 [0203.462] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0203.463] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0203.463] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 1 [0203.463] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0203.465] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0203.466] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb76a6d10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb76a6d10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb76a6d10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="addons.json", cAlternateFileName="ADDONS~1.JSO")) returned 1 [0203.466] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\addons.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\addons.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0203.467] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\addons.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\addons.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0203.468] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0203.468] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0203.468] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0203.556] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x18, lpOverlapped=0x0) returned 1 [0203.557] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x20, lpOverlapped=0x0) returned 1 [0203.558] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0203.578] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.587] CloseHandle (hObject=0xf0) returned 1 [0203.587] CloseHandle (hObject=0xe0) returned 1 [0203.587] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\addons.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\addons.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\addons.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\addons.json.dvodltmf")) returned 0 [0203.588] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\addons.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\addons.json.dvodltmf")) returned 0x2020 [0203.588] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\addons.json", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb76a6d10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb76a6d10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb76a6d10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="addons.json", cAlternateFileName="ADDONS~1.JSO")) returned 0x2e8558 [0203.588] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb76a6d10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb76a6d10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb76a6d10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="addons.json", cAlternateFileName="ADDONS~1.JSO")) returned 0 [0203.588] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0203.589] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\addons.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\addons.json")) returned 1 [0203.589] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\addons.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\addons.json")) returned 0xffffffff [0203.589] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb5233c30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x8503de70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8503de70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="bookmarkbackups", cAlternateFileName="BOOKMA~1")) returned 1 [0203.590] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb5233c30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x8503de70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8503de70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0203.594] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb5233c30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x8503de70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8503de70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0203.594] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc37c9330, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc37c9330, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc37df2c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xbdb, dwReserved0=0xc6, dwReserved1=0x0, cFileName="bookmarks-2017-06-05_5.json", cAlternateFileName="BOOKMA~1.JSO")) returned 1 [0203.594] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0203.594] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0203.595] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbdb [0203.595] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0203.595] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0203.682] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xbdb, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0xbdb, lpOverlapped=0x0) returned 1 [0203.684] WriteFile (in: hFile=0xf4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0xbe0, lpOverlapped=0x0) returned 1 [0203.685] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0203.704] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.714] CloseHandle (hObject=0xf0) returned 1 [0203.714] CloseHandle (hObject=0xf4) returned 1 [0203.714] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json.dvodltmf")) returned 0 [0203.715] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json.dvodltmf")) returned 0x2020 [0203.715] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc37c9330, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc37c9330, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc37df2c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xbdb, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="bookmarks-2017-06-05_5.json", cAlternateFileName="BOOKMA~1.JSO")) returned 0x2e8598 [0203.715] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc37c9330, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc37c9330, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc37df2c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xbdb, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="bookmarks-2017-06-05_5.json", cAlternateFileName="BOOKMA~1.JSO")) returned 0 [0203.715] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0203.715] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json")) returned 1 [0203.716] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json")) returned 0xffffffff [0203.716] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85017d10, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x85017d10, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85017d10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbdb, dwReserved0=0x2dcc40, dwReserved1=0x18e6b4, cFileName="bookmarks-2017-06-16_5.json", cAlternateFileName="BOOKMA~2.JSO")) returned 1 [0203.716] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0203.717] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0203.718] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbdb [0203.718] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0203.718] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0203.887] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xbdb, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0xbdb, lpOverlapped=0x0) returned 1 [0203.888] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0xbe0, lpOverlapped=0x0) returned 1 [0203.889] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0203.909] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.918] CloseHandle (hObject=0xf4) returned 1 [0203.919] CloseHandle (hObject=0xf0) returned 1 [0203.919] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json.dvodltmf")) returned 0 [0203.920] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json.dvodltmf")) returned 0x2020 [0203.920] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85017d10, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x85017d10, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85017d10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbdb, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="bookmarks-2017-06-16_5.json", cAlternateFileName="BOOKMA~2.JSO")) returned 0x2e8598 [0203.920] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85017d10, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x85017d10, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85017d10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbdb, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="bookmarks-2017-06-16_5.json", cAlternateFileName="BOOKMA~2.JSO")) returned 0 [0203.920] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0203.920] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json")) returned 1 [0203.921] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json")) returned 0xffffffff [0203.921] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85017d10, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x85017d10, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85017d10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbdb, dwReserved0=0x2dcc40, dwReserved1=0x18e6b4, cFileName="bookmarks-2017-06-16_5.json", cAlternateFileName="BOOKMA~2.JSO")) returned 0 [0203.921] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0203.921] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb47c9bf0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb47c9bf0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x853f60d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x2d373130, dwReserved1=0x312d3630, cFileName="cert8.db", cAlternateFileName="")) returned 1 [0203.921] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cert8.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cert8.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0203.922] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cert8.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cert8.db.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0203.923] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10000 [0203.923] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0203.923] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0204.017] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x10000, lpOverlapped=0x0) returned 1 [0204.020] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x10010, lpOverlapped=0x0) returned 1 [0204.025] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0204.045] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.054] CloseHandle (hObject=0xe0) returned 1 [0204.055] CloseHandle (hObject=0xf0) returned 1 [0204.055] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cert8.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cert8.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cert8.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cert8.db.dvodltmf")) returned 0 [0204.056] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cert8.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cert8.db.dvodltmf")) returned 0x2020 [0204.056] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cert8.db", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb47c9bf0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb47c9bf0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x853f60d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="cert8.db", cAlternateFileName="")) returned 0x2e8558 [0204.057] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb47c9bf0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb47c9bf0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x853f60d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="cert8.db", cAlternateFileName="")) returned 0 [0204.057] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0204.057] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cert8.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cert8.db")) returned 1 [0204.059] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cert8.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cert8.db")) returned 0xffffffff [0204.059] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x80696ec0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="compatibility.ini", cAlternateFileName="COMPAT~1.INI")) returned 1 [0204.059] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\compatibility.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\compatibility.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0204.059] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\compatibility.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\compatibility.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0204.060] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xce [0204.060] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0204.060] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0204.163] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0xce, lpOverlapped=0x0) returned 1 [0204.165] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0xd0, lpOverlapped=0x0) returned 1 [0204.166] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0204.189] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.199] CloseHandle (hObject=0xf0) returned 1 [0204.199] CloseHandle (hObject=0xe0) returned 1 [0204.199] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\compatibility.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\compatibility.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\compatibility.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\compatibility.ini.dvodltmf")) returned 0 [0204.200] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\compatibility.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\compatibility.ini.dvodltmf")) returned 0x2020 [0204.200] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\compatibility.ini", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x80696ec0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="compatibility.ini", cAlternateFileName="COMPAT~1.INI")) returned 0x2e8558 [0204.201] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x80696ec0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="compatibility.ini", cAlternateFileName="COMPAT~1.INI")) returned 0 [0204.201] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0204.201] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\compatibility.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\compatibility.ini")) returned 1 [0204.202] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\compatibility.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\compatibility.ini")) returned 0xffffffff [0204.202] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb5e8ce50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb5e8ce50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb639bd10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x38000, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="content-prefs.sqlite", cAlternateFileName="CONTEN~1.SQL")) returned 1 [0204.202] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\content-prefs.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\content-prefs.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0204.202] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\content-prefs.sqlite.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\content-prefs.sqlite.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0204.203] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x38000 [0204.203] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0204.203] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0204.288] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x38000, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x38000, lpOverlapped=0x0) returned 1 [0204.293] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x38010, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x38010, lpOverlapped=0x0) returned 1 [0204.297] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0204.319] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.339] CloseHandle (hObject=0xe0) returned 1 [0204.340] CloseHandle (hObject=0xf0) returned 1 [0204.340] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\content-prefs.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\content-prefs.sqlite"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\content-prefs.sqlite.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\content-prefs.sqlite.dvodltmf")) returned 0 [0204.341] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\content-prefs.sqlite.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\content-prefs.sqlite.dvodltmf")) returned 0x2020 [0204.341] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\content-prefs.sqlite", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb5e8ce50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb5e8ce50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb639bd10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x38000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="content-prefs.sqlite", cAlternateFileName="CONTEN~1.SQL")) returned 0x2e8558 [0204.341] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb5e8ce50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb5e8ce50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb639bd10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x38000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="content-prefs.sqlite", cAlternateFileName="CONTEN~1.SQL")) returned 0 [0204.341] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0204.341] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\content-prefs.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\content-prefs.sqlite")) returned 1 [0204.343] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\content-prefs.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\content-prefs.sqlite")) returned 0xffffffff [0204.343] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb5ad4bf0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb5ad4bf0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x83256a10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="cookies.sqlite", cAlternateFileName="COOKIE~1.SQL")) returned 1 [0204.343] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cookies.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0204.344] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cookies.sqlite.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0204.344] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x80000 [0204.344] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0204.345] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0204.541] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x80000, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x80000, lpOverlapped=0x0) returned 1 [0204.552] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x80010, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x80010, lpOverlapped=0x0) returned 1 [0204.562] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0204.581] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.591] CloseHandle (hObject=0xf0) returned 1 [0204.591] CloseHandle (hObject=0xe0) returned 1 [0204.591] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cookies.sqlite"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cookies.sqlite.dvodltmf")) returned 0 [0204.592] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cookies.sqlite.dvodltmf")) returned 0x2020 [0204.592] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb5ad4bf0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb5ad4bf0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x83256a10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="cookies.sqlite", cAlternateFileName="COOKIE~1.SQL")) returned 0x2e8558 [0204.593] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb5ad4bf0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb5ad4bf0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x83256a10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="cookies.sqlite", cAlternateFileName="COOKIE~1.SQL")) returned 0 [0204.593] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0204.593] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cookies.sqlite")) returned 1 [0204.597] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cookies.sqlite")) returned 0xffffffff [0204.597] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc374ed0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbc374ed0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbc555e20, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="downloads.sqlite", cAlternateFileName="DOWNLO~1.SQL")) returned 1 [0204.597] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\downloads.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\downloads.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0204.598] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\downloads.sqlite.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\downloads.sqlite.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0204.598] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18000 [0204.598] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0204.599] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0204.691] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x18000, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x18000, lpOverlapped=0x0) returned 1 [0204.694] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x18010, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x18010, lpOverlapped=0x0) returned 1 [0204.697] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0204.717] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.726] CloseHandle (hObject=0xe0) returned 1 [0204.726] CloseHandle (hObject=0xf0) returned 1 [0204.726] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\downloads.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\downloads.sqlite"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\downloads.sqlite.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\downloads.sqlite.dvodltmf")) returned 0 [0204.727] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\downloads.sqlite.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\downloads.sqlite.dvodltmf")) returned 0x2020 [0204.727] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\downloads.sqlite", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc374ed0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbc374ed0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbc555e20, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="downloads.sqlite", cAlternateFileName="DOWNLO~1.SQL")) returned 0x2e8558 [0204.728] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc374ed0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbc374ed0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbc555e20, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="downloads.sqlite", cAlternateFileName="DOWNLO~1.SQL")) returned 0 [0204.728] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0204.728] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\downloads.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\downloads.sqlite")) returned 1 [0204.730] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\downloads.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\downloads.sqlite")) returned 0xffffffff [0204.730] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4b81e50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb4b81e50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb4b81e50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x8d, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="extensions.ini", cAlternateFileName="EXTENS~1.INI")) returned 1 [0204.730] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0204.732] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0204.732] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8d [0204.733] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0204.733] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0204.819] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x8d, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x8d, lpOverlapped=0x0) returned 1 [0204.820] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x90, lpOverlapped=0x0) returned 1 [0204.821] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0204.841] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.850] CloseHandle (hObject=0xf0) returned 1 [0204.850] CloseHandle (hObject=0xe0) returned 1 [0204.850] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.ini.dvodltmf")) returned 0 [0204.851] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.ini.dvodltmf")) returned 0x2020 [0204.851] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.ini", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4b81e50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb4b81e50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb4b81e50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x8d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="extensions.ini", cAlternateFileName="EXTENS~1.INI")) returned 0x2e8558 [0204.852] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4b81e50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb4b81e50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb4b81e50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x8d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="extensions.ini", cAlternateFileName="EXTENS~1.INI")) returned 0 [0204.852] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0204.852] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.ini")) returned 1 [0204.853] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.ini")) returned 0xffffffff [0204.853] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb45b48b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb45b48b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb4b0fa30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x70000, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="extensions.sqlite", cAlternateFileName="EXTENS~1.SQL")) returned 1 [0204.853] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0204.853] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.sqlite.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.sqlite.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0204.854] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x70000 [0204.854] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0204.854] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0204.938] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x70000, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x70000, lpOverlapped=0x0) returned 1 [0204.946] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x70010, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x70010, lpOverlapped=0x0) returned 1 [0204.955] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0204.975] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.985] CloseHandle (hObject=0xe0) returned 1 [0204.985] CloseHandle (hObject=0xf0) returned 1 [0204.985] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.sqlite"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.sqlite.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.sqlite.dvodltmf")) returned 0 [0204.986] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.sqlite.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.sqlite.dvodltmf")) returned 0x2020 [0204.986] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.sqlite", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb45b48b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb45b48b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb4b0fa30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x70000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="extensions.sqlite", cAlternateFileName="EXTENS~1.SQL")) returned 0x2e8558 [0204.986] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb45b48b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb45b48b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb4b0fa30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x70000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="extensions.sqlite", cAlternateFileName="EXTENS~1.SQL")) returned 0 [0204.986] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0204.986] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.sqlite")) returned 1 [0204.990] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.sqlite")) returned 0xffffffff [0204.990] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6ff4f30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="indexedDB", cAlternateFileName="INDEXE~1")) returned 1 [0204.990] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6ff4f30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0204.991] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6ff4f30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.991] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd2, dwReserved1=0x0, cFileName="moz-safe-about+home", cAlternateFileName="MOZ-SA~1")) returned 1 [0204.991] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69006c, dwReserved1=0x650074, cFileName=".", cAlternateFileName="")) returned 0x2e8598 [0204.992] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69006c, dwReserved1=0x650074, cFileName="..", cAlternateFileName="")) returned 1 [0204.992] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69006c, dwReserved1=0x650074, cFileName=".metadata", cAlternateFileName="METADA~1")) returned 1 [0204.992] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\.metadata" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\.metadata"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0204.993] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\.metadata.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\.metadata.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0204.993] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0204.993] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0204.994] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0205.082] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e440, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e440*=0x10, lpOverlapped=0x0) returned 1 [0205.083] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0205.103] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.113] CloseHandle (hObject=0xf4) returned 1 [0205.113] CloseHandle (hObject=0xe8) returned 1 [0205.113] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\.metadata" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\.metadata"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\.metadata.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\.metadata.dvodltmf")) returned 0 [0205.114] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\.metadata.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\.metadata.dvodltmf")) returned 0x2020 [0205.114] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\.metadata", lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName=".metadata", cAlternateFileName="METADA~1")) returned 0x2e85d8 [0205.114] FindNextFileA (in: hFindFile=0x2e85d8, lpFindFileData=0x18e33c | out: lpFindFileData=0x18e33c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName=".metadata", cAlternateFileName="METADA~1")) returned 0 [0205.114] FindClose (in: hFindFile=0x2e85d8 | out: hFindFile=0x2e85d8) returned 1 [0205.114] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\.metadata" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\.metadata")) returned 1 [0205.115] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\.metadata" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\.metadata")) returned 0xffffffff [0205.115] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8110d50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8110d50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18e44c, cFileName="idb", cAlternateFileName="")) returned 1 [0205.115] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8110d50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8110d50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e85d8 [0205.116] FindNextFileA (in: hFindFile=0x2e85d8, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8110d50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8110d50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.116] FindNextFileA (in: hFindFile=0x2e85d8, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb70ff8d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb70ff8d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb70ff8d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfe, dwReserved1=0x0, cFileName="818200132aebmoouht", cAlternateFileName="818200~1")) returned 1 [0205.116] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*.*", lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb70ff8d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb70ff8d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb70ff8d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740075, dwReserved1=0x68002b, cFileName=".", cAlternateFileName="")) returned 0x2e8618 [0205.117] FindNextFileA (in: hFindFile=0x2e8618, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb70ff8d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb70ff8d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb70ff8d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740075, dwReserved1=0x68002b, cFileName="..", cAlternateFileName="")) returned 1 [0205.117] FindNextFileA (in: hFindFile=0x2e8618, lpFindFileData=0x18e1e8 | out: lpFindFileData=0x18e1e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb70ff8d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb70ff8d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb70ff8d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740075, dwReserved1=0x68002b, cFileName="..", cAlternateFileName="")) returned 0 [0205.117] FindClose (in: hFindFile=0x2e8618 | out: hFindFile=0x2e8618) returned 1 [0205.117] FindNextFileA (in: hFindFile=0x2e85d8, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb81a92d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa0000, dwReserved0=0xfe, dwReserved1=0x0, cFileName="818200132aebmoouht.sqlite", cAlternateFileName="818200~1.SQL")) returned 1 [0205.117] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0205.118] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0205.119] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa0000 [0205.119] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0205.119] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0205.218] ReadFile (in: hFile=0xf4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa0000, lpNumberOfBytesRead=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e1d8*=0xa0000, lpOverlapped=0x0) returned 1 [0205.229] WriteFile (in: hFile=0x100, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa0010, lpNumberOfBytesWritten=0x18e1d8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e1d8*=0xa0010, lpOverlapped=0x0) returned 1 [0205.241] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0205.262] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.271] CloseHandle (hObject=0xf4) returned 1 [0205.272] CloseHandle (hObject=0x100) returned 1 [0205.272] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite.dvodltmf")) returned 0 [0205.273] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite.dvodltmf")) returned 0x2020 [0205.273] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb81a92d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa0000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="818200132aebmoouht.sqlite", cAlternateFileName="818200~1.SQL")) returned 0x2e8618 [0205.273] FindNextFileA (in: hFindFile=0x2e8618, lpFindFileData=0x18e0d4 | out: lpFindFileData=0x18e0d4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb81a92d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa0000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="818200132aebmoouht.sqlite", cAlternateFileName="818200~1.SQL")) returned 0 [0205.273] FindClose (in: hFindFile=0x2e8618 | out: hFindFile=0x2e8618) returned 1 [0205.273] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite")) returned 1 [0205.280] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite")) returned 0xffffffff [0205.280] FindNextFileA (in: hFindFile=0x2e85d8, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb81a92d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa0000, dwReserved0=0xfe, dwReserved1=0x0, cFileName="818200132aebmoouht.sqlite", cAlternateFileName="818200~1.SQL")) returned 0 [0205.280] FindClose (in: hFindFile=0x2e85d8 | out: hFindFile=0x2e85d8) returned 1 [0205.280] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8110d50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8110d50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18e44c, cFileName="idb", cAlternateFileName="")) returned 0 [0205.280] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0205.280] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd2, dwReserved1=0x0, cFileName="moz-safe-about+home", cAlternateFileName="MOZ-SA~1")) returned 0 [0205.280] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0205.280] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4815eb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb4815eb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x853f60d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2b74756f, dwReserved1=0x656d6f68, cFileName="key3.db", cAlternateFileName="")) returned 1 [0205.280] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key3.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\key3.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0205.280] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key3.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\key3.db.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0205.281] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4000 [0205.281] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0205.281] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0205.386] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x4000, lpOverlapped=0x0) returned 1 [0205.388] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x4010, lpOverlapped=0x0) returned 1 [0205.389] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0205.409] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.419] CloseHandle (hObject=0xf0) returned 1 [0205.419] CloseHandle (hObject=0xe0) returned 1 [0205.419] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key3.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\key3.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key3.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\key3.db.dvodltmf")) returned 0 [0205.420] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key3.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\key3.db.dvodltmf")) returned 0x2020 [0205.420] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key3.db", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4815eb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb4815eb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x853f60d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="key3.db", cAlternateFileName="")) returned 0x2e8558 [0205.420] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4815eb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb4815eb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x853f60d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="key3.db", cAlternateFileName="")) returned 0 [0205.420] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0205.420] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key3.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\key3.db")) returned 1 [0205.421] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key3.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\key3.db")) returned 0xffffffff [0205.421] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x850d63f0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x850d63f0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x850d63f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x501, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="localstore.rdf", cAlternateFileName="LOCALS~1.RDF")) returned 1 [0205.421] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\localstore.rdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\localstore.rdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0205.422] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\localstore.rdf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\localstore.rdf.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0205.423] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x501 [0205.423] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0205.423] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0205.509] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x501, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x501, lpOverlapped=0x0) returned 1 [0205.511] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x510, lpOverlapped=0x0) returned 1 [0205.512] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0205.532] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.541] CloseHandle (hObject=0xe0) returned 1 [0205.541] CloseHandle (hObject=0xf0) returned 1 [0205.541] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\localstore.rdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\localstore.rdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\localstore.rdf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\localstore.rdf.dvodltmf")) returned 0 [0205.542] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\localstore.rdf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\localstore.rdf.dvodltmf")) returned 0x2020 [0205.542] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\localstore.rdf", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x850d63f0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x850d63f0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x850d63f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x501, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="localstore.rdf", cAlternateFileName="LOCALS~1.RDF")) returned 0x2e8558 [0205.543] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x850d63f0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x850d63f0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x850d63f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x501, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="localstore.rdf", cAlternateFileName="LOCALS~1.RDF")) returned 0 [0205.543] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0205.543] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\localstore.rdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\localstore.rdf")) returned 1 [0205.544] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\localstore.rdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\localstore.rdf")) returned 0xffffffff [0205.544] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x85572e90, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x39, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="marionette.log", cAlternateFileName="MARION~1.LOG")) returned 1 [0205.544] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\marionette.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\marionette.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0205.544] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\marionette.log.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\marionette.log.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0205.545] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x39 [0205.545] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0205.545] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0205.631] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x39, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x39, lpOverlapped=0x0) returned 1 [0205.632] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x40, lpOverlapped=0x0) returned 1 [0205.633] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0205.653] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.663] CloseHandle (hObject=0xf0) returned 1 [0205.663] CloseHandle (hObject=0xe0) returned 1 [0205.663] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\marionette.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\marionette.log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\marionette.log.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\marionette.log.dvodltmf")) returned 0 [0205.664] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\marionette.log.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\marionette.log.dvodltmf")) returned 0x2020 [0205.664] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\marionette.log", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x85572e90, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x39, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="marionette.log", cAlternateFileName="MARION~1.LOG")) returned 0x2e8558 [0205.664] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x85572e90, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x39, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="marionette.log", cAlternateFileName="MARION~1.LOG")) returned 0 [0205.664] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0205.664] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\marionette.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\marionette.log")) returned 1 [0205.665] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\marionette.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\marionette.log")) returned 0xffffffff [0205.665] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb50b6e70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb5175550, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb5175550, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xef3, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="mimeTypes.rdf", cAlternateFileName="MIMETY~1.RDF")) returned 1 [0205.665] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\mimeTypes.rdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\mimetypes.rdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0205.667] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\mimeTypes.rdf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\mimetypes.rdf.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0205.668] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xef3 [0205.668] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0205.668] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0205.754] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xef3, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0xef3, lpOverlapped=0x0) returned 1 [0205.755] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0xf00, lpOverlapped=0x0) returned 1 [0205.756] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0205.777] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.786] CloseHandle (hObject=0xe0) returned 1 [0205.786] CloseHandle (hObject=0xf0) returned 1 [0205.786] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\mimeTypes.rdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\mimetypes.rdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\mimeTypes.rdf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\mimetypes.rdf.dvodltmf")) returned 0 [0205.787] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\mimeTypes.rdf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\mimetypes.rdf.dvodltmf")) returned 0x2020 [0205.787] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\mimeTypes.rdf", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb50b6e70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb5175550, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb5175550, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xef3, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="mimeTypes.rdf", cAlternateFileName="MIMETY~1.RDF")) returned 0x2e8558 [0205.787] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb50b6e70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb5175550, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb5175550, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xef3, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="mimeTypes.rdf", cAlternateFileName="MIMETY~1.RDF")) returned 0 [0205.787] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0205.787] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\mimeTypes.rdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\mimetypes.rdf")) returned 1 [0205.788] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\mimeTypes.rdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\mimetypes.rdf")) returned 0xffffffff [0205.788] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="minidumps", cAlternateFileName="MINIDU~1")) returned 1 [0205.788] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xca, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0205.854] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xca, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.854] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xca, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0205.854] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0205.854] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x80696ec0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="parent.lock", cAlternateFileName="PARENT~1.LOC")) returned 1 [0205.854] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\parent.lock" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\parent.lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0205.857] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\parent.lock.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\parent.lock.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0205.858] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0205.858] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0205.858] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0205.950] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x10, lpOverlapped=0x0) returned 1 [0205.951] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0205.971] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.980] CloseHandle (hObject=0xf0) returned 1 [0205.980] CloseHandle (hObject=0xe0) returned 1 [0205.981] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\parent.lock" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\parent.lock"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\parent.lock.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\parent.lock.dvodltmf")) returned 0 [0205.981] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\parent.lock.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\parent.lock.dvodltmf")) returned 0x2020 [0205.982] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\parent.lock", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x80696ec0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="parent.lock", cAlternateFileName="PARENT~1.LOC")) returned 0x2e8558 [0205.982] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x80696ec0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="parent.lock", cAlternateFileName="PARENT~1.LOC")) returned 0 [0205.982] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0205.982] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\parent.lock" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\parent.lock")) returned 1 [0205.982] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\parent.lock" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\parent.lock")) returned 0xffffffff [0205.982] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb43eb830, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb43eb830, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc3b3f6e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="permissions.sqlite", cAlternateFileName="PERMIS~1.SQL")) returned 1 [0205.982] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\permissions.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\permissions.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0205.983] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\permissions.sqlite.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\permissions.sqlite.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0205.983] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10000 [0205.983] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0205.983] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0206.069] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x10000, lpOverlapped=0x0) returned 1 [0206.071] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x10010, lpOverlapped=0x0) returned 1 [0206.073] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0206.093] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0206.103] CloseHandle (hObject=0xe0) returned 1 [0206.103] CloseHandle (hObject=0xf0) returned 1 [0206.103] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\permissions.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\permissions.sqlite"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\permissions.sqlite.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\permissions.sqlite.dvodltmf")) returned 0 [0206.104] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\permissions.sqlite.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\permissions.sqlite.dvodltmf")) returned 0x2020 [0206.104] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\permissions.sqlite", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb43eb830, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb43eb830, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc3b3f6e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="permissions.sqlite", cAlternateFileName="PERMIS~1.SQL")) returned 0x2e8558 [0206.104] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb43eb830, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb43eb830, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc3b3f6e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="permissions.sqlite", cAlternateFileName="PERMIS~1.SQL")) returned 0 [0206.104] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0206.104] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\permissions.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\permissions.sqlite")) returned 1 [0206.106] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\permissions.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\permissions.sqlite")) returned 0xffffffff [0206.106] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4c1a3d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb4c1a3d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x82b58970, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xa00000, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="places.sqlite", cAlternateFileName="PLACES~1.SQL")) returned 1 [0206.106] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\places.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\places.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0206.106] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\places.sqlite.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\places.sqlite.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0206.106] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa00000 [0206.107] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0206.107] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0206.194] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x500000, lpOverlapped=0x0) returned 1 [0206.393] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x500000, lpOverlapped=0x0) returned 1 [0206.507] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x500000, lpOverlapped=0x0) returned 1 [0206.582] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x500010, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x500010, lpOverlapped=0x0) returned 1 [0206.701] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0206.721] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0206.731] CloseHandle (hObject=0xf0) returned 1 [0206.731] CloseHandle (hObject=0xe0) returned 1 [0206.732] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\places.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\places.sqlite"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\places.sqlite.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\places.sqlite.dvodltmf")) returned 0 [0206.733] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\places.sqlite.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\places.sqlite.dvodltmf")) returned 0x2020 [0206.733] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\places.sqlite", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4c1a3d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb4c1a3d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x82b58970, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xa00000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="places.sqlite", cAlternateFileName="PLACES~1.SQL")) returned 0x2e8558 [0206.733] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4c1a3d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb4c1a3d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x82b58970, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xa00000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="places.sqlite", cAlternateFileName="PLACES~1.SQL")) returned 0 [0206.733] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0206.733] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\places.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\places.sqlite")) returned 1 [0206.742] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\places.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\places.sqlite")) returned 0xffffffff [0206.742] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81fbde30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81fbde30, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81fbde30, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe14, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="pluginreg.dat", cAlternateFileName="PLUGIN~1.DAT")) returned 1 [0206.742] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\pluginreg.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\pluginreg.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0206.742] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\pluginreg.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\pluginreg.dat.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0206.743] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe14 [0206.743] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0206.743] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0206.838] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe14, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0xe14, lpOverlapped=0x0) returned 1 [0206.840] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0xe20, lpOverlapped=0x0) returned 1 [0206.841] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0206.860] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0206.879] CloseHandle (hObject=0xe0) returned 1 [0206.879] CloseHandle (hObject=0xf0) returned 1 [0206.879] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\pluginreg.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\pluginreg.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\pluginreg.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\pluginreg.dat.dvodltmf")) returned 0 [0206.880] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\pluginreg.dat.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\pluginreg.dat.dvodltmf")) returned 0x2020 [0206.880] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\pluginreg.dat", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81fbde30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81fbde30, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81fbde30, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe14, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="pluginreg.dat", cAlternateFileName="PLUGIN~1.DAT")) returned 0x2e8558 [0206.881] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81fbde30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81fbde30, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81fbde30, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe14, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="pluginreg.dat", cAlternateFileName="PLUGIN~1.DAT")) returned 0 [0206.881] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0206.881] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\pluginreg.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\pluginreg.dat")) returned 1 [0206.882] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\pluginreg.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\pluginreg.dat")) returned 0xffffffff [0206.882] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84c85c10, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x853f60d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x12069be0, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0xfde, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="prefs.js", cAlternateFileName="")) returned 1 [0206.882] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\prefs.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0206.883] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\prefs.js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0206.884] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfde [0206.884] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0206.884] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0206.972] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xfde, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0xfde, lpOverlapped=0x0) returned 1 [0206.974] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xfe0, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0xfe0, lpOverlapped=0x0) returned 1 [0206.975] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0206.994] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0207.004] CloseHandle (hObject=0xf0) returned 1 [0207.004] CloseHandle (hObject=0xe0) returned 1 [0207.004] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\prefs.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\prefs.js.dvodltmf")) returned 0 [0207.005] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\prefs.js.dvodltmf")) returned 0x2020 [0207.005] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84c85c10, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x853f60d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x12069be0, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0xfde, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="prefs.js", cAlternateFileName="")) returned 0x2e8558 [0207.005] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84c85c10, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x853f60d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x12069be0, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0xfde, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="prefs.js", cAlternateFileName="")) returned 0 [0207.005] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0207.005] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\prefs.js")) returned 1 [0207.007] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\prefs.js")) returned 0xffffffff [0207.007] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb6fa8c70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6fa8c70, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6fa8c70, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x4183, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="search.json", cAlternateFileName="SEARCH~1.JSO")) returned 1 [0207.007] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\search.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\search.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0207.008] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\search.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\search.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0207.008] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4183 [0207.008] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0207.009] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0207.097] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4183, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x4183, lpOverlapped=0x0) returned 1 [0207.100] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4190, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x4190, lpOverlapped=0x0) returned 1 [0207.101] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0207.121] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0207.130] CloseHandle (hObject=0xe0) returned 1 [0207.130] CloseHandle (hObject=0xf0) returned 1 [0207.131] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\search.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\search.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\search.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\search.json.dvodltmf")) returned 0 [0207.132] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\search.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\search.json.dvodltmf")) returned 0x2020 [0207.132] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\search.json", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb6fa8c70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6fa8c70, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6fa8c70, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x4183, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="search.json", cAlternateFileName="SEARCH~1.JSO")) returned 0x2e8558 [0207.132] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb6fa8c70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6fa8c70, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6fa8c70, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x4183, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="search.json", cAlternateFileName="SEARCH~1.JSO")) returned 0 [0207.132] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0207.132] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\search.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\search.json")) returned 1 [0207.133] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\search.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\search.json")) returned 0xffffffff [0207.133] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb477d930, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb477d930, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb47c9bf0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="secmod.db", cAlternateFileName="")) returned 1 [0207.133] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\secmod.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\secmod.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0207.135] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\secmod.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\secmod.db.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0207.135] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4000 [0207.135] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0207.136] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0207.224] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x4000, lpOverlapped=0x0) returned 1 [0207.226] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x4010, lpOverlapped=0x0) returned 1 [0207.227] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0207.247] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0207.258] CloseHandle (hObject=0xf0) returned 1 [0207.258] CloseHandle (hObject=0xe0) returned 1 [0207.258] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\secmod.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\secmod.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\secmod.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\secmod.db.dvodltmf")) returned 0 [0207.259] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\secmod.db.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\secmod.db.dvodltmf")) returned 0x2020 [0207.259] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\secmod.db", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb477d930, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb477d930, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb47c9bf0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="secmod.db", cAlternateFileName="")) returned 0x2e8558 [0207.259] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb477d930, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb477d930, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb47c9bf0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="secmod.db", cAlternateFileName="")) returned 0 [0207.259] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0207.259] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\secmod.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\secmod.db")) returned 1 [0207.260] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\secmod.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\secmod.db")) returned 0xffffffff [0207.260] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb82fff30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc3787480, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc3787480, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x3d6, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="sessionstore.bak", cAlternateFileName="SESSIO~1.BAK")) returned 1 [0207.260] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.bak" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0207.260] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.bak.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.bak.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0207.261] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d6 [0207.261] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0207.261] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0207.347] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3d6, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x3d6, lpOverlapped=0x0) returned 1 [0207.387] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x3e0, lpOverlapped=0x0) returned 1 [0207.388] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0207.409] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0207.419] CloseHandle (hObject=0xe0) returned 1 [0207.419] CloseHandle (hObject=0xf0) returned 1 [0207.419] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.bak" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.bak"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.bak.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.bak.dvodltmf")) returned 0 [0207.420] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.bak.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.bak.dvodltmf")) returned 0x2020 [0207.420] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.bak", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb82fff30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc3787480, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc3787480, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x3d6, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="sessionstore.bak", cAlternateFileName="SESSIO~1.BAK")) returned 0x2e8558 [0207.420] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb82fff30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc3787480, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc3787480, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x3d6, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="sessionstore.bak", cAlternateFileName="SESSIO~1.BAK")) returned 0 [0207.421] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0207.421] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.bak" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.bak")) returned 1 [0207.421] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.bak" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.bak")) returned 0xffffffff [0207.422] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb82fff30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x84e029d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x84e029d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbc5, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="sessionstore.js", cAlternateFileName="SESSIO~1.JS")) returned 1 [0207.422] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0207.426] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.js.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0207.427] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbc5 [0207.427] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0207.427] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0207.522] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xbc5, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0xbc5, lpOverlapped=0x0) returned 1 [0207.524] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0xbd0, lpOverlapped=0x0) returned 1 [0207.525] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0207.545] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0207.558] CloseHandle (hObject=0xf0) returned 1 [0207.558] CloseHandle (hObject=0xe0) returned 1 [0207.558] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.js.dvodltmf")) returned 0 [0207.559] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.js.dvodltmf")) returned 0x2020 [0207.559] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb82fff30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x84e029d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x84e029d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbc5, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="sessionstore.js", cAlternateFileName="SESSIO~1.JS")) returned 0x2e8558 [0207.559] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb82fff30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x84e029d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x84e029d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbc5, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="sessionstore.js", cAlternateFileName="SESSIO~1.JS")) returned 0 [0207.559] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0207.559] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.js")) returned 1 [0207.560] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.js")) returned 0xffffffff [0207.560] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb66495d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb66495d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6f36850, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x50000, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="signons.sqlite", cAlternateFileName="SIGNON~1.SQL")) returned 1 [0207.560] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\signons.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\signons.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0207.561] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\signons.sqlite.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\signons.sqlite.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0207.561] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x50000 [0207.561] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0207.562] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0207.654] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x50000, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x50000, lpOverlapped=0x0) returned 1 [0207.661] WriteFile (in: hFile=0xf0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x50010, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x50010, lpOverlapped=0x0) returned 1 [0207.667] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0207.687] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0207.697] CloseHandle (hObject=0xe0) returned 1 [0207.697] CloseHandle (hObject=0xf0) returned 1 [0207.697] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\signons.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\signons.sqlite"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\signons.sqlite.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\signons.sqlite.dvodltmf")) returned 0 [0207.698] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\signons.sqlite.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\signons.sqlite.dvodltmf")) returned 0x2020 [0207.698] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\signons.sqlite", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb66495d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb66495d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6f36850, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x50000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="signons.sqlite", cAlternateFileName="SIGNON~1.SQL")) returned 0x2e8558 [0207.698] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb66495d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb66495d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6f36850, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x50000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="signons.sqlite", cAlternateFileName="SIGNON~1.SQL")) returned 0 [0207.698] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0207.698] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\signons.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\signons.sqlite")) returned 1 [0207.702] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\signons.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\signons.sqlite")) returned 0xffffffff [0207.702] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x1d, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="times.json", cAlternateFileName="TIMES~1.JSO")) returned 1 [0207.702] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\times.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\times.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0207.704] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\times.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\times.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0207.705] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d [0207.705] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0207.705] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0207.811] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1d, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x1d, lpOverlapped=0x0) returned 1 [0207.812] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x20, lpOverlapped=0x0) returned 1 [0207.813] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0207.832] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0207.843] CloseHandle (hObject=0xf0) returned 1 [0207.843] CloseHandle (hObject=0xe0) returned 1 [0207.843] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\times.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\times.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\times.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\times.json.dvodltmf")) returned 0 [0207.844] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\times.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\times.json.dvodltmf")) returned 0x2020 [0207.844] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\times.json", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x1d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="times.json", cAlternateFileName="TIMES~1.JSO")) returned 0x2e8558 [0207.844] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x1d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="times.json", cAlternateFileName="TIMES~1.JSO")) returned 0 [0207.844] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0207.844] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\times.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\times.json")) returned 1 [0207.845] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\times.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\times.json")) returned 0xffffffff [0207.845] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb4f60210, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80d71510, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80d71510, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dcc40, dwReserved1=0x18e91c, cFileName="webapps", cAlternateFileName="")) returned 1 [0207.845] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb4f60210, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80d71510, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80d71510, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0207.847] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb4f60210, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80d71510, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80d71510, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0207.847] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80cff0f0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80cff0f0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80cff0f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0xc4, dwReserved1=0x0, cFileName="webapps.json", cAlternateFileName="WEBAPP~1.JSO")) returned 1 [0207.847] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\webapps.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webapps\\webapps.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0207.847] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\webapps.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webapps\\webapps.json.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0207.851] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2 [0207.851] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0207.851] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0207.942] ReadFile (in: hFile=0xf0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2, lpNumberOfBytesRead=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e6a8*=0x2, lpOverlapped=0x0) returned 1 [0207.942] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e6a8, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e6a8*=0x10, lpOverlapped=0x0) returned 1 [0207.943] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0207.964] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0207.974] CloseHandle (hObject=0xf0) returned 1 [0207.974] CloseHandle (hObject=0xe8) returned 1 [0207.975] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\webapps.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webapps\\webapps.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\webapps.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webapps\\webapps.json.dvodltmf")) returned 0 [0207.975] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\webapps.json.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webapps\\webapps.json.dvodltmf")) returned 0x2020 [0207.976] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\webapps.json", lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80cff0f0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80cff0f0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80cff0f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="webapps.json", cAlternateFileName="WEBAPP~1.JSO")) returned 0x2e8598 [0207.976] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e5a4 | out: lpFindFileData=0x18e5a4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80cff0f0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80cff0f0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80cff0f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="webapps.json", cAlternateFileName="WEBAPP~1.JSO")) returned 0 [0207.976] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0207.976] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\webapps.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webapps\\webapps.json")) returned 1 [0207.977] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\webapps.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webapps\\webapps.json")) returned 0xffffffff [0207.977] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80cff0f0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80cff0f0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80cff0f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0xc4, dwReserved1=0x0, cFileName="webapps.json", cAlternateFileName="WEBAPP~1.JSO")) returned 0 [0207.977] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0207.977] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb66495d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb66495d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc3a63b40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x2dcc6e, dwReserved1=0x18e91c, cFileName="webappsstore.sqlite", cAlternateFileName="WEBAPP~1.SQL")) returned 1 [0207.977] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webappsstore.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webappsstore.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0207.978] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webappsstore.sqlite.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webappsstore.sqlite.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0207.979] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18000 [0207.979] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0207.979] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0208.066] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x18000, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0x18000, lpOverlapped=0x0) returned 1 [0208.071] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x18010, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0x18010, lpOverlapped=0x0) returned 1 [0208.073] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0208.093] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0208.103] CloseHandle (hObject=0xe0) returned 1 [0208.103] CloseHandle (hObject=0xe8) returned 1 [0208.103] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webappsstore.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webappsstore.sqlite"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webappsstore.sqlite.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webappsstore.sqlite.dvodltmf")) returned 0 [0208.104] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webappsstore.sqlite.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webappsstore.sqlite.dvodltmf")) returned 0x2020 [0208.104] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webappsstore.sqlite", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb66495d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb66495d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc3a63b40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="webappsstore.sqlite", cAlternateFileName="WEBAPP~1.SQL")) returned 0x2e8558 [0208.104] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb66495d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb66495d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc3a63b40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="webappsstore.sqlite", cAlternateFileName="WEBAPP~1.SQL")) returned 0 [0208.104] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0208.104] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webappsstore.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webappsstore.sqlite")) returned 1 [0208.106] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webappsstore.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webappsstore.sqlite")) returned 0xffffffff [0208.106] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb66495d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb66495d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc3a63b40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x2dcc6e, dwReserved1=0x18e91c, cFileName="webappsstore.sqlite", cAlternateFileName="WEBAPP~1.SQL")) returned 0 [0208.106] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0208.106] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 0 [0208.106] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0208.106] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x6c756166, dwReserved1=0x35323074, cFileName="profiles.ini", cAlternateFileName="")) returned 1 [0208.106] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0208.106] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0208.107] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6f [0208.107] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0208.107] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0208.197] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x6f, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x6f, lpOverlapped=0x0) returned 1 [0208.208] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x70, lpOverlapped=0x0) returned 1 [0208.209] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0208.231] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0208.240] CloseHandle (hObject=0xe4) returned 1 [0208.240] CloseHandle (hObject=0xdc) returned 1 [0208.241] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles.ini.dvodltmf")) returned 0 [0208.241] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles.ini.dvodltmf")) returned 0x2020 [0208.242] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="profiles.ini", cAlternateFileName="")) returned 0x2e84d8 [0208.242] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="profiles.ini", cAlternateFileName="")) returned 0 [0208.242] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0208.242] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles.ini")) returned 1 [0208.243] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles.ini")) returned 0xffffffff [0208.243] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x6c756166, dwReserved1=0x35323074, cFileName="profiles.ini", cAlternateFileName="")) returned 0 [0208.243] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0208.243] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75637472, dwReserved1=0x33377374, cFileName="Firefox", cAlternateFileName="")) returned 0 [0208.243] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0208.243] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x14c50cc0, ftCreationTime.dwHighDateTime=0x1d4cb99, ftLastAccessTime.dwLowDateTime=0xdf6bfe40, ftLastAccessTime.dwHighDateTime=0x1d4c881, ftLastWriteTime.dwLowDateTime=0xdf6bfe40, ftLastWriteTime.dwHighDateTime=0x1d4c881, nFileSizeHigh=0x0, nFileSizeLow=0xb992, dwReserved0=0x61636966, dwReserved1=0x20736574, cFileName="oTgdMAbmiemx25b5srML.mp3", cAlternateFileName="OTGDMA~1.MP3")) returned 1 [0208.243] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\oTgdMAbmiemx25b5srML.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\otgdmabmiemx25b5srml.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0208.243] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\oTgdMAbmiemx25b5srML.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\otgdmabmiemx25b5srml.mp3.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0208.244] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb992 [0208.244] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0208.245] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0208.353] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb992, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0xb992, lpOverlapped=0x0) returned 1 [0208.355] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb9a0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0xb9a0, lpOverlapped=0x0) returned 1 [0208.356] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0208.400] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0208.410] CloseHandle (hObject=0xd8) returned 1 [0208.410] CloseHandle (hObject=0xec) returned 1 [0208.410] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\oTgdMAbmiemx25b5srML.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\otgdmabmiemx25b5srml.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\oTgdMAbmiemx25b5srML.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\otgdmabmiemx25b5srml.mp3.dvodltmf")) returned 0 [0208.411] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\oTgdMAbmiemx25b5srML.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\otgdmabmiemx25b5srml.mp3.dvodltmf")) returned 0x2020 [0208.411] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\oTgdMAbmiemx25b5srML.mp3", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x14c50cc0, ftCreationTime.dwHighDateTime=0x1d4cb99, ftLastAccessTime.dwLowDateTime=0xdf6bfe40, ftLastAccessTime.dwHighDateTime=0x1d4c881, ftLastWriteTime.dwLowDateTime=0xdf6bfe40, ftLastWriteTime.dwHighDateTime=0x1d4c881, nFileSizeHigh=0x0, nFileSizeLow=0xb992, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="oTgdMAbmiemx25b5srML.mp3", cAlternateFileName="OTGDMA~1.MP3")) returned 0x2e8458 [0208.411] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x14c50cc0, ftCreationTime.dwHighDateTime=0x1d4cb99, ftLastAccessTime.dwLowDateTime=0xdf6bfe40, ftLastAccessTime.dwHighDateTime=0x1d4c881, ftLastWriteTime.dwLowDateTime=0xdf6bfe40, ftLastWriteTime.dwHighDateTime=0x1d4c881, nFileSizeHigh=0x0, nFileSizeLow=0xb992, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="oTgdMAbmiemx25b5srML.mp3", cAlternateFileName="OTGDMA~1.MP3")) returned 0 [0208.411] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0208.411] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\oTgdMAbmiemx25b5srML.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\otgdmabmiemx25b5srml.mp3")) returned 1 [0208.412] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\oTgdMAbmiemx25b5srML.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\otgdmabmiemx25b5srml.mp3")) returned 0xffffffff [0208.412] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x56f454e0, ftCreationTime.dwHighDateTime=0x1d4caed, ftLastAccessTime.dwLowDateTime=0xeb0015f0, ftLastAccessTime.dwHighDateTime=0x1d4d39b, ftLastWriteTime.dwLowDateTime=0xeb0015f0, ftLastWriteTime.dwHighDateTime=0x1d4d39b, nFileSizeHigh=0x0, nFileSizeLow=0x15de3, dwReserved0=0x0, dwReserved1=0x0, cFileName="OYA_AmX-oJaA35K4.gif", cAlternateFileName="OYA_AM~1.GIF")) returned 1 [0208.412] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OYA_AmX-oJaA35K4.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\oya_amx-ojaa35k4.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0208.413] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OYA_AmX-oJaA35K4.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\oya_amx-ojaa35k4.gif.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0208.413] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15de3 [0208.414] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0208.414] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0208.515] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x15de3, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x15de3, lpOverlapped=0x0) returned 1 [0208.517] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x15df0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x15df0, lpOverlapped=0x0) returned 1 [0208.519] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0208.571] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0208.580] CloseHandle (hObject=0xec) returned 1 [0208.580] CloseHandle (hObject=0xd8) returned 1 [0208.580] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OYA_AmX-oJaA35K4.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\oya_amx-ojaa35k4.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OYA_AmX-oJaA35K4.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\oya_amx-ojaa35k4.gif.dvodltmf")) returned 0 [0208.581] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OYA_AmX-oJaA35K4.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\oya_amx-ojaa35k4.gif.dvodltmf")) returned 0x2020 [0208.581] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OYA_AmX-oJaA35K4.gif", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x56f454e0, ftCreationTime.dwHighDateTime=0x1d4caed, ftLastAccessTime.dwLowDateTime=0xeb0015f0, ftLastAccessTime.dwHighDateTime=0x1d4d39b, ftLastWriteTime.dwLowDateTime=0xeb0015f0, ftLastWriteTime.dwHighDateTime=0x1d4d39b, nFileSizeHigh=0x0, nFileSizeLow=0x15de3, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="OYA_AmX-oJaA35K4.gif", cAlternateFileName="OYA_AM~1.GIF")) returned 0x2e8458 [0208.582] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x56f454e0, ftCreationTime.dwHighDateTime=0x1d4caed, ftLastAccessTime.dwLowDateTime=0xeb0015f0, ftLastAccessTime.dwHighDateTime=0x1d4d39b, ftLastWriteTime.dwLowDateTime=0xeb0015f0, ftLastWriteTime.dwHighDateTime=0x1d4d39b, nFileSizeHigh=0x0, nFileSizeLow=0x15de3, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="OYA_AmX-oJaA35K4.gif", cAlternateFileName="OYA_AM~1.GIF")) returned 0 [0208.582] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0208.582] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OYA_AmX-oJaA35K4.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\oya_amx-ojaa35k4.gif")) returned 1 [0208.584] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OYA_AmX-oJaA35K4.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\oya_amx-ojaa35k4.gif")) returned 0xffffffff [0208.585] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46209cb0, ftCreationTime.dwHighDateTime=0x1d4c7fe, ftLastAccessTime.dwLowDateTime=0xe39090a0, ftLastAccessTime.dwHighDateTime=0x1d4cee2, ftLastWriteTime.dwLowDateTime=0xe39090a0, ftLastWriteTime.dwHighDateTime=0x1d4cee2, nFileSizeHigh=0x0, nFileSizeLow=0xe9f2, dwReserved0=0x2dcc40, dwReserved1=0x18f2bc, cFileName="qeVnN6Bzkzfaz.swf", cAlternateFileName="QEVNN6~1.SWF")) returned 1 [0208.585] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\qeVnN6Bzkzfaz.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\qevnn6bzkzfaz.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0208.585] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\qeVnN6Bzkzfaz.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\qevnn6bzkzfaz.swf.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0208.586] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe9f2 [0208.586] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0208.586] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0208.680] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe9f2, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0xe9f2, lpOverlapped=0x0) returned 1 [0208.681] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xea00, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0xea00, lpOverlapped=0x0) returned 1 [0208.683] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0208.703] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0208.713] CloseHandle (hObject=0xd8) returned 1 [0208.713] CloseHandle (hObject=0xec) returned 1 [0208.713] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\qeVnN6Bzkzfaz.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\qevnn6bzkzfaz.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\qeVnN6Bzkzfaz.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\qevnn6bzkzfaz.swf.dvodltmf")) returned 0 [0208.714] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\qeVnN6Bzkzfaz.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\qevnn6bzkzfaz.swf.dvodltmf")) returned 0x2020 [0208.714] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\qeVnN6Bzkzfaz.swf", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46209cb0, ftCreationTime.dwHighDateTime=0x1d4c7fe, ftLastAccessTime.dwLowDateTime=0xe39090a0, ftLastAccessTime.dwHighDateTime=0x1d4cee2, ftLastWriteTime.dwLowDateTime=0xe39090a0, ftLastWriteTime.dwHighDateTime=0x1d4cee2, nFileSizeHigh=0x0, nFileSizeLow=0xe9f2, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="qeVnN6Bzkzfaz.swf", cAlternateFileName="QEVNN6~1.SWF")) returned 0x2e8458 [0208.714] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46209cb0, ftCreationTime.dwHighDateTime=0x1d4c7fe, ftLastAccessTime.dwLowDateTime=0xe39090a0, ftLastAccessTime.dwHighDateTime=0x1d4cee2, ftLastWriteTime.dwLowDateTime=0xe39090a0, ftLastWriteTime.dwHighDateTime=0x1d4cee2, nFileSizeHigh=0x0, nFileSizeLow=0xe9f2, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="qeVnN6Bzkzfaz.swf", cAlternateFileName="QEVNN6~1.SWF")) returned 0 [0208.714] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0208.714] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\qeVnN6Bzkzfaz.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\qevnn6bzkzfaz.swf")) returned 1 [0208.716] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\qeVnN6Bzkzfaz.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\qevnn6bzkzfaz.swf")) returned 0xffffffff [0208.716] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf546f450, ftCreationTime.dwHighDateTime=0x1d4d258, ftLastAccessTime.dwLowDateTime=0xd50e9c80, ftLastAccessTime.dwHighDateTime=0x1d4cf68, ftLastWriteTime.dwLowDateTime=0xd50e9c80, ftLastWriteTime.dwHighDateTime=0x1d4cf68, nFileSizeHigh=0x0, nFileSizeLow=0xf7af, dwReserved0=0x2dcc40, dwReserved1=0x18f2bc, cFileName="RxG jFiGSA1Wy.bmp", cAlternateFileName="RXGJFI~1.BMP")) returned 1 [0208.716] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\RxG jFiGSA1Wy.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\rxg jfigsa1wy.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0208.716] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\RxG jFiGSA1Wy.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\rxg jfigsa1wy.bmp.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0208.717] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf7af [0208.717] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0208.717] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0208.822] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xf7af, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0xf7af, lpOverlapped=0x0) returned 1 [0208.824] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf7b0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0xf7b0, lpOverlapped=0x0) returned 1 [0208.826] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0208.845] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0208.863] CloseHandle (hObject=0xec) returned 1 [0208.863] CloseHandle (hObject=0xd8) returned 1 [0208.863] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\RxG jFiGSA1Wy.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\rxg jfigsa1wy.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\RxG jFiGSA1Wy.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\rxg jfigsa1wy.bmp.dvodltmf")) returned 0 [0208.864] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\RxG jFiGSA1Wy.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\rxg jfigsa1wy.bmp.dvodltmf")) returned 0x2020 [0208.864] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\RxG jFiGSA1Wy.bmp", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf546f450, ftCreationTime.dwHighDateTime=0x1d4d258, ftLastAccessTime.dwLowDateTime=0xd50e9c80, ftLastAccessTime.dwHighDateTime=0x1d4cf68, ftLastWriteTime.dwLowDateTime=0xd50e9c80, ftLastWriteTime.dwHighDateTime=0x1d4cf68, nFileSizeHigh=0x0, nFileSizeLow=0xf7af, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="RxG jFiGSA1Wy.bmp", cAlternateFileName="RXGJFI~1.BMP")) returned 0x2e8458 [0208.864] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf546f450, ftCreationTime.dwHighDateTime=0x1d4d258, ftLastAccessTime.dwLowDateTime=0xd50e9c80, ftLastAccessTime.dwHighDateTime=0x1d4cf68, ftLastWriteTime.dwLowDateTime=0xd50e9c80, ftLastWriteTime.dwHighDateTime=0x1d4cf68, nFileSizeHigh=0x0, nFileSizeLow=0xf7af, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="RxG jFiGSA1Wy.bmp", cAlternateFileName="RXGJFI~1.BMP")) returned 0 [0208.864] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0208.864] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\RxG jFiGSA1Wy.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\rxg jfigsa1wy.bmp")) returned 1 [0208.866] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\RxG jFiGSA1Wy.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\rxg jfigsa1wy.bmp")) returned 0xffffffff [0208.866] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xead41a40, ftCreationTime.dwHighDateTime=0x1d4c8e2, ftLastAccessTime.dwLowDateTime=0x66c38930, ftLastAccessTime.dwHighDateTime=0x1d4cbca, ftLastWriteTime.dwLowDateTime=0x66c38930, ftLastWriteTime.dwHighDateTime=0x1d4cbca, nFileSizeHigh=0x0, nFileSizeLow=0xe71c, dwReserved0=0x2dcc40, dwReserved1=0x18f2bc, cFileName="sfHzJggJD.avi", cAlternateFileName="SFHZJG~1.AVI")) returned 1 [0208.866] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\sfHzJggJD.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\sfhzjggjd.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0208.866] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\sfHzJggJD.avi.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\sfhzjggjd.avi.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0208.867] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe71c [0208.867] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0208.867] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0208.955] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe71c, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0xe71c, lpOverlapped=0x0) returned 1 [0208.957] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe720, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0xe720, lpOverlapped=0x0) returned 1 [0208.958] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0208.978] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0208.988] CloseHandle (hObject=0xd8) returned 1 [0208.988] CloseHandle (hObject=0xec) returned 1 [0208.988] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\sfHzJggJD.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\sfhzjggjd.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\sfHzJggJD.avi.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\sfhzjggjd.avi.dvodltmf")) returned 0 [0208.989] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\sfHzJggJD.avi.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\sfhzjggjd.avi.dvodltmf")) returned 0x2020 [0208.990] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\sfHzJggJD.avi", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xead41a40, ftCreationTime.dwHighDateTime=0x1d4c8e2, ftLastAccessTime.dwLowDateTime=0x66c38930, ftLastAccessTime.dwHighDateTime=0x1d4cbca, ftLastWriteTime.dwLowDateTime=0x66c38930, ftLastWriteTime.dwHighDateTime=0x1d4cbca, nFileSizeHigh=0x0, nFileSizeLow=0xe71c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="sfHzJggJD.avi", cAlternateFileName="SFHZJG~1.AVI")) returned 0x2e8458 [0208.990] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xead41a40, ftCreationTime.dwHighDateTime=0x1d4c8e2, ftLastAccessTime.dwLowDateTime=0x66c38930, ftLastAccessTime.dwHighDateTime=0x1d4cbca, ftLastWriteTime.dwLowDateTime=0x66c38930, ftLastWriteTime.dwHighDateTime=0x1d4cbca, nFileSizeHigh=0x0, nFileSizeLow=0xe71c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="sfHzJggJD.avi", cAlternateFileName="SFHZJG~1.AVI")) returned 0 [0208.990] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0208.990] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\sfHzJggJD.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\sfhzjggjd.avi")) returned 1 [0208.991] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\sfHzJggJD.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\sfhzjggjd.avi")) returned 0xffffffff [0208.991] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x17d404f0, ftCreationTime.dwHighDateTime=0x1d4d3b1, ftLastAccessTime.dwLowDateTime=0x8d496a60, ftLastAccessTime.dwHighDateTime=0x1d4d198, ftLastWriteTime.dwLowDateTime=0x8d496a60, ftLastWriteTime.dwHighDateTime=0x1d4d198, nFileSizeHigh=0x0, nFileSizeLow=0x96e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="VwxOP6.ods", cAlternateFileName="")) returned 1 [0208.991] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VwxOP6.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vwxop6.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0208.991] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VwxOP6.ods.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vwxop6.ods.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0208.992] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x96e4 [0208.992] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0208.992] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0209.081] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x96e4, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x96e4, lpOverlapped=0x0) returned 1 [0209.086] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x96f0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x96f0, lpOverlapped=0x0) returned 1 [0209.088] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0209.107] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0209.117] CloseHandle (hObject=0xec) returned 1 [0209.117] CloseHandle (hObject=0xd8) returned 1 [0209.117] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VwxOP6.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vwxop6.ods"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VwxOP6.ods.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vwxop6.ods.dvodltmf")) returned 0 [0209.118] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VwxOP6.ods.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vwxop6.ods.dvodltmf")) returned 0x2020 [0209.118] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VwxOP6.ods", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x17d404f0, ftCreationTime.dwHighDateTime=0x1d4d3b1, ftLastAccessTime.dwLowDateTime=0x8d496a60, ftLastAccessTime.dwHighDateTime=0x1d4d198, ftLastWriteTime.dwLowDateTime=0x8d496a60, ftLastWriteTime.dwHighDateTime=0x1d4d198, nFileSizeHigh=0x0, nFileSizeLow=0x96e4, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="VwxOP6.ods", cAlternateFileName="")) returned 0x2e8458 [0209.118] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x17d404f0, ftCreationTime.dwHighDateTime=0x1d4d3b1, ftLastAccessTime.dwLowDateTime=0x8d496a60, ftLastAccessTime.dwHighDateTime=0x1d4d198, ftLastWriteTime.dwLowDateTime=0x8d496a60, ftLastWriteTime.dwHighDateTime=0x1d4d198, nFileSizeHigh=0x0, nFileSizeLow=0x96e4, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="VwxOP6.ods", cAlternateFileName="")) returned 0 [0209.118] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0209.119] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VwxOP6.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vwxop6.ods")) returned 1 [0209.136] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VwxOP6.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vwxop6.ods")) returned 0xffffffff [0209.136] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4a343bf0, ftCreationTime.dwHighDateTime=0x1d4d0cc, ftLastAccessTime.dwLowDateTime=0x634bc5b0, ftLastAccessTime.dwHighDateTime=0x1d4c7e7, ftLastWriteTime.dwLowDateTime=0x634bc5b0, ftLastWriteTime.dwHighDateTime=0x1d4c7e7, nFileSizeHigh=0x0, nFileSizeLow=0x3625, dwReserved0=0x0, dwReserved1=0x0, cFileName="VzhSp.csv", cAlternateFileName="")) returned 1 [0209.136] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VzhSp.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vzhsp.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0209.136] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VzhSp.csv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vzhsp.csv.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0209.137] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3625 [0209.137] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0209.138] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0209.231] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3625, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x3625, lpOverlapped=0x0) returned 1 [0209.232] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3630, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x3630, lpOverlapped=0x0) returned 1 [0209.233] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0209.252] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0209.262] CloseHandle (hObject=0xd8) returned 1 [0209.262] CloseHandle (hObject=0xec) returned 1 [0209.262] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VzhSp.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vzhsp.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VzhSp.csv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vzhsp.csv.dvodltmf")) returned 0 [0209.263] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VzhSp.csv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vzhsp.csv.dvodltmf")) returned 0x2020 [0209.263] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VzhSp.csv", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4a343bf0, ftCreationTime.dwHighDateTime=0x1d4d0cc, ftLastAccessTime.dwLowDateTime=0x634bc5b0, ftLastAccessTime.dwHighDateTime=0x1d4c7e7, ftLastWriteTime.dwLowDateTime=0x634bc5b0, ftLastWriteTime.dwHighDateTime=0x1d4c7e7, nFileSizeHigh=0x0, nFileSizeLow=0x3625, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="VzhSp.csv", cAlternateFileName="")) returned 0x2e8458 [0209.263] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4a343bf0, ftCreationTime.dwHighDateTime=0x1d4d0cc, ftLastAccessTime.dwLowDateTime=0x634bc5b0, ftLastAccessTime.dwHighDateTime=0x1d4c7e7, ftLastWriteTime.dwLowDateTime=0x634bc5b0, ftLastWriteTime.dwHighDateTime=0x1d4c7e7, nFileSizeHigh=0x0, nFileSizeLow=0x3625, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="VzhSp.csv", cAlternateFileName="")) returned 0 [0209.263] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0209.263] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VzhSp.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vzhsp.csv")) returned 1 [0209.265] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VzhSp.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vzhsp.csv")) returned 0xffffffff [0209.265] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a2787d0, ftCreationTime.dwHighDateTime=0x1d4cbe2, ftLastAccessTime.dwLowDateTime=0x8bd6b570, ftLastAccessTime.dwHighDateTime=0x1d4c540, ftLastWriteTime.dwLowDateTime=0x8bd6b570, ftLastWriteTime.dwHighDateTime=0x1d4c540, nFileSizeHigh=0x0, nFileSizeLow=0x144e4, dwReserved0=0x2dcc40, dwReserved1=0x18f2bc, cFileName="w-WLVKUu8ATeBy1syxp.mp3", cAlternateFileName="W-WLVK~1.MP3")) returned 1 [0209.265] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\w-WLVKUu8ATeBy1syxp.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\w-wlvkuu8ateby1syxp.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0209.265] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\w-WLVKUu8ATeBy1syxp.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\w-wlvkuu8ateby1syxp.mp3.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0209.266] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x144e4 [0209.266] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0209.266] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0209.354] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x144e4, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x144e4, lpOverlapped=0x0) returned 1 [0209.356] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x144f0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x144f0, lpOverlapped=0x0) returned 1 [0209.358] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0209.488] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0209.497] CloseHandle (hObject=0xec) returned 1 [0209.497] CloseHandle (hObject=0xd8) returned 1 [0209.498] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\w-WLVKUu8ATeBy1syxp.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\w-wlvkuu8ateby1syxp.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\w-WLVKUu8ATeBy1syxp.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\w-wlvkuu8ateby1syxp.mp3.dvodltmf")) returned 0 [0209.499] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\w-WLVKUu8ATeBy1syxp.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\w-wlvkuu8ateby1syxp.mp3.dvodltmf")) returned 0x2020 [0209.499] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\w-WLVKUu8ATeBy1syxp.mp3", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a2787d0, ftCreationTime.dwHighDateTime=0x1d4cbe2, ftLastAccessTime.dwLowDateTime=0x8bd6b570, ftLastAccessTime.dwHighDateTime=0x1d4c540, ftLastWriteTime.dwLowDateTime=0x8bd6b570, ftLastWriteTime.dwHighDateTime=0x1d4c540, nFileSizeHigh=0x0, nFileSizeLow=0x144e4, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="w-WLVKUu8ATeBy1syxp.mp3", cAlternateFileName="W-WLVK~1.MP3")) returned 0x2e8458 [0209.499] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a2787d0, ftCreationTime.dwHighDateTime=0x1d4cbe2, ftLastAccessTime.dwLowDateTime=0x8bd6b570, ftLastAccessTime.dwHighDateTime=0x1d4c540, ftLastWriteTime.dwLowDateTime=0x8bd6b570, ftLastWriteTime.dwHighDateTime=0x1d4c540, nFileSizeHigh=0x0, nFileSizeLow=0x144e4, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="w-WLVKUu8ATeBy1syxp.mp3", cAlternateFileName="W-WLVK~1.MP3")) returned 0 [0209.499] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0209.499] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\w-WLVKUu8ATeBy1syxp.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\w-wlvkuu8ateby1syxp.mp3")) returned 1 [0209.500] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\w-WLVKUu8ATeBy1syxp.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\w-wlvkuu8ateby1syxp.mp3")) returned 0xffffffff [0209.500] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55ed7060, ftCreationTime.dwHighDateTime=0x1d4cae6, ftLastAccessTime.dwLowDateTime=0xaf52d570, ftLastAccessTime.dwHighDateTime=0x1d4c913, ftLastWriteTime.dwLowDateTime=0xaf52d570, ftLastWriteTime.dwHighDateTime=0x1d4c913, nFileSizeHigh=0x0, nFileSizeLow=0x5583, dwReserved0=0x0, dwReserved1=0x0, cFileName="WygDLVNDW9XETrgnC0Hc.gif", cAlternateFileName="WYGDLV~1.GIF")) returned 1 [0209.500] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\WygDLVNDW9XETrgnC0Hc.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\wygdlvndw9xetrgnc0hc.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0209.501] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\WygDLVNDW9XETrgnC0Hc.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\wygdlvndw9xetrgnc0hc.gif.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0209.501] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5583 [0209.501] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0209.502] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0209.667] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x5583, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x5583, lpOverlapped=0x0) returned 1 [0209.668] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x5590, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x5590, lpOverlapped=0x0) returned 1 [0209.669] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0209.688] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0209.697] CloseHandle (hObject=0xd8) returned 1 [0209.698] CloseHandle (hObject=0xec) returned 1 [0209.698] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\WygDLVNDW9XETrgnC0Hc.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\wygdlvndw9xetrgnc0hc.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\WygDLVNDW9XETrgnC0Hc.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\wygdlvndw9xetrgnc0hc.gif.dvodltmf")) returned 0 [0209.699] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\WygDLVNDW9XETrgnC0Hc.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\wygdlvndw9xetrgnc0hc.gif.dvodltmf")) returned 0x2020 [0209.699] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\WygDLVNDW9XETrgnC0Hc.gif", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55ed7060, ftCreationTime.dwHighDateTime=0x1d4cae6, ftLastAccessTime.dwLowDateTime=0xaf52d570, ftLastAccessTime.dwHighDateTime=0x1d4c913, ftLastWriteTime.dwLowDateTime=0xaf52d570, ftLastWriteTime.dwHighDateTime=0x1d4c913, nFileSizeHigh=0x0, nFileSizeLow=0x5583, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="WygDLVNDW9XETrgnC0Hc.gif", cAlternateFileName="WYGDLV~1.GIF")) returned 0x2e8458 [0209.699] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55ed7060, ftCreationTime.dwHighDateTime=0x1d4cae6, ftLastAccessTime.dwLowDateTime=0xaf52d570, ftLastAccessTime.dwHighDateTime=0x1d4c913, ftLastWriteTime.dwLowDateTime=0xaf52d570, ftLastWriteTime.dwHighDateTime=0x1d4c913, nFileSizeHigh=0x0, nFileSizeLow=0x5583, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="WygDLVNDW9XETrgnC0Hc.gif", cAlternateFileName="WYGDLV~1.GIF")) returned 0 [0209.699] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0209.699] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\WygDLVNDW9XETrgnC0Hc.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\wygdlvndw9xetrgnc0hc.gif")) returned 1 [0209.710] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\WygDLVNDW9XETrgnC0Hc.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\wygdlvndw9xetrgnc0hc.gif")) returned 0xffffffff [0209.710] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb71d6200, ftCreationTime.dwHighDateTime=0x1d4ccda, ftLastAccessTime.dwLowDateTime=0xeb6250a0, ftLastAccessTime.dwHighDateTime=0x1d4d11e, ftLastWriteTime.dwLowDateTime=0xeb6250a0, ftLastWriteTime.dwHighDateTime=0x1d4d11e, nFileSizeHigh=0x0, nFileSizeLow=0x171e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="XIml-b33On9Rx nOguK2.wav", cAlternateFileName="XIML-B~1.WAV")) returned 1 [0209.710] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XIml-b33On9Rx nOguK2.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ximl-b33on9rx noguk2.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0209.710] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XIml-b33On9Rx nOguK2.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ximl-b33on9rx noguk2.wav.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0209.711] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x171e5 [0209.711] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0209.711] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0209.811] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x171e5, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x171e5, lpOverlapped=0x0) returned 1 [0209.813] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x171f0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x171f0, lpOverlapped=0x0) returned 1 [0209.872] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0209.892] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0209.901] CloseHandle (hObject=0xec) returned 1 [0209.901] CloseHandle (hObject=0xd8) returned 1 [0209.902] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XIml-b33On9Rx nOguK2.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ximl-b33on9rx noguk2.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XIml-b33On9Rx nOguK2.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ximl-b33on9rx noguk2.wav.dvodltmf")) returned 0 [0209.902] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XIml-b33On9Rx nOguK2.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ximl-b33on9rx noguk2.wav.dvodltmf")) returned 0x2020 [0209.903] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XIml-b33On9Rx nOguK2.wav", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb71d6200, ftCreationTime.dwHighDateTime=0x1d4ccda, ftLastAccessTime.dwLowDateTime=0xeb6250a0, ftLastAccessTime.dwHighDateTime=0x1d4d11e, ftLastWriteTime.dwLowDateTime=0xeb6250a0, ftLastWriteTime.dwHighDateTime=0x1d4d11e, nFileSizeHigh=0x0, nFileSizeLow=0x171e5, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="XIml-b33On9Rx nOguK2.wav", cAlternateFileName="XIML-B~1.WAV")) returned 0x2e8458 [0209.903] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb71d6200, ftCreationTime.dwHighDateTime=0x1d4ccda, ftLastAccessTime.dwLowDateTime=0xeb6250a0, ftLastAccessTime.dwHighDateTime=0x1d4d11e, ftLastWriteTime.dwLowDateTime=0xeb6250a0, ftLastWriteTime.dwHighDateTime=0x1d4d11e, nFileSizeHigh=0x0, nFileSizeLow=0x171e5, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="XIml-b33On9Rx nOguK2.wav", cAlternateFileName="XIML-B~1.WAV")) returned 0 [0209.903] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0209.903] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XIml-b33On9Rx nOguK2.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ximl-b33on9rx noguk2.wav")) returned 1 [0209.904] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XIml-b33On9Rx nOguK2.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ximl-b33on9rx noguk2.wav")) returned 0xffffffff [0209.904] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x659b7620, ftCreationTime.dwHighDateTime=0x1d4c536, ftLastAccessTime.dwLowDateTime=0x3fd60160, ftLastAccessTime.dwHighDateTime=0x1d4d285, ftLastWriteTime.dwLowDateTime=0x3fd60160, ftLastWriteTime.dwHighDateTime=0x1d4d285, nFileSizeHigh=0x0, nFileSizeLow=0x179bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="xLRB.png", cAlternateFileName="")) returned 1 [0209.904] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\xLRB.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xlrb.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0209.904] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\xLRB.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xlrb.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0209.905] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x179bf [0209.905] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0209.905] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0210.024] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x179bf, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x179bf, lpOverlapped=0x0) returned 1 [0210.026] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x179c0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x179c0, lpOverlapped=0x0) returned 1 [0210.028] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0210.048] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0210.058] CloseHandle (hObject=0xd8) returned 1 [0210.058] CloseHandle (hObject=0xec) returned 1 [0210.058] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\xLRB.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xlrb.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\xLRB.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xlrb.png.dvodltmf")) returned 0 [0210.059] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\xLRB.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xlrb.png.dvodltmf")) returned 0x2020 [0210.059] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\xLRB.png", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x659b7620, ftCreationTime.dwHighDateTime=0x1d4c536, ftLastAccessTime.dwLowDateTime=0x3fd60160, ftLastAccessTime.dwHighDateTime=0x1d4d285, ftLastWriteTime.dwLowDateTime=0x3fd60160, ftLastWriteTime.dwHighDateTime=0x1d4d285, nFileSizeHigh=0x0, nFileSizeLow=0x179bf, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="xLRB.png", cAlternateFileName="")) returned 0x2e8458 [0210.059] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x659b7620, ftCreationTime.dwHighDateTime=0x1d4c536, ftLastAccessTime.dwLowDateTime=0x3fd60160, ftLastAccessTime.dwHighDateTime=0x1d4d285, ftLastWriteTime.dwLowDateTime=0x3fd60160, ftLastWriteTime.dwHighDateTime=0x1d4d285, nFileSizeHigh=0x0, nFileSizeLow=0x179bf, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="xLRB.png", cAlternateFileName="")) returned 0 [0210.059] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0210.059] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\xLRB.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xlrb.png")) returned 1 [0210.061] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\xLRB.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xlrb.png")) returned 0xffffffff [0210.061] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4ee08090, ftCreationTime.dwHighDateTime=0x1d4ce48, ftLastAccessTime.dwLowDateTime=0x8cac6570, ftLastAccessTime.dwHighDateTime=0x1d4d469, ftLastWriteTime.dwLowDateTime=0x8cac6570, ftLastWriteTime.dwHighDateTime=0x1d4d469, nFileSizeHigh=0x0, nFileSizeLow=0x70f7, dwReserved0=0x2dcc40, dwReserved1=0x18f2bc, cFileName="ZsXeVrVx.mp4", cAlternateFileName="")) returned 1 [0210.061] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ZsXeVrVx.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\zsxevrvx.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0210.061] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ZsXeVrVx.mp4.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\zsxevrvx.mp4.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0210.062] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x70f7 [0210.062] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0210.062] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0210.157] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x70f7, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x70f7, lpOverlapped=0x0) returned 1 [0210.158] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x7100, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x7100, lpOverlapped=0x0) returned 1 [0210.160] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0210.181] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0210.200] CloseHandle (hObject=0xec) returned 1 [0210.200] CloseHandle (hObject=0xd8) returned 1 [0210.200] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ZsXeVrVx.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\zsxevrvx.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ZsXeVrVx.mp4.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\zsxevrvx.mp4.dvodltmf")) returned 0 [0210.201] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ZsXeVrVx.mp4.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\zsxevrvx.mp4.dvodltmf")) returned 0x2020 [0210.201] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ZsXeVrVx.mp4", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4ee08090, ftCreationTime.dwHighDateTime=0x1d4ce48, ftLastAccessTime.dwLowDateTime=0x8cac6570, ftLastAccessTime.dwHighDateTime=0x1d4d469, ftLastWriteTime.dwLowDateTime=0x8cac6570, ftLastWriteTime.dwHighDateTime=0x1d4d469, nFileSizeHigh=0x0, nFileSizeLow=0x70f7, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ZsXeVrVx.mp4", cAlternateFileName="")) returned 0x2e8458 [0210.201] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4ee08090, ftCreationTime.dwHighDateTime=0x1d4ce48, ftLastAccessTime.dwLowDateTime=0x8cac6570, ftLastAccessTime.dwHighDateTime=0x1d4d469, ftLastWriteTime.dwLowDateTime=0x8cac6570, ftLastWriteTime.dwHighDateTime=0x1d4d469, nFileSizeHigh=0x0, nFileSizeLow=0x70f7, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ZsXeVrVx.mp4", cAlternateFileName="")) returned 0 [0210.201] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0210.201] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ZsXeVrVx.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\zsxevrvx.mp4")) returned 1 [0210.202] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ZsXeVrVx.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\zsxevrvx.mp4")) returned 0xffffffff [0210.202] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x89768f90, ftCreationTime.dwHighDateTime=0x1d4c657, ftLastAccessTime.dwLowDateTime=0xc87d9730, ftLastAccessTime.dwHighDateTime=0x1d4c60f, ftLastWriteTime.dwLowDateTime=0xc87d9730, ftLastWriteTime.dwHighDateTime=0x1d4c60f, nFileSizeHigh=0x0, nFileSizeLow=0x500e, dwReserved0=0x0, dwReserved1=0x0, cFileName="zVd9ua6sveW.m4a", cAlternateFileName="ZVD9UA~1.M4A")) returned 1 [0210.202] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\zVd9ua6sveW.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\zvd9ua6svew.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0210.202] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\zVd9ua6sveW.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\zvd9ua6svew.m4a.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0210.203] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x500e [0210.203] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0210.204] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0210.293] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x500e, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x500e, lpOverlapped=0x0) returned 1 [0210.294] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x5010, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x5010, lpOverlapped=0x0) returned 1 [0210.295] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0210.315] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0210.325] CloseHandle (hObject=0xd8) returned 1 [0210.325] CloseHandle (hObject=0xec) returned 1 [0210.325] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\zVd9ua6sveW.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\zvd9ua6svew.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\zVd9ua6sveW.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\zvd9ua6svew.m4a.dvodltmf")) returned 0 [0210.326] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\zVd9ua6sveW.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\zvd9ua6svew.m4a.dvodltmf")) returned 0x2020 [0210.326] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\zVd9ua6sveW.m4a", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x89768f90, ftCreationTime.dwHighDateTime=0x1d4c657, ftLastAccessTime.dwLowDateTime=0xc87d9730, ftLastAccessTime.dwHighDateTime=0x1d4c60f, ftLastWriteTime.dwLowDateTime=0xc87d9730, ftLastWriteTime.dwHighDateTime=0x1d4c60f, nFileSizeHigh=0x0, nFileSizeLow=0x500e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="zVd9ua6sveW.m4a", cAlternateFileName="ZVD9UA~1.M4A")) returned 0x2e8458 [0210.326] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x89768f90, ftCreationTime.dwHighDateTime=0x1d4c657, ftLastAccessTime.dwLowDateTime=0xc87d9730, ftLastAccessTime.dwHighDateTime=0x1d4c60f, ftLastWriteTime.dwLowDateTime=0xc87d9730, ftLastWriteTime.dwHighDateTime=0x1d4c60f, nFileSizeHigh=0x0, nFileSizeLow=0x500e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="zVd9ua6sveW.m4a", cAlternateFileName="ZVD9UA~1.M4A")) returned 0 [0210.326] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0210.326] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\zVd9ua6sveW.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\zvd9ua6svew.m4a")) returned 1 [0210.327] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\zVd9ua6sveW.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\zvd9ua6svew.m4a")) returned 0xffffffff [0210.327] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86b7e930, ftCreationTime.dwHighDateTime=0x1d4ca93, ftLastAccessTime.dwLowDateTime=0x70e2480, ftLastAccessTime.dwHighDateTime=0x1d4cb95, ftLastWriteTime.dwLowDateTime=0x70e2480, ftLastWriteTime.dwHighDateTime=0x1d4cb95, nFileSizeHigh=0x0, nFileSizeLow=0x1444f, dwReserved0=0x2dcc40, dwReserved1=0x18f2bc, cFileName="_Mu7Udcpu-.wav", cAlternateFileName="_MU7UD~1.WAV")) returned 1 [0210.327] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_Mu7Udcpu-.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_mu7udcpu-.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0210.327] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_Mu7Udcpu-.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_mu7udcpu-.wav.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0210.328] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1444f [0210.328] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0210.329] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0210.426] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1444f, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x1444f, lpOverlapped=0x0) returned 1 [0210.428] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x14450, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x14450, lpOverlapped=0x0) returned 1 [0210.430] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0210.450] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0210.459] CloseHandle (hObject=0xec) returned 1 [0210.459] CloseHandle (hObject=0xd8) returned 1 [0210.459] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_Mu7Udcpu-.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_mu7udcpu-.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_Mu7Udcpu-.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_mu7udcpu-.wav.dvodltmf")) returned 0 [0210.460] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_Mu7Udcpu-.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_mu7udcpu-.wav.dvodltmf")) returned 0x2020 [0210.460] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_Mu7Udcpu-.wav", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86b7e930, ftCreationTime.dwHighDateTime=0x1d4ca93, ftLastAccessTime.dwLowDateTime=0x70e2480, ftLastAccessTime.dwHighDateTime=0x1d4cb95, ftLastWriteTime.dwLowDateTime=0x70e2480, ftLastWriteTime.dwHighDateTime=0x1d4cb95, nFileSizeHigh=0x0, nFileSizeLow=0x1444f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="_Mu7Udcpu-.wav", cAlternateFileName="_MU7UD~1.WAV")) returned 0x2e8458 [0210.461] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86b7e930, ftCreationTime.dwHighDateTime=0x1d4ca93, ftLastAccessTime.dwLowDateTime=0x70e2480, ftLastAccessTime.dwHighDateTime=0x1d4cb95, ftLastWriteTime.dwLowDateTime=0x70e2480, ftLastWriteTime.dwHighDateTime=0x1d4cb95, nFileSizeHigh=0x0, nFileSizeLow=0x1444f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="_Mu7Udcpu-.wav", cAlternateFileName="_MU7UD~1.WAV")) returned 0 [0210.461] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0210.461] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_Mu7Udcpu-.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_mu7udcpu-.wav")) returned 1 [0210.462] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_Mu7Udcpu-.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_mu7udcpu-.wav")) returned 0xffffffff [0210.462] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86b7e930, ftCreationTime.dwHighDateTime=0x1d4ca93, ftLastAccessTime.dwLowDateTime=0x70e2480, ftLastAccessTime.dwHighDateTime=0x1d4cb95, ftLastWriteTime.dwLowDateTime=0x70e2480, ftLastWriteTime.dwHighDateTime=0x1d4cb95, nFileSizeHigh=0x0, nFileSizeLow=0x1444f, dwReserved0=0x2dcc40, dwReserved1=0x18f2bc, cFileName="_Mu7Udcpu-.wav", cAlternateFileName="_MU7UD~1.WAV")) returned 0 [0210.462] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0210.462] FindNextFileA (in: hFindFile=0x2dab40, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7298d080, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7298d080, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72657465, dwReserved1=0x2074656e, cFileName="Roaming", cAlternateFileName="")) returned 0 [0210.462] FindClose (in: hFindFile=0x2dab40 | out: hFindFile=0x2dab40) returned 1 [0210.462] FindNextFileA (in: hFindFile=0x2dab90, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2c019c, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0210.462] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7298d080, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7298d080, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72657465, dwReserved1=0x2074656e, cFileName="Roaming", cAlternateFileName="\x90«-")) returned 0xffffffff [0210.463] FindNextFileA (in: hFindFile=0x2dab90, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2c019c, cFileName="Contacts", cAlternateFileName="")) returned 1 [0210.463] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61766177, dwReserved1=0x4b75674f, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0210.463] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61766177, dwReserved1=0x4b75674f, cFileName="..", cAlternateFileName="")) returned 1 [0210.463] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ea7ef20, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2ea7ef20, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2ea7ef20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x49a, dwReserved0=0x61766177, dwReserved1=0x4b75674f, cFileName="Aclviho ASldjfl.contact", cAlternateFileName="ACLVIH~1.CON")) returned 1 [0210.463] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0210.463] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0210.464] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x49a [0210.464] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0210.464] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0210.555] ReadFile (in: hFile=0xd4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x49a, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x49a, lpOverlapped=0x0) returned 1 [0210.560] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x4a0, lpOverlapped=0x0) returned 1 [0210.561] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0210.580] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0210.590] CloseHandle (hObject=0xd4) returned 1 [0210.590] CloseHandle (hObject=0xd8) returned 1 [0210.590] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact.dvodltmf")) returned 0 [0210.591] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact.dvodltmf")) returned 0x20 [0210.591] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ea7ef20, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2ea7ef20, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2ea7ef20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x49a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Aclviho ASldjfl.contact", cAlternateFileName="ACLVIH~1.CON")) returned 0x2e8458 [0210.591] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ea7ef20, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2ea7ef20, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2ea7ef20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x49a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Aclviho ASldjfl.contact", cAlternateFileName="ACLVIH~1.CON")) returned 0 [0210.591] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0210.591] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact")) returned 1 [0210.592] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact")) returned 0xffffffff [0210.592] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 1 [0210.592] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0210.593] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0210.593] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10b1e [0210.593] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0210.594] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0210.686] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x10b1e, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x10b1e, lpOverlapped=0x0) returned 1 [0210.694] WriteFile (in: hFile=0xd4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10b20, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x10b20, lpOverlapped=0x0) returned 1 [0210.696] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0210.715] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0210.726] CloseHandle (hObject=0xd8) returned 1 [0210.726] CloseHandle (hObject=0xd4) returned 1 [0210.726] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact.dvodltmf")) returned 0 [0210.727] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact.dvodltmf")) returned 0x20 [0210.727] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 0x2e8458 [0210.727] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 0 [0210.727] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0210.728] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact")) returned 1 [0210.729] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact")) returned 0xffffffff [0210.729] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaa5080, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaa5080, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaa5080, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="asdlfk poopvy.contact", cAlternateFileName="ASDLFK~1.CON")) returned 1 [0210.729] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0210.729] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0210.730] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x493 [0210.730] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0210.730] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0210.855] ReadFile (in: hFile=0xd4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x493, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x493, lpOverlapped=0x0) returned 1 [0210.856] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x4a0, lpOverlapped=0x0) returned 1 [0210.857] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0210.877] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0210.887] CloseHandle (hObject=0xd4) returned 1 [0210.887] CloseHandle (hObject=0xd8) returned 1 [0210.887] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact.dvodltmf")) returned 0 [0210.888] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact.dvodltmf")) returned 0x20 [0210.888] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaa5080, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaa5080, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaa5080, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="asdlfk poopvy.contact", cAlternateFileName="ASDLFK~1.CON")) returned 0x2e8458 [0210.888] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaa5080, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaa5080, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaa5080, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="asdlfk poopvy.contact", cAlternateFileName="ASDLFK~1.CON")) returned 0 [0210.888] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0210.888] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact")) returned 1 [0210.889] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact")) returned 0xffffffff [0210.889] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eacb1e0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eacb1e0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eacb1e0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x499, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="chucu jadnvk.contact", cAlternateFileName="CHUCUJ~1.CON")) returned 1 [0210.889] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0210.889] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0210.890] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x499 [0210.890] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0210.890] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0210.978] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x499, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x499, lpOverlapped=0x0) returned 1 [0210.980] WriteFile (in: hFile=0xd4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x4a0, lpOverlapped=0x0) returned 1 [0210.981] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0211.000] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0211.010] CloseHandle (hObject=0xd8) returned 1 [0211.010] CloseHandle (hObject=0xd4) returned 1 [0211.010] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact.dvodltmf")) returned 0 [0211.011] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact.dvodltmf")) returned 0x20 [0211.011] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eacb1e0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eacb1e0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eacb1e0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x499, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="chucu jadnvk.contact", cAlternateFileName="CHUCUJ~1.CON")) returned 0x2e8458 [0211.011] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eacb1e0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eacb1e0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eacb1e0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x499, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="chucu jadnvk.contact", cAlternateFileName="CHUCUJ~1.CON")) returned 0 [0211.011] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0211.011] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact")) returned 1 [0211.012] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact")) returned 0xffffffff [0211.012] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0211.012] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0211.012] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0211.013] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19c [0211.013] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0211.013] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0211.099] ReadFile (in: hFile=0xd4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x19c, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x19c, lpOverlapped=0x0) returned 1 [0211.100] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x1a0, lpOverlapped=0x0) returned 1 [0211.101] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0211.121] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0211.130] CloseHandle (hObject=0xd4) returned 1 [0211.131] CloseHandle (hObject=0xd8) returned 1 [0211.131] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\desktop.ini.dvodltmf")) returned 0 [0211.132] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\desktop.ini.dvodltmf")) returned 0x20 [0211.132] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8458 [0211.132] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0211.132] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0211.132] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\desktop.ini")) returned 1 [0211.133] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\desktop.ini")) returned 0xffffffff [0211.133] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x496, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="lulcit amkdfe.contact", cAlternateFileName="LULCIT~1.CON")) returned 1 [0211.133] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0211.133] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0211.134] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x496 [0211.134] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0211.134] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0211.224] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x496, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x496, lpOverlapped=0x0) returned 1 [0211.225] WriteFile (in: hFile=0xd4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x4a0, lpOverlapped=0x0) returned 1 [0211.226] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0211.246] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0211.256] CloseHandle (hObject=0xd8) returned 1 [0211.256] CloseHandle (hObject=0xd4) returned 1 [0211.256] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact.dvodltmf")) returned 0 [0211.257] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact.dvodltmf")) returned 0x20 [0211.257] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x496, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="lulcit amkdfe.contact", cAlternateFileName="LULCIT~1.CON")) returned 0x2e8458 [0211.258] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x496, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="lulcit amkdfe.contact", cAlternateFileName="LULCIT~1.CON")) returned 0 [0211.258] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0211.258] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact")) returned 1 [0211.259] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact")) returned 0xffffffff [0211.259] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 1 [0211.259] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0211.259] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0211.260] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x494 [0211.260] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0211.260] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0211.347] ReadFile (in: hFile=0xd4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x494, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x494, lpOverlapped=0x0) returned 1 [0211.349] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x4a0, lpOverlapped=0x0) returned 1 [0211.350] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0211.375] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0211.384] CloseHandle (hObject=0xd4) returned 1 [0211.384] CloseHandle (hObject=0xd8) returned 1 [0211.384] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact.dvodltmf")) returned 0 [0211.385] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact.dvodltmf")) returned 0x20 [0211.386] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 0x2e8458 [0211.386] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 0 [0211.386] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0211.386] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact")) returned 1 [0211.387] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact")) returned 0xffffffff [0211.387] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 0 [0211.387] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0211.387] FindNextFileA (in: hFindFile=0x2dab90, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x61746e6f, cFileName="Cookies", cAlternateFileName="")) returned 1 [0211.387] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="sikvnb huvuib.contact", cAlternateFileName="\x90«-")) returned 0xffffffff [0211.387] FindNextFileA (in: hFindFile=0x2dab90, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x77357a80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x77357a80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x61746e6f, cFileName="Desktop", cAlternateFileName="")) returned 1 [0211.387] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x77357a80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x77357a80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0211.387] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x77357a80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x77357a80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="..", cAlternateFileName="")) returned 1 [0211.387] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb01500, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x6eb01500, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x6c4dbb00, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="01.exe", cAlternateFileName="")) returned 1 [0211.387] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\01.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0211.388] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01.exe.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\01.exe.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0211.389] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa600 [0211.389] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0211.389] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0211.486] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa600, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0xa600, lpOverlapped=0x0) returned 1 [0211.488] WriteFile (in: hFile=0xd4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa610, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0xa610, lpOverlapped=0x0) returned 1 [0211.489] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0211.510] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0211.520] CloseHandle (hObject=0xd8) returned 1 [0211.520] CloseHandle (hObject=0xd4) returned 1 [0211.521] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\01.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01.exe.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\01.exe.dvodltmf")) returned 0 [0211.522] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01.exe.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\01.exe.dvodltmf")) returned 0x20 [0211.522] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01.exe", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb01500, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x6eb01500, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x6c4dbb00, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="01.exe", cAlternateFileName="")) returned 0x2e8458 [0211.522] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb01500, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x6eb01500, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x6c4dbb00, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="01.exe", cAlternateFileName="")) returned 0 [0211.522] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0211.522] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\01.exe")) returned 0 [0211.523] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\01.exe")) returned 0x20 [0211.523] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd11b9b20, ftCreationTime.dwHighDateTime=0x1d4cf8e, ftLastAccessTime.dwLowDateTime=0xc67001a0, ftLastAccessTime.dwHighDateTime=0x1d4c838, ftLastWriteTime.dwLowDateTime=0xc67001a0, ftLastWriteTime.dwHighDateTime=0x1d4c838, nFileSizeHigh=0x0, nFileSizeLow=0x10629, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="07iSZWrH.bmp", cAlternateFileName="")) returned 1 [0211.523] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\07iSZWrH.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\07iszwrh.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0211.523] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\07iSZWrH.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\07iszwrh.bmp.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0211.524] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10629 [0211.524] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0211.524] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0211.610] ReadFile (in: hFile=0xd4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x10629, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x10629, lpOverlapped=0x0) returned 1 [0211.611] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10630, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x10630, lpOverlapped=0x0) returned 1 [0211.613] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0211.634] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0211.644] CloseHandle (hObject=0xd4) returned 1 [0211.644] CloseHandle (hObject=0xd8) returned 1 [0211.644] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\07iSZWrH.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\07iszwrh.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\07iSZWrH.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\07iszwrh.bmp.dvodltmf")) returned 0 [0211.645] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\07iSZWrH.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\07iszwrh.bmp.dvodltmf")) returned 0x20 [0211.645] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\07iSZWrH.bmp", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd11b9b20, ftCreationTime.dwHighDateTime=0x1d4cf8e, ftLastAccessTime.dwLowDateTime=0xc67001a0, ftLastAccessTime.dwHighDateTime=0x1d4c838, ftLastWriteTime.dwLowDateTime=0xc67001a0, ftLastWriteTime.dwHighDateTime=0x1d4c838, nFileSizeHigh=0x0, nFileSizeLow=0x10629, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="07iSZWrH.bmp", cAlternateFileName="")) returned 0x2e8458 [0211.646] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd11b9b20, ftCreationTime.dwHighDateTime=0x1d4cf8e, ftLastAccessTime.dwLowDateTime=0xc67001a0, ftLastAccessTime.dwHighDateTime=0x1d4c838, ftLastWriteTime.dwLowDateTime=0xc67001a0, ftLastWriteTime.dwHighDateTime=0x1d4c838, nFileSizeHigh=0x0, nFileSizeLow=0x10629, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="07iSZWrH.bmp", cAlternateFileName="")) returned 0 [0211.646] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0211.646] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\07iSZWrH.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\07iszwrh.bmp")) returned 1 [0211.648] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\07iSZWrH.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\07iszwrh.bmp")) returned 0xffffffff [0211.648] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7289230, ftCreationTime.dwHighDateTime=0x1d4cc76, ftLastAccessTime.dwLowDateTime=0x4cf119a0, ftLastAccessTime.dwHighDateTime=0x1d4d02a, ftLastWriteTime.dwLowDateTime=0x4cf119a0, ftLastWriteTime.dwHighDateTime=0x1d4d02a, nFileSizeHigh=0x0, nFileSizeLow=0xc223, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="1sdHK.m4a", cAlternateFileName="")) returned 1 [0211.648] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1sdHK.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1sdhk.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0211.648] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1sdHK.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1sdhk.m4a.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0211.649] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc223 [0211.649] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0211.649] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0211.735] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xc223, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0xc223, lpOverlapped=0x0) returned 1 [0211.737] WriteFile (in: hFile=0xd4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc230, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0xc230, lpOverlapped=0x0) returned 1 [0211.738] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0211.758] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0211.768] CloseHandle (hObject=0xd8) returned 1 [0211.768] CloseHandle (hObject=0xd4) returned 1 [0211.769] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1sdHK.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1sdhk.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1sdHK.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1sdhk.m4a.dvodltmf")) returned 0 [0211.770] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1sdHK.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1sdhk.m4a.dvodltmf")) returned 0x20 [0211.770] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1sdHK.m4a", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7289230, ftCreationTime.dwHighDateTime=0x1d4cc76, ftLastAccessTime.dwLowDateTime=0x4cf119a0, ftLastAccessTime.dwHighDateTime=0x1d4d02a, ftLastWriteTime.dwLowDateTime=0x4cf119a0, ftLastWriteTime.dwHighDateTime=0x1d4d02a, nFileSizeHigh=0x0, nFileSizeLow=0xc223, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="1sdHK.m4a", cAlternateFileName="")) returned 0x2e8458 [0211.770] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7289230, ftCreationTime.dwHighDateTime=0x1d4cc76, ftLastAccessTime.dwLowDateTime=0x4cf119a0, ftLastAccessTime.dwHighDateTime=0x1d4d02a, ftLastWriteTime.dwLowDateTime=0x4cf119a0, ftLastWriteTime.dwHighDateTime=0x1d4d02a, nFileSizeHigh=0x0, nFileSizeLow=0xc223, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="1sdHK.m4a", cAlternateFileName="")) returned 0 [0211.770] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0211.770] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1sdHK.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1sdhk.m4a")) returned 1 [0211.772] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1sdHK.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1sdhk.m4a")) returned 0xffffffff [0211.772] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d20120, ftCreationTime.dwHighDateTime=0x1d4c6e7, ftLastAccessTime.dwLowDateTime=0xbc53b060, ftLastAccessTime.dwHighDateTime=0x1d4d268, ftLastWriteTime.dwLowDateTime=0xbc53b060, ftLastWriteTime.dwHighDateTime=0x1d4d268, nFileSizeHigh=0x0, nFileSizeLow=0x773c, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="3Z7Oh.flv", cAlternateFileName="")) returned 1 [0211.772] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3Z7Oh.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3z7oh.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0211.772] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3Z7Oh.flv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3z7oh.flv.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0211.774] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x773c [0211.774] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0211.774] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0211.859] ReadFile (in: hFile=0xd4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x773c, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x773c, lpOverlapped=0x0) returned 1 [0211.860] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x7740, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x7740, lpOverlapped=0x0) returned 1 [0211.861] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0211.881] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0211.891] CloseHandle (hObject=0xd4) returned 1 [0211.891] CloseHandle (hObject=0xd8) returned 1 [0211.892] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3Z7Oh.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3z7oh.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3Z7Oh.flv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3z7oh.flv.dvodltmf")) returned 0 [0211.893] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3Z7Oh.flv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3z7oh.flv.dvodltmf")) returned 0x20 [0211.893] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3Z7Oh.flv", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d20120, ftCreationTime.dwHighDateTime=0x1d4c6e7, ftLastAccessTime.dwLowDateTime=0xbc53b060, ftLastAccessTime.dwHighDateTime=0x1d4d268, ftLastWriteTime.dwLowDateTime=0xbc53b060, ftLastWriteTime.dwHighDateTime=0x1d4d268, nFileSizeHigh=0x0, nFileSizeLow=0x773c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="3Z7Oh.flv", cAlternateFileName="")) returned 0x2e8458 [0211.893] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d20120, ftCreationTime.dwHighDateTime=0x1d4c6e7, ftLastAccessTime.dwLowDateTime=0xbc53b060, ftLastAccessTime.dwHighDateTime=0x1d4d268, ftLastWriteTime.dwLowDateTime=0xbc53b060, ftLastWriteTime.dwHighDateTime=0x1d4d268, nFileSizeHigh=0x0, nFileSizeLow=0x773c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="3Z7Oh.flv", cAlternateFileName="")) returned 0 [0211.893] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0211.893] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3Z7Oh.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3z7oh.flv")) returned 1 [0211.896] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3Z7Oh.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3z7oh.flv")) returned 0xffffffff [0211.896] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11e2f530, ftCreationTime.dwHighDateTime=0x1d4cc7a, ftLastAccessTime.dwLowDateTime=0xe3d9a610, ftLastAccessTime.dwHighDateTime=0x1d4d29c, ftLastWriteTime.dwLowDateTime=0xe3d9a610, ftLastWriteTime.dwHighDateTime=0x1d4d29c, nFileSizeHigh=0x0, nFileSizeLow=0x39b3, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="4MSGIDZlCWwjJ3mDt.mkv", cAlternateFileName="4MSGID~1.MKV")) returned 1 [0211.896] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\4MSGIDZlCWwjJ3mDt.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\4msgidzlcwwjj3mdt.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0211.896] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\4MSGIDZlCWwjJ3mDt.mkv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\4msgidzlcwwjj3mdt.mkv.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0211.897] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x39b3 [0211.897] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0211.897] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0211.986] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x39b3, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x39b3, lpOverlapped=0x0) returned 1 [0211.987] WriteFile (in: hFile=0xd4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x39c0, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x39c0, lpOverlapped=0x0) returned 1 [0211.988] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0212.008] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0212.018] CloseHandle (hObject=0xd8) returned 1 [0212.018] CloseHandle (hObject=0xd4) returned 1 [0212.018] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\4MSGIDZlCWwjJ3mDt.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\4msgidzlcwwjj3mdt.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\4MSGIDZlCWwjJ3mDt.mkv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\4msgidzlcwwjj3mdt.mkv.dvodltmf")) returned 0 [0212.019] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\4MSGIDZlCWwjJ3mDt.mkv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\4msgidzlcwwjj3mdt.mkv.dvodltmf")) returned 0x20 [0212.019] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\4MSGIDZlCWwjJ3mDt.mkv", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11e2f530, ftCreationTime.dwHighDateTime=0x1d4cc7a, ftLastAccessTime.dwLowDateTime=0xe3d9a610, ftLastAccessTime.dwHighDateTime=0x1d4d29c, ftLastWriteTime.dwLowDateTime=0xe3d9a610, ftLastWriteTime.dwHighDateTime=0x1d4d29c, nFileSizeHigh=0x0, nFileSizeLow=0x39b3, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="4MSGIDZlCWwjJ3mDt.mkv", cAlternateFileName="4MSGID~1.MKV")) returned 0x2e8458 [0212.020] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11e2f530, ftCreationTime.dwHighDateTime=0x1d4cc7a, ftLastAccessTime.dwLowDateTime=0xe3d9a610, ftLastAccessTime.dwHighDateTime=0x1d4d29c, ftLastWriteTime.dwLowDateTime=0xe3d9a610, ftLastWriteTime.dwHighDateTime=0x1d4d29c, nFileSizeHigh=0x0, nFileSizeLow=0x39b3, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="4MSGIDZlCWwjJ3mDt.mkv", cAlternateFileName="4MSGID~1.MKV")) returned 0 [0212.020] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0212.020] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\4MSGIDZlCWwjJ3mDt.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\4msgidzlcwwjj3mdt.mkv")) returned 1 [0212.021] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\4MSGIDZlCWwjJ3mDt.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\4msgidzlcwwjj3mdt.mkv")) returned 0xffffffff [0212.021] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a9cb0e0, ftCreationTime.dwHighDateTime=0x1d4c921, ftLastAccessTime.dwLowDateTime=0x756e4d40, ftLastAccessTime.dwHighDateTime=0x1d4cec1, ftLastWriteTime.dwLowDateTime=0x756e4d40, ftLastWriteTime.dwHighDateTime=0x1d4cec1, nFileSizeHigh=0x0, nFileSizeLow=0xf12c, dwReserved0=0x0, dwReserved1=0x0, cFileName="6eC3qF19PhMh RC.jpg", cAlternateFileName="6EC3QF~1.JPG")) returned 1 [0212.021] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6eC3qF19PhMh RC.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6ec3qf19phmh rc.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0212.022] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6eC3qF19PhMh RC.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6ec3qf19phmh rc.jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0212.022] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf12c [0212.022] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0212.023] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0212.107] ReadFile (in: hFile=0xd4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xf12c, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0xf12c, lpOverlapped=0x0) returned 1 [0212.108] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf130, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0xf130, lpOverlapped=0x0) returned 1 [0212.110] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0212.129] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0212.139] CloseHandle (hObject=0xd4) returned 1 [0212.139] CloseHandle (hObject=0xd8) returned 1 [0212.140] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6eC3qF19PhMh RC.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6ec3qf19phmh rc.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6eC3qF19PhMh RC.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6ec3qf19phmh rc.jpg.dvodltmf")) returned 0 [0212.140] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6eC3qF19PhMh RC.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6ec3qf19phmh rc.jpg.dvodltmf")) returned 0x20 [0212.141] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6eC3qF19PhMh RC.jpg", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a9cb0e0, ftCreationTime.dwHighDateTime=0x1d4c921, ftLastAccessTime.dwLowDateTime=0x756e4d40, ftLastAccessTime.dwHighDateTime=0x1d4cec1, ftLastWriteTime.dwLowDateTime=0x756e4d40, ftLastWriteTime.dwHighDateTime=0x1d4cec1, nFileSizeHigh=0x0, nFileSizeLow=0xf12c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="6eC3qF19PhMh RC.jpg", cAlternateFileName="6EC3QF~1.JPG")) returned 0x2e8458 [0212.141] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a9cb0e0, ftCreationTime.dwHighDateTime=0x1d4c921, ftLastAccessTime.dwLowDateTime=0x756e4d40, ftLastAccessTime.dwHighDateTime=0x1d4cec1, ftLastWriteTime.dwLowDateTime=0x756e4d40, ftLastWriteTime.dwHighDateTime=0x1d4cec1, nFileSizeHigh=0x0, nFileSizeLow=0xf12c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="6eC3qF19PhMh RC.jpg", cAlternateFileName="6EC3QF~1.JPG")) returned 0 [0212.141] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0212.141] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6eC3qF19PhMh RC.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6ec3qf19phmh rc.jpg")) returned 1 [0212.143] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6eC3qF19PhMh RC.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6ec3qf19phmh rc.jpg")) returned 0xffffffff [0212.143] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4440c8c0, ftCreationTime.dwHighDateTime=0x1d4c704, ftLastAccessTime.dwLowDateTime=0xa848a6d0, ftLastAccessTime.dwHighDateTime=0x1d4cb9b, ftLastWriteTime.dwLowDateTime=0xa848a6d0, ftLastWriteTime.dwHighDateTime=0x1d4cb9b, nFileSizeHigh=0x0, nFileSizeLow=0xe058, dwReserved0=0x0, dwReserved1=0x0, cFileName="8jHu2zIm2PF6J76.mp3", cAlternateFileName="8JHU2Z~1.MP3")) returned 1 [0212.143] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8jHu2zIm2PF6J76.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\8jhu2zim2pf6j76.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0212.143] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8jHu2zIm2PF6J76.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\8jhu2zim2pf6j76.mp3.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0212.144] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe058 [0212.144] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0212.144] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0212.229] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe058, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0xe058, lpOverlapped=0x0) returned 1 [0212.231] WriteFile (in: hFile=0xd4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe060, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0xe060, lpOverlapped=0x0) returned 1 [0212.233] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0212.253] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0212.264] CloseHandle (hObject=0xd8) returned 1 [0212.264] CloseHandle (hObject=0xd4) returned 1 [0212.264] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8jHu2zIm2PF6J76.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\8jhu2zim2pf6j76.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8jHu2zIm2PF6J76.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\8jhu2zim2pf6j76.mp3.dvodltmf")) returned 0 [0212.265] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8jHu2zIm2PF6J76.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\8jhu2zim2pf6j76.mp3.dvodltmf")) returned 0x20 [0212.265] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8jHu2zIm2PF6J76.mp3", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4440c8c0, ftCreationTime.dwHighDateTime=0x1d4c704, ftLastAccessTime.dwLowDateTime=0xa848a6d0, ftLastAccessTime.dwHighDateTime=0x1d4cb9b, ftLastWriteTime.dwLowDateTime=0xa848a6d0, ftLastWriteTime.dwHighDateTime=0x1d4cb9b, nFileSizeHigh=0x0, nFileSizeLow=0xe058, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="8jHu2zIm2PF6J76.mp3", cAlternateFileName="8JHU2Z~1.MP3")) returned 0x2e8458 [0212.266] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4440c8c0, ftCreationTime.dwHighDateTime=0x1d4c704, ftLastAccessTime.dwLowDateTime=0xa848a6d0, ftLastAccessTime.dwHighDateTime=0x1d4cb9b, ftLastWriteTime.dwLowDateTime=0xa848a6d0, ftLastWriteTime.dwHighDateTime=0x1d4cb9b, nFileSizeHigh=0x0, nFileSizeLow=0xe058, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="8jHu2zIm2PF6J76.mp3", cAlternateFileName="8JHU2Z~1.MP3")) returned 0 [0212.266] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0212.266] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8jHu2zIm2PF6J76.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\8jhu2zim2pf6j76.mp3")) returned 1 [0212.267] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8jHu2zIm2PF6J76.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\8jhu2zim2pf6j76.mp3")) returned 0xffffffff [0212.267] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfde8adb0, ftCreationTime.dwHighDateTime=0x1d4c61e, ftLastAccessTime.dwLowDateTime=0x981b6ca0, ftLastAccessTime.dwHighDateTime=0x1d4cd32, ftLastWriteTime.dwLowDateTime=0x981b6ca0, ftLastWriteTime.dwHighDateTime=0x1d4cd32, nFileSizeHigh=0x0, nFileSizeLow=0x72ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="8KI_D-7z3bfwjLxD6ua2.rtf", cAlternateFileName="8KI_D-~1.RTF")) returned 1 [0212.267] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8KI_D-7z3bfwjLxD6ua2.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\8ki_d-7z3bfwjlxd6ua2.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0212.267] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8KI_D-7z3bfwjLxD6ua2.rtf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\8ki_d-7z3bfwjlxd6ua2.rtf.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0212.268] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x72ba [0212.269] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0212.269] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0212.353] ReadFile (in: hFile=0xd4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x72ba, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x72ba, lpOverlapped=0x0) returned 1 [0212.354] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x72c0, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x72c0, lpOverlapped=0x0) returned 1 [0212.356] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0212.381] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0212.394] CloseHandle (hObject=0xd4) returned 1 [0212.394] CloseHandle (hObject=0xd8) returned 1 [0212.395] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8KI_D-7z3bfwjLxD6ua2.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\8ki_d-7z3bfwjlxd6ua2.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8KI_D-7z3bfwjLxD6ua2.rtf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\8ki_d-7z3bfwjlxd6ua2.rtf.dvodltmf")) returned 0 [0212.396] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8KI_D-7z3bfwjLxD6ua2.rtf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\8ki_d-7z3bfwjlxd6ua2.rtf.dvodltmf")) returned 0x20 [0212.396] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8KI_D-7z3bfwjLxD6ua2.rtf", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfde8adb0, ftCreationTime.dwHighDateTime=0x1d4c61e, ftLastAccessTime.dwLowDateTime=0x981b6ca0, ftLastAccessTime.dwHighDateTime=0x1d4cd32, ftLastWriteTime.dwLowDateTime=0x981b6ca0, ftLastWriteTime.dwHighDateTime=0x1d4cd32, nFileSizeHigh=0x0, nFileSizeLow=0x72ba, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="8KI_D-7z3bfwjLxD6ua2.rtf", cAlternateFileName="8KI_D-~1.RTF")) returned 0x2e8458 [0212.396] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfde8adb0, ftCreationTime.dwHighDateTime=0x1d4c61e, ftLastAccessTime.dwLowDateTime=0x981b6ca0, ftLastAccessTime.dwHighDateTime=0x1d4cd32, ftLastWriteTime.dwLowDateTime=0x981b6ca0, ftLastWriteTime.dwHighDateTime=0x1d4cd32, nFileSizeHigh=0x0, nFileSizeLow=0x72ba, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="8KI_D-7z3bfwjLxD6ua2.rtf", cAlternateFileName="8KI_D-~1.RTF")) returned 0 [0212.396] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0212.396] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8KI_D-7z3bfwjLxD6ua2.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\8ki_d-7z3bfwjlxd6ua2.rtf")) returned 1 [0212.398] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8KI_D-7z3bfwjLxD6ua2.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\8ki_d-7z3bfwjlxd6ua2.rtf")) returned 0xffffffff [0212.398] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd698fa50, ftCreationTime.dwHighDateTime=0x1d4d47c, ftLastAccessTime.dwLowDateTime=0xb42b4780, ftLastAccessTime.dwHighDateTime=0x1d4cadf, ftLastWriteTime.dwLowDateTime=0xb42b4780, ftLastWriteTime.dwHighDateTime=0x1d4cadf, nFileSizeHigh=0x0, nFileSizeLow=0xf870, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="8_DKhm.gif", cAlternateFileName="")) returned 1 [0212.398] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8_DKhm.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\8_dkhm.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0212.398] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8_DKhm.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\8_dkhm.gif.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0212.399] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf870 [0212.399] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0212.399] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0212.500] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xf870, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0xf870, lpOverlapped=0x0) returned 1 [0212.502] WriteFile (in: hFile=0xd4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf880, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0xf880, lpOverlapped=0x0) returned 1 [0212.503] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0212.523] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0212.533] CloseHandle (hObject=0xd8) returned 1 [0212.533] CloseHandle (hObject=0xd4) returned 1 [0212.533] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8_DKhm.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\8_dkhm.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8_DKhm.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\8_dkhm.gif.dvodltmf")) returned 0 [0212.534] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8_DKhm.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\8_dkhm.gif.dvodltmf")) returned 0x20 [0212.534] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8_DKhm.gif", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd698fa50, ftCreationTime.dwHighDateTime=0x1d4d47c, ftLastAccessTime.dwLowDateTime=0xb42b4780, ftLastAccessTime.dwHighDateTime=0x1d4cadf, ftLastWriteTime.dwLowDateTime=0xb42b4780, ftLastWriteTime.dwHighDateTime=0x1d4cadf, nFileSizeHigh=0x0, nFileSizeLow=0xf870, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="8_DKhm.gif", cAlternateFileName="")) returned 0x2e8458 [0212.534] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd698fa50, ftCreationTime.dwHighDateTime=0x1d4d47c, ftLastAccessTime.dwLowDateTime=0xb42b4780, ftLastAccessTime.dwHighDateTime=0x1d4cadf, ftLastWriteTime.dwLowDateTime=0xb42b4780, ftLastWriteTime.dwHighDateTime=0x1d4cadf, nFileSizeHigh=0x0, nFileSizeLow=0xf870, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="8_DKhm.gif", cAlternateFileName="")) returned 0 [0212.534] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0212.535] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8_DKhm.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\8_dkhm.gif")) returned 1 [0212.536] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8_DKhm.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\8_dkhm.gif")) returned 0xffffffff [0212.536] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x342f010, ftCreationTime.dwHighDateTime=0x1d4d095, ftLastAccessTime.dwLowDateTime=0x69652440, ftLastAccessTime.dwHighDateTime=0x1d4d25b, ftLastWriteTime.dwLowDateTime=0x69652440, ftLastWriteTime.dwHighDateTime=0x1d4d25b, nFileSizeHigh=0x0, nFileSizeLow=0x1510a, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="A6iaStFgDrW2BOZV.gif", cAlternateFileName="A6IAST~1.GIF")) returned 1 [0212.536] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\A6iaStFgDrW2BOZV.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\a6iastfgdrw2bozv.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0212.537] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\A6iaStFgDrW2BOZV.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\a6iastfgdrw2bozv.gif.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0212.537] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1510a [0212.537] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0212.538] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0212.623] ReadFile (in: hFile=0xd4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1510a, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x1510a, lpOverlapped=0x0) returned 1 [0212.624] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x15110, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x15110, lpOverlapped=0x0) returned 1 [0212.628] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0212.648] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0212.659] CloseHandle (hObject=0xd4) returned 1 [0212.659] CloseHandle (hObject=0xd8) returned 1 [0212.659] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\A6iaStFgDrW2BOZV.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\a6iastfgdrw2bozv.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\A6iaStFgDrW2BOZV.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\a6iastfgdrw2bozv.gif.dvodltmf")) returned 0 [0212.660] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\A6iaStFgDrW2BOZV.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\a6iastfgdrw2bozv.gif.dvodltmf")) returned 0x20 [0212.660] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\A6iaStFgDrW2BOZV.gif", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x342f010, ftCreationTime.dwHighDateTime=0x1d4d095, ftLastAccessTime.dwLowDateTime=0x69652440, ftLastAccessTime.dwHighDateTime=0x1d4d25b, ftLastWriteTime.dwLowDateTime=0x69652440, ftLastWriteTime.dwHighDateTime=0x1d4d25b, nFileSizeHigh=0x0, nFileSizeLow=0x1510a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="A6iaStFgDrW2BOZV.gif", cAlternateFileName="A6IAST~1.GIF")) returned 0x2e8458 [0212.660] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x342f010, ftCreationTime.dwHighDateTime=0x1d4d095, ftLastAccessTime.dwLowDateTime=0x69652440, ftLastAccessTime.dwHighDateTime=0x1d4d25b, ftLastWriteTime.dwLowDateTime=0x69652440, ftLastWriteTime.dwHighDateTime=0x1d4d25b, nFileSizeHigh=0x0, nFileSizeLow=0x1510a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="A6iaStFgDrW2BOZV.gif", cAlternateFileName="A6IAST~1.GIF")) returned 0 [0212.660] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0212.660] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\A6iaStFgDrW2BOZV.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\a6iastfgdrw2bozv.gif")) returned 1 [0212.662] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\A6iaStFgDrW2BOZV.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\a6iastfgdrw2bozv.gif")) returned 0xffffffff [0212.662] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6640e430, ftCreationTime.dwHighDateTime=0x1d4cd55, ftLastAccessTime.dwLowDateTime=0xfac025f0, ftLastAccessTime.dwHighDateTime=0x1d4c7bd, ftLastWriteTime.dwLowDateTime=0xfac025f0, ftLastWriteTime.dwHighDateTime=0x1d4c7bd, nFileSizeHigh=0x0, nFileSizeLow=0xf26d, dwReserved0=0x0, dwReserved1=0x0, cFileName="az0q2Si.odt", cAlternateFileName="")) returned 1 [0212.662] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\az0q2Si.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\az0q2si.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0212.662] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\az0q2Si.odt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\az0q2si.odt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0212.663] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf26d [0212.663] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0212.663] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0212.748] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xf26d, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0xf26d, lpOverlapped=0x0) returned 1 [0212.750] WriteFile (in: hFile=0xd4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf270, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0xf270, lpOverlapped=0x0) returned 1 [0212.752] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0212.772] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0212.790] CloseHandle (hObject=0xd8) returned 1 [0212.790] CloseHandle (hObject=0xd4) returned 1 [0212.790] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\az0q2Si.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\az0q2si.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\az0q2Si.odt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\az0q2si.odt.dvodltmf")) returned 0 [0212.791] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\az0q2Si.odt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\az0q2si.odt.dvodltmf")) returned 0x20 [0212.791] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\az0q2Si.odt", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6640e430, ftCreationTime.dwHighDateTime=0x1d4cd55, ftLastAccessTime.dwLowDateTime=0xfac025f0, ftLastAccessTime.dwHighDateTime=0x1d4c7bd, ftLastWriteTime.dwLowDateTime=0xfac025f0, ftLastWriteTime.dwHighDateTime=0x1d4c7bd, nFileSizeHigh=0x0, nFileSizeLow=0xf26d, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="az0q2Si.odt", cAlternateFileName="")) returned 0x2e8458 [0212.791] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6640e430, ftCreationTime.dwHighDateTime=0x1d4cd55, ftLastAccessTime.dwLowDateTime=0xfac025f0, ftLastAccessTime.dwHighDateTime=0x1d4c7bd, ftLastWriteTime.dwLowDateTime=0xfac025f0, ftLastWriteTime.dwHighDateTime=0x1d4c7bd, nFileSizeHigh=0x0, nFileSizeLow=0xf26d, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="az0q2Si.odt", cAlternateFileName="")) returned 0 [0212.791] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0212.791] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\az0q2Si.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\az0q2si.odt")) returned 1 [0212.796] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\az0q2Si.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\az0q2si.odt")) returned 0xffffffff [0212.796] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c94e8e0, ftCreationTime.dwHighDateTime=0x1d4d580, ftLastAccessTime.dwLowDateTime=0x56928b40, ftLastAccessTime.dwHighDateTime=0x1d4ca3c, ftLastWriteTime.dwLowDateTime=0x56928b40, ftLastWriteTime.dwHighDateTime=0x1d4ca3c, nFileSizeHigh=0x0, nFileSizeLow=0x12124, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="bKPyQJpjymh3 ls7X.pdf", cAlternateFileName="BKPYQJ~1.PDF")) returned 1 [0212.796] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bKPyQJpjymh3 ls7X.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bkpyqjpjymh3 ls7x.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0212.796] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bKPyQJpjymh3 ls7X.pdf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bkpyqjpjymh3 ls7x.pdf.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0212.797] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12124 [0212.797] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0212.798] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0212.884] ReadFile (in: hFile=0xd4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x12124, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x12124, lpOverlapped=0x0) returned 1 [0212.886] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x12130, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x12130, lpOverlapped=0x0) returned 1 [0212.888] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0213.033] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0213.043] CloseHandle (hObject=0xd4) returned 1 [0213.043] CloseHandle (hObject=0xd8) returned 1 [0213.148] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bKPyQJpjymh3 ls7X.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bkpyqjpjymh3 ls7x.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bKPyQJpjymh3 ls7X.pdf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bkpyqjpjymh3 ls7x.pdf.dvodltmf")) returned 0 [0213.149] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bKPyQJpjymh3 ls7X.pdf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bkpyqjpjymh3 ls7x.pdf.dvodltmf")) returned 0x20 [0213.149] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bKPyQJpjymh3 ls7X.pdf", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c94e8e0, ftCreationTime.dwHighDateTime=0x1d4d580, ftLastAccessTime.dwLowDateTime=0x56928b40, ftLastAccessTime.dwHighDateTime=0x1d4ca3c, ftLastWriteTime.dwLowDateTime=0x56928b40, ftLastWriteTime.dwHighDateTime=0x1d4ca3c, nFileSizeHigh=0x0, nFileSizeLow=0x12124, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="bKPyQJpjymh3 ls7X.pdf", cAlternateFileName="BKPYQJ~1.PDF")) returned 0x2e8458 [0213.149] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c94e8e0, ftCreationTime.dwHighDateTime=0x1d4d580, ftLastAccessTime.dwLowDateTime=0x56928b40, ftLastAccessTime.dwHighDateTime=0x1d4ca3c, ftLastWriteTime.dwLowDateTime=0x56928b40, ftLastWriteTime.dwHighDateTime=0x1d4ca3c, nFileSizeHigh=0x0, nFileSizeLow=0x12124, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="bKPyQJpjymh3 ls7X.pdf", cAlternateFileName="BKPYQJ~1.PDF")) returned 0 [0213.149] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0213.149] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bKPyQJpjymh3 ls7X.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bkpyqjpjymh3 ls7x.pdf")) returned 1 [0213.152] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bKPyQJpjymh3 ls7X.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bkpyqjpjymh3 ls7x.pdf")) returned 0xffffffff [0213.152] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ffbf500, ftCreationTime.dwHighDateTime=0x1d4d4f9, ftLastAccessTime.dwLowDateTime=0x8b2aedc0, ftLastAccessTime.dwHighDateTime=0x1d4c640, ftLastWriteTime.dwLowDateTime=0x8b2aedc0, ftLastWriteTime.dwHighDateTime=0x1d4c640, nFileSizeHigh=0x0, nFileSizeLow=0xfe97, dwReserved0=0x0, dwReserved1=0x0, cFileName="chgwst6vKL.pps", cAlternateFileName="CHGWST~1.PPS")) returned 1 [0213.153] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\chgwst6vKL.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\chgwst6vkl.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0213.153] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\chgwst6vKL.pps.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\chgwst6vkl.pps.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0213.153] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfe97 [0213.153] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0213.154] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0213.380] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xfe97, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0xfe97, lpOverlapped=0x0) returned 1 [0213.381] WriteFile (in: hFile=0xd4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xfea0, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0xfea0, lpOverlapped=0x0) returned 1 [0213.383] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0213.419] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0213.429] CloseHandle (hObject=0xd8) returned 1 [0213.429] CloseHandle (hObject=0xd4) returned 1 [0213.429] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\chgwst6vKL.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\chgwst6vkl.pps"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\chgwst6vKL.pps.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\chgwst6vkl.pps.dvodltmf")) returned 0 [0213.430] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\chgwst6vKL.pps.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\chgwst6vkl.pps.dvodltmf")) returned 0x20 [0213.430] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\chgwst6vKL.pps", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ffbf500, ftCreationTime.dwHighDateTime=0x1d4d4f9, ftLastAccessTime.dwLowDateTime=0x8b2aedc0, ftLastAccessTime.dwHighDateTime=0x1d4c640, ftLastWriteTime.dwLowDateTime=0x8b2aedc0, ftLastWriteTime.dwHighDateTime=0x1d4c640, nFileSizeHigh=0x0, nFileSizeLow=0xfe97, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="chgwst6vKL.pps", cAlternateFileName="CHGWST~1.PPS")) returned 0x2e8458 [0213.430] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ffbf500, ftCreationTime.dwHighDateTime=0x1d4d4f9, ftLastAccessTime.dwLowDateTime=0x8b2aedc0, ftLastAccessTime.dwHighDateTime=0x1d4c640, ftLastWriteTime.dwLowDateTime=0x8b2aedc0, ftLastWriteTime.dwHighDateTime=0x1d4c640, nFileSizeHigh=0x0, nFileSizeLow=0xfe97, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="chgwst6vKL.pps", cAlternateFileName="CHGWST~1.PPS")) returned 0 [0213.430] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0213.430] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\chgwst6vKL.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\chgwst6vkl.pps")) returned 1 [0213.432] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\chgwst6vKL.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\chgwst6vkl.pps")) returned 0xffffffff [0213.432] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ca8c3c0, ftCreationTime.dwHighDateTime=0x1d4c790, ftLastAccessTime.dwLowDateTime=0x1fc8470, ftLastAccessTime.dwHighDateTime=0x1d4cb52, ftLastWriteTime.dwLowDateTime=0x1fc8470, ftLastWriteTime.dwHighDateTime=0x1d4cb52, nFileSizeHigh=0x0, nFileSizeLow=0xb8a, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="culY42q.wav", cAlternateFileName="")) returned 1 [0213.432] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\culY42q.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\culy42q.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0213.432] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\culY42q.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\culy42q.wav.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0213.433] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb8a [0213.433] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0213.433] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0213.550] ReadFile (in: hFile=0xd4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb8a, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0xb8a, lpOverlapped=0x0) returned 1 [0213.550] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0xb90, lpOverlapped=0x0) returned 1 [0213.551] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0213.574] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0213.586] CloseHandle (hObject=0xd4) returned 1 [0213.586] CloseHandle (hObject=0xd8) returned 1 [0213.586] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\culY42q.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\culy42q.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\culY42q.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\culy42q.wav.dvodltmf")) returned 0 [0213.587] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\culY42q.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\culy42q.wav.dvodltmf")) returned 0x20 [0213.587] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\culY42q.wav", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ca8c3c0, ftCreationTime.dwHighDateTime=0x1d4c790, ftLastAccessTime.dwLowDateTime=0x1fc8470, ftLastAccessTime.dwHighDateTime=0x1d4cb52, ftLastWriteTime.dwLowDateTime=0x1fc8470, ftLastWriteTime.dwHighDateTime=0x1d4cb52, nFileSizeHigh=0x0, nFileSizeLow=0xb8a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="culY42q.wav", cAlternateFileName="")) returned 0x2e8458 [0213.588] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ca8c3c0, ftCreationTime.dwHighDateTime=0x1d4c790, ftLastAccessTime.dwLowDateTime=0x1fc8470, ftLastAccessTime.dwHighDateTime=0x1d4cb52, ftLastWriteTime.dwLowDateTime=0x1fc8470, ftLastWriteTime.dwHighDateTime=0x1d4cb52, nFileSizeHigh=0x0, nFileSizeLow=0xb8a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="culY42q.wav", cAlternateFileName="")) returned 0 [0213.588] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0213.588] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\culY42q.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\culy42q.wav")) returned 1 [0213.589] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\culY42q.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\culy42q.wav")) returned 0xffffffff [0213.589] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0213.589] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0213.589] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0213.590] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11a [0213.590] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0213.591] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0213.691] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x11a, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x11a, lpOverlapped=0x0) returned 1 [0213.691] WriteFile (in: hFile=0xd4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x120, lpOverlapped=0x0) returned 1 [0213.692] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0213.713] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0213.723] CloseHandle (hObject=0xd8) returned 1 [0213.723] CloseHandle (hObject=0xd4) returned 1 [0213.723] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\desktop.ini.dvodltmf")) returned 0 [0213.724] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\desktop.ini.dvodltmf")) returned 0x20 [0213.724] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8458 [0213.724] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0213.724] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0213.725] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\desktop.ini")) returned 1 [0213.725] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\desktop.ini")) returned 0xffffffff [0213.725] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2be43540, ftCreationTime.dwHighDateTime=0x1d4ce62, ftLastAccessTime.dwLowDateTime=0x77829480, ftLastAccessTime.dwHighDateTime=0x1d4cd93, ftLastWriteTime.dwLowDateTime=0x77829480, ftLastWriteTime.dwHighDateTime=0x1d4cd93, nFileSizeHigh=0x0, nFileSizeLow=0x174c0, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="djnZYFl1eRGz-4XF4Bnz.doc", cAlternateFileName="DJNZYF~1.DOC")) returned 1 [0213.725] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\djnZYFl1eRGz-4XF4Bnz.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\djnzyfl1ergz-4xf4bnz.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0213.726] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\djnZYFl1eRGz-4XF4Bnz.doc.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\djnzyfl1ergz-4xf4bnz.doc.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0213.726] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x174c0 [0213.726] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0213.727] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0213.820] ReadFile (in: hFile=0xd4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x174c0, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x174c0, lpOverlapped=0x0) returned 1 [0213.821] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x174d0, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x174d0, lpOverlapped=0x0) returned 1 [0213.827] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0213.846] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0213.856] CloseHandle (hObject=0xd4) returned 1 [0213.856] CloseHandle (hObject=0xd8) returned 1 [0213.856] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\djnZYFl1eRGz-4XF4Bnz.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\djnzyfl1ergz-4xf4bnz.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\djnZYFl1eRGz-4XF4Bnz.doc.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\djnzyfl1ergz-4xf4bnz.doc.dvodltmf")) returned 0 [0213.857] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\djnZYFl1eRGz-4XF4Bnz.doc.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\djnzyfl1ergz-4xf4bnz.doc.dvodltmf")) returned 0x20 [0213.857] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\djnZYFl1eRGz-4XF4Bnz.doc", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2be43540, ftCreationTime.dwHighDateTime=0x1d4ce62, ftLastAccessTime.dwLowDateTime=0x77829480, ftLastAccessTime.dwHighDateTime=0x1d4cd93, ftLastWriteTime.dwLowDateTime=0x77829480, ftLastWriteTime.dwHighDateTime=0x1d4cd93, nFileSizeHigh=0x0, nFileSizeLow=0x174c0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="djnZYFl1eRGz-4XF4Bnz.doc", cAlternateFileName="DJNZYF~1.DOC")) returned 0x2e8458 [0213.857] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2be43540, ftCreationTime.dwHighDateTime=0x1d4ce62, ftLastAccessTime.dwLowDateTime=0x77829480, ftLastAccessTime.dwHighDateTime=0x1d4cd93, ftLastWriteTime.dwLowDateTime=0x77829480, ftLastWriteTime.dwHighDateTime=0x1d4cd93, nFileSizeHigh=0x0, nFileSizeLow=0x174c0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="djnZYFl1eRGz-4XF4Bnz.doc", cAlternateFileName="DJNZYF~1.DOC")) returned 0 [0213.857] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0213.858] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\djnZYFl1eRGz-4XF4Bnz.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\djnzyfl1ergz-4xf4bnz.doc")) returned 1 [0213.860] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\djnZYFl1eRGz-4XF4Bnz.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\djnzyfl1ergz-4xf4bnz.doc")) returned 0xffffffff [0213.860] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd356e880, ftCreationTime.dwHighDateTime=0x1d4cd46, ftLastAccessTime.dwLowDateTime=0x4c335190, ftLastAccessTime.dwHighDateTime=0x1d4d11f, ftLastWriteTime.dwLowDateTime=0x4c335190, ftLastWriteTime.dwHighDateTime=0x1d4d11f, nFileSizeHigh=0x0, nFileSizeLow=0x18f08, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="Dp1OBqpReW5YadtHZRss.m4a", cAlternateFileName="DP1OBQ~1.M4A")) returned 1 [0213.860] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Dp1OBqpReW5YadtHZRss.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dp1obqprew5yadthzrss.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0213.860] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Dp1OBqpReW5YadtHZRss.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dp1obqprew5yadthzrss.m4a.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0213.861] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18f08 [0213.861] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0213.861] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0213.946] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x18f08, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x18f08, lpOverlapped=0x0) returned 1 [0213.949] WriteFile (in: hFile=0xd4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x18f10, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x18f10, lpOverlapped=0x0) returned 1 [0213.951] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0213.971] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0213.981] CloseHandle (hObject=0xd8) returned 1 [0213.981] CloseHandle (hObject=0xd4) returned 1 [0213.981] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Dp1OBqpReW5YadtHZRss.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dp1obqprew5yadthzrss.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Dp1OBqpReW5YadtHZRss.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dp1obqprew5yadthzrss.m4a.dvodltmf")) returned 0 [0213.982] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Dp1OBqpReW5YadtHZRss.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dp1obqprew5yadthzrss.m4a.dvodltmf")) returned 0x20 [0213.982] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Dp1OBqpReW5YadtHZRss.m4a", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd356e880, ftCreationTime.dwHighDateTime=0x1d4cd46, ftLastAccessTime.dwLowDateTime=0x4c335190, ftLastAccessTime.dwHighDateTime=0x1d4d11f, ftLastWriteTime.dwLowDateTime=0x4c335190, ftLastWriteTime.dwHighDateTime=0x1d4d11f, nFileSizeHigh=0x0, nFileSizeLow=0x18f08, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Dp1OBqpReW5YadtHZRss.m4a", cAlternateFileName="DP1OBQ~1.M4A")) returned 0x2e8458 [0213.982] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd356e880, ftCreationTime.dwHighDateTime=0x1d4cd46, ftLastAccessTime.dwLowDateTime=0x4c335190, ftLastAccessTime.dwHighDateTime=0x1d4d11f, ftLastWriteTime.dwLowDateTime=0x4c335190, ftLastWriteTime.dwHighDateTime=0x1d4d11f, nFileSizeHigh=0x0, nFileSizeLow=0x18f08, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Dp1OBqpReW5YadtHZRss.m4a", cAlternateFileName="DP1OBQ~1.M4A")) returned 0 [0213.982] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0213.982] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Dp1OBqpReW5YadtHZRss.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dp1obqprew5yadthzrss.m4a")) returned 1 [0213.984] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Dp1OBqpReW5YadtHZRss.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dp1obqprew5yadthzrss.m4a")) returned 0xffffffff [0213.984] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd468a720, ftCreationTime.dwHighDateTime=0x1d4d0ea, ftLastAccessTime.dwLowDateTime=0xe99e0a0, ftLastAccessTime.dwHighDateTime=0x1d4c617, ftLastWriteTime.dwLowDateTime=0xe99e0a0, ftLastWriteTime.dwHighDateTime=0x1d4c617, nFileSizeHigh=0x0, nFileSizeLow=0x1cd5, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="dw1xSD.gif", cAlternateFileName="")) returned 1 [0213.984] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dw1xSD.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dw1xsd.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0213.984] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dw1xSD.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dw1xsd.gif.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0213.985] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1cd5 [0213.985] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0213.985] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0214.078] ReadFile (in: hFile=0xd4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1cd5, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x1cd5, lpOverlapped=0x0) returned 1 [0214.079] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x1ce0, lpOverlapped=0x0) returned 1 [0214.080] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0214.101] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.111] CloseHandle (hObject=0xd4) returned 1 [0214.111] CloseHandle (hObject=0xd8) returned 1 [0214.111] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dw1xSD.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dw1xsd.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dw1xSD.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dw1xsd.gif.dvodltmf")) returned 0 [0214.112] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dw1xSD.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dw1xsd.gif.dvodltmf")) returned 0x20 [0214.112] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dw1xSD.gif", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd468a720, ftCreationTime.dwHighDateTime=0x1d4d0ea, ftLastAccessTime.dwLowDateTime=0xe99e0a0, ftLastAccessTime.dwHighDateTime=0x1d4c617, ftLastWriteTime.dwLowDateTime=0xe99e0a0, ftLastWriteTime.dwHighDateTime=0x1d4c617, nFileSizeHigh=0x0, nFileSizeLow=0x1cd5, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="dw1xSD.gif", cAlternateFileName="")) returned 0x2e8458 [0214.113] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd468a720, ftCreationTime.dwHighDateTime=0x1d4d0ea, ftLastAccessTime.dwLowDateTime=0xe99e0a0, ftLastAccessTime.dwHighDateTime=0x1d4c617, ftLastWriteTime.dwLowDateTime=0xe99e0a0, ftLastWriteTime.dwHighDateTime=0x1d4c617, nFileSizeHigh=0x0, nFileSizeLow=0x1cd5, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="dw1xSD.gif", cAlternateFileName="")) returned 0 [0214.113] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0214.113] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dw1xSD.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dw1xsd.gif")) returned 1 [0214.114] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dw1xSD.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dw1xsd.gif")) returned 0xffffffff [0214.114] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9221c180, ftCreationTime.dwHighDateTime=0x1d4c794, ftLastAccessTime.dwLowDateTime=0xb27e90f0, ftLastAccessTime.dwHighDateTime=0x1d4cbe7, ftLastWriteTime.dwLowDateTime=0xb27e90f0, ftLastWriteTime.dwHighDateTime=0x1d4cbe7, nFileSizeHigh=0x0, nFileSizeLow=0x22aa, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="Jeh2.m4a", cAlternateFileName="")) returned 1 [0214.114] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jeh2.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jeh2.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0214.114] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jeh2.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jeh2.m4a.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0214.115] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x22aa [0214.115] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0214.115] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0214.203] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x22aa, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x22aa, lpOverlapped=0x0) returned 1 [0214.203] WriteFile (in: hFile=0xd4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x22b0, lpOverlapped=0x0) returned 1 [0214.204] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0214.224] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.234] CloseHandle (hObject=0xd8) returned 1 [0214.234] CloseHandle (hObject=0xd4) returned 1 [0214.235] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jeh2.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jeh2.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jeh2.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jeh2.m4a.dvodltmf")) returned 0 [0214.236] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jeh2.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jeh2.m4a.dvodltmf")) returned 0x20 [0214.236] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jeh2.m4a", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9221c180, ftCreationTime.dwHighDateTime=0x1d4c794, ftLastAccessTime.dwLowDateTime=0xb27e90f0, ftLastAccessTime.dwHighDateTime=0x1d4cbe7, ftLastWriteTime.dwLowDateTime=0xb27e90f0, ftLastWriteTime.dwHighDateTime=0x1d4cbe7, nFileSizeHigh=0x0, nFileSizeLow=0x22aa, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Jeh2.m4a", cAlternateFileName="")) returned 0x2e8458 [0214.236] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9221c180, ftCreationTime.dwHighDateTime=0x1d4c794, ftLastAccessTime.dwLowDateTime=0xb27e90f0, ftLastAccessTime.dwHighDateTime=0x1d4cbe7, ftLastWriteTime.dwLowDateTime=0xb27e90f0, ftLastWriteTime.dwHighDateTime=0x1d4cbe7, nFileSizeHigh=0x0, nFileSizeLow=0x22aa, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Jeh2.m4a", cAlternateFileName="")) returned 0 [0214.236] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0214.236] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jeh2.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jeh2.m4a")) returned 1 [0214.237] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jeh2.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jeh2.m4a")) returned 0xffffffff [0214.237] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9117d9d0, ftCreationTime.dwHighDateTime=0x1d4d501, ftLastAccessTime.dwLowDateTime=0xff819490, ftLastAccessTime.dwHighDateTime=0x1d4c6cb, ftLastWriteTime.dwLowDateTime=0xff819490, ftLastWriteTime.dwHighDateTime=0x1d4c6cb, nFileSizeHigh=0x0, nFileSizeLow=0x805a, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="KA2pOeYmbRArI.jpg", cAlternateFileName="KA2POE~1.JPG")) returned 1 [0214.237] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KA2pOeYmbRArI.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ka2poeymbrari.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0214.237] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KA2pOeYmbRArI.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ka2poeymbrari.jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0214.238] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x805a [0214.238] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0214.238] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0214.327] ReadFile (in: hFile=0xd4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x805a, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x805a, lpOverlapped=0x0) returned 1 [0214.327] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x8060, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x8060, lpOverlapped=0x0) returned 1 [0214.329] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0214.349] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.467] CloseHandle (hObject=0xd4) returned 1 [0214.467] CloseHandle (hObject=0xd8) returned 1 [0214.468] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KA2pOeYmbRArI.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ka2poeymbrari.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KA2pOeYmbRArI.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ka2poeymbrari.jpg.dvodltmf")) returned 0 [0214.469] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KA2pOeYmbRArI.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ka2poeymbrari.jpg.dvodltmf")) returned 0x20 [0214.469] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KA2pOeYmbRArI.jpg", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9117d9d0, ftCreationTime.dwHighDateTime=0x1d4d501, ftLastAccessTime.dwLowDateTime=0xff819490, ftLastAccessTime.dwHighDateTime=0x1d4c6cb, ftLastWriteTime.dwLowDateTime=0xff819490, ftLastWriteTime.dwHighDateTime=0x1d4c6cb, nFileSizeHigh=0x0, nFileSizeLow=0x805a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="KA2pOeYmbRArI.jpg", cAlternateFileName="KA2POE~1.JPG")) returned 0x2e8458 [0214.469] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9117d9d0, ftCreationTime.dwHighDateTime=0x1d4d501, ftLastAccessTime.dwLowDateTime=0xff819490, ftLastAccessTime.dwHighDateTime=0x1d4c6cb, ftLastWriteTime.dwLowDateTime=0xff819490, ftLastWriteTime.dwHighDateTime=0x1d4c6cb, nFileSizeHigh=0x0, nFileSizeLow=0x805a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="KA2pOeYmbRArI.jpg", cAlternateFileName="KA2POE~1.JPG")) returned 0 [0214.469] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0214.469] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KA2pOeYmbRArI.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ka2poeymbrari.jpg")) returned 1 [0214.471] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KA2pOeYmbRArI.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ka2poeymbrari.jpg")) returned 0xffffffff [0214.471] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5ae0b70, ftCreationTime.dwHighDateTime=0x1d4c591, ftLastAccessTime.dwLowDateTime=0xececf8d0, ftLastAccessTime.dwHighDateTime=0x1d4c98a, ftLastWriteTime.dwLowDateTime=0xececf8d0, ftLastWriteTime.dwHighDateTime=0x1d4c98a, nFileSizeHigh=0x0, nFileSizeLow=0x1149f, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="kZ-Y6eKdk-Bibs.flv", cAlternateFileName="KZ-Y6E~1.FLV")) returned 1 [0214.471] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kZ-Y6eKdk-Bibs.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kz-y6ekdk-bibs.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0214.471] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kZ-Y6eKdk-Bibs.flv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kz-y6ekdk-bibs.flv.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0214.472] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1149f [0214.472] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0214.472] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0214.563] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1149f, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x1149f, lpOverlapped=0x0) returned 1 [0214.564] WriteFile (in: hFile=0xd4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x114a0, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x114a0, lpOverlapped=0x0) returned 1 [0214.566] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0214.586] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.607] CloseHandle (hObject=0xd8) returned 1 [0214.607] CloseHandle (hObject=0xd4) returned 1 [0214.608] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kZ-Y6eKdk-Bibs.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kz-y6ekdk-bibs.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kZ-Y6eKdk-Bibs.flv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kz-y6ekdk-bibs.flv.dvodltmf")) returned 0 [0214.608] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kZ-Y6eKdk-Bibs.flv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kz-y6ekdk-bibs.flv.dvodltmf")) returned 0x20 [0214.609] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kZ-Y6eKdk-Bibs.flv", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5ae0b70, ftCreationTime.dwHighDateTime=0x1d4c591, ftLastAccessTime.dwLowDateTime=0xececf8d0, ftLastAccessTime.dwHighDateTime=0x1d4c98a, ftLastWriteTime.dwLowDateTime=0xececf8d0, ftLastWriteTime.dwHighDateTime=0x1d4c98a, nFileSizeHigh=0x0, nFileSizeLow=0x1149f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="kZ-Y6eKdk-Bibs.flv", cAlternateFileName="KZ-Y6E~1.FLV")) returned 0x2e8458 [0214.609] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5ae0b70, ftCreationTime.dwHighDateTime=0x1d4c591, ftLastAccessTime.dwLowDateTime=0xececf8d0, ftLastAccessTime.dwHighDateTime=0x1d4c98a, ftLastWriteTime.dwLowDateTime=0xececf8d0, ftLastWriteTime.dwHighDateTime=0x1d4c98a, nFileSizeHigh=0x0, nFileSizeLow=0x1149f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="kZ-Y6eKdk-Bibs.flv", cAlternateFileName="KZ-Y6E~1.FLV")) returned 0 [0214.609] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0214.609] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kZ-Y6eKdk-Bibs.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kz-y6ekdk-bibs.flv")) returned 1 [0214.611] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kZ-Y6eKdk-Bibs.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kz-y6ekdk-bibs.flv")) returned 0xffffffff [0214.611] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cc2ebe0, ftCreationTime.dwHighDateTime=0x1d4ccf6, ftLastAccessTime.dwLowDateTime=0xdf439e60, ftLastAccessTime.dwHighDateTime=0x1d4d087, ftLastWriteTime.dwLowDateTime=0xdf439e60, ftLastWriteTime.dwHighDateTime=0x1d4d087, nFileSizeHigh=0x0, nFileSizeLow=0x7644, dwReserved0=0x0, dwReserved1=0x0, cFileName="L02tp5dfFU.jpg", cAlternateFileName="L02TP5~1.JPG")) returned 1 [0214.611] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\L02tp5dfFU.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\l02tp5dffu.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0214.611] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\L02tp5dfFU.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\l02tp5dffu.jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0214.612] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7644 [0214.612] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0214.612] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0214.721] ReadFile (in: hFile=0xd4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x7644, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x7644, lpOverlapped=0x0) returned 1 [0214.721] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x7650, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x7650, lpOverlapped=0x0) returned 1 [0214.722] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0214.743] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.753] CloseHandle (hObject=0xd4) returned 1 [0214.754] CloseHandle (hObject=0xd8) returned 1 [0214.754] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\L02tp5dfFU.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\l02tp5dffu.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\L02tp5dfFU.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\l02tp5dffu.jpg.dvodltmf")) returned 0 [0214.755] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\L02tp5dfFU.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\l02tp5dffu.jpg.dvodltmf")) returned 0x20 [0214.755] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\L02tp5dfFU.jpg", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cc2ebe0, ftCreationTime.dwHighDateTime=0x1d4ccf6, ftLastAccessTime.dwLowDateTime=0xdf439e60, ftLastAccessTime.dwHighDateTime=0x1d4d087, ftLastWriteTime.dwLowDateTime=0xdf439e60, ftLastWriteTime.dwHighDateTime=0x1d4d087, nFileSizeHigh=0x0, nFileSizeLow=0x7644, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="L02tp5dfFU.jpg", cAlternateFileName="L02TP5~1.JPG")) returned 0x2e8458 [0214.755] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cc2ebe0, ftCreationTime.dwHighDateTime=0x1d4ccf6, ftLastAccessTime.dwLowDateTime=0xdf439e60, ftLastAccessTime.dwHighDateTime=0x1d4d087, ftLastWriteTime.dwLowDateTime=0xdf439e60, ftLastWriteTime.dwHighDateTime=0x1d4d087, nFileSizeHigh=0x0, nFileSizeLow=0x7644, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="L02tp5dfFU.jpg", cAlternateFileName="L02TP5~1.JPG")) returned 0 [0214.755] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0214.756] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\L02tp5dfFU.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\l02tp5dffu.jpg")) returned 1 [0214.757] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\L02tp5dfFU.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\l02tp5dffu.jpg")) returned 0xffffffff [0214.757] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9018a00, ftCreationTime.dwHighDateTime=0x1d4d351, ftLastAccessTime.dwLowDateTime=0xce813ee0, ftLastAccessTime.dwHighDateTime=0x1d4cc25, ftLastWriteTime.dwLowDateTime=0xce813ee0, ftLastWriteTime.dwHighDateTime=0x1d4cc25, nFileSizeHigh=0x0, nFileSizeLow=0x12d1e, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="meRGDonQiiIA.jpg", cAlternateFileName="MERGDO~1.JPG")) returned 1 [0214.757] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\meRGDonQiiIA.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mergdonqiiia.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0214.757] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\meRGDonQiiIA.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mergdonqiiia.jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0214.758] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12d1e [0214.759] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0214.759] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0214.868] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x12d1e, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x12d1e, lpOverlapped=0x0) returned 1 [0214.870] WriteFile (in: hFile=0xd4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x12d20, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x12d20, lpOverlapped=0x0) returned 1 [0214.872] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0214.895] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.906] CloseHandle (hObject=0xd8) returned 1 [0214.906] CloseHandle (hObject=0xd4) returned 1 [0214.907] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\meRGDonQiiIA.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mergdonqiiia.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\meRGDonQiiIA.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mergdonqiiia.jpg.dvodltmf")) returned 0 [0214.908] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\meRGDonQiiIA.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mergdonqiiia.jpg.dvodltmf")) returned 0x20 [0214.908] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\meRGDonQiiIA.jpg", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9018a00, ftCreationTime.dwHighDateTime=0x1d4d351, ftLastAccessTime.dwLowDateTime=0xce813ee0, ftLastAccessTime.dwHighDateTime=0x1d4cc25, ftLastWriteTime.dwLowDateTime=0xce813ee0, ftLastWriteTime.dwHighDateTime=0x1d4cc25, nFileSizeHigh=0x0, nFileSizeLow=0x12d1e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="meRGDonQiiIA.jpg", cAlternateFileName="MERGDO~1.JPG")) returned 0x2e8458 [0214.908] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9018a00, ftCreationTime.dwHighDateTime=0x1d4d351, ftLastAccessTime.dwLowDateTime=0xce813ee0, ftLastAccessTime.dwHighDateTime=0x1d4cc25, ftLastWriteTime.dwLowDateTime=0xce813ee0, ftLastWriteTime.dwHighDateTime=0x1d4cc25, nFileSizeHigh=0x0, nFileSizeLow=0x12d1e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="meRGDonQiiIA.jpg", cAlternateFileName="MERGDO~1.JPG")) returned 0 [0214.908] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0214.908] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\meRGDonQiiIA.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mergdonqiiia.jpg")) returned 1 [0214.910] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\meRGDonQiiIA.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mergdonqiiia.jpg")) returned 0xffffffff [0214.911] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafc73920, ftCreationTime.dwHighDateTime=0x1d4cbe7, ftLastAccessTime.dwLowDateTime=0xee3ef920, ftLastAccessTime.dwHighDateTime=0x1d4cadb, ftLastWriteTime.dwLowDateTime=0xee3ef920, ftLastWriteTime.dwHighDateTime=0x1d4cadb, nFileSizeHigh=0x0, nFileSizeLow=0x4988, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="mNsVMqc_Q8ILW.ots", cAlternateFileName="MNSVMQ~1.OTS")) returned 1 [0214.911] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mNsVMqc_Q8ILW.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mnsvmqc_q8ilw.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0214.911] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mNsVMqc_Q8ILW.ots.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mnsvmqc_q8ilw.ots.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0214.912] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4988 [0214.912] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0214.912] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0215.004] ReadFile (in: hFile=0xd4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4988, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x4988, lpOverlapped=0x0) returned 1 [0215.005] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4990, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x4990, lpOverlapped=0x0) returned 1 [0215.006] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0215.030] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.041] CloseHandle (hObject=0xd4) returned 1 [0215.041] CloseHandle (hObject=0xd8) returned 1 [0215.041] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mNsVMqc_Q8ILW.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mnsvmqc_q8ilw.ots"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mNsVMqc_Q8ILW.ots.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mnsvmqc_q8ilw.ots.dvodltmf")) returned 0 [0215.042] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mNsVMqc_Q8ILW.ots.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mnsvmqc_q8ilw.ots.dvodltmf")) returned 0x20 [0215.042] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mNsVMqc_Q8ILW.ots", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafc73920, ftCreationTime.dwHighDateTime=0x1d4cbe7, ftLastAccessTime.dwLowDateTime=0xee3ef920, ftLastAccessTime.dwHighDateTime=0x1d4cadb, ftLastWriteTime.dwLowDateTime=0xee3ef920, ftLastWriteTime.dwHighDateTime=0x1d4cadb, nFileSizeHigh=0x0, nFileSizeLow=0x4988, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="mNsVMqc_Q8ILW.ots", cAlternateFileName="MNSVMQ~1.OTS")) returned 0x2e8458 [0215.043] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafc73920, ftCreationTime.dwHighDateTime=0x1d4cbe7, ftLastAccessTime.dwLowDateTime=0xee3ef920, ftLastAccessTime.dwHighDateTime=0x1d4cadb, ftLastWriteTime.dwLowDateTime=0xee3ef920, ftLastWriteTime.dwHighDateTime=0x1d4cadb, nFileSizeHigh=0x0, nFileSizeLow=0x4988, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="mNsVMqc_Q8ILW.ots", cAlternateFileName="MNSVMQ~1.OTS")) returned 0 [0215.043] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0215.043] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mNsVMqc_Q8ILW.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mnsvmqc_q8ilw.ots")) returned 1 [0215.044] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mNsVMqc_Q8ILW.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mnsvmqc_q8ilw.ots")) returned 0xffffffff [0215.044] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c534ac0, ftCreationTime.dwHighDateTime=0x1d4c820, ftLastAccessTime.dwLowDateTime=0xf06cd620, ftLastAccessTime.dwHighDateTime=0x1d4ce7f, ftLastWriteTime.dwLowDateTime=0xf06cd620, ftLastWriteTime.dwHighDateTime=0x1d4ce7f, nFileSizeHigh=0x0, nFileSizeLow=0x3d5d, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="NsKO4YZ3AU1H5XD.jpg", cAlternateFileName="NSKO4Y~1.JPG")) returned 1 [0215.044] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NsKO4YZ3AU1H5XD.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nsko4yz3au1h5xd.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0215.044] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NsKO4YZ3AU1H5XD.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nsko4yz3au1h5xd.jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0215.045] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d5d [0215.045] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0215.046] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0215.135] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3d5d, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x3d5d, lpOverlapped=0x0) returned 1 [0215.135] WriteFile (in: hFile=0xd4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x3d60, lpOverlapped=0x0) returned 1 [0215.137] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0215.162] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.173] CloseHandle (hObject=0xd8) returned 1 [0215.174] CloseHandle (hObject=0xd4) returned 1 [0215.174] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NsKO4YZ3AU1H5XD.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nsko4yz3au1h5xd.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NsKO4YZ3AU1H5XD.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nsko4yz3au1h5xd.jpg.dvodltmf")) returned 0 [0215.175] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NsKO4YZ3AU1H5XD.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nsko4yz3au1h5xd.jpg.dvodltmf")) returned 0x20 [0215.175] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NsKO4YZ3AU1H5XD.jpg", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c534ac0, ftCreationTime.dwHighDateTime=0x1d4c820, ftLastAccessTime.dwLowDateTime=0xf06cd620, ftLastAccessTime.dwHighDateTime=0x1d4ce7f, ftLastWriteTime.dwLowDateTime=0xf06cd620, ftLastWriteTime.dwHighDateTime=0x1d4ce7f, nFileSizeHigh=0x0, nFileSizeLow=0x3d5d, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="NsKO4YZ3AU1H5XD.jpg", cAlternateFileName="NSKO4Y~1.JPG")) returned 0x2e8458 [0215.175] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c534ac0, ftCreationTime.dwHighDateTime=0x1d4c820, ftLastAccessTime.dwLowDateTime=0xf06cd620, ftLastAccessTime.dwHighDateTime=0x1d4ce7f, ftLastWriteTime.dwLowDateTime=0xf06cd620, ftLastWriteTime.dwHighDateTime=0x1d4ce7f, nFileSizeHigh=0x0, nFileSizeLow=0x3d5d, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="NsKO4YZ3AU1H5XD.jpg", cAlternateFileName="NSKO4Y~1.JPG")) returned 0 [0215.175] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0215.175] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NsKO4YZ3AU1H5XD.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nsko4yz3au1h5xd.jpg")) returned 1 [0215.177] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NsKO4YZ3AU1H5XD.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nsko4yz3au1h5xd.jpg")) returned 0xffffffff [0215.177] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd23c5e0, ftCreationTime.dwHighDateTime=0x1d4d311, ftLastAccessTime.dwLowDateTime=0xa2eafc30, ftLastAccessTime.dwHighDateTime=0x1d4c9f0, ftLastWriteTime.dwLowDateTime=0xa2eafc30, ftLastWriteTime.dwHighDateTime=0x1d4c9f0, nFileSizeHigh=0x0, nFileSizeLow=0xecd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="O9wse7c.bmp", cAlternateFileName="")) returned 1 [0215.177] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\O9wse7c.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\o9wse7c.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0215.177] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\O9wse7c.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\o9wse7c.bmp.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0215.178] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xecd8 [0215.178] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0215.178] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0215.268] ReadFile (in: hFile=0xd4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xecd8, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0xecd8, lpOverlapped=0x0) returned 1 [0215.269] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xece0, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0xece0, lpOverlapped=0x0) returned 1 [0215.271] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0215.294] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.305] CloseHandle (hObject=0xd4) returned 1 [0215.305] CloseHandle (hObject=0xd8) returned 1 [0215.306] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\O9wse7c.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\o9wse7c.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\O9wse7c.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\o9wse7c.bmp.dvodltmf")) returned 0 [0215.307] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\O9wse7c.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\o9wse7c.bmp.dvodltmf")) returned 0x20 [0215.307] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\O9wse7c.bmp", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd23c5e0, ftCreationTime.dwHighDateTime=0x1d4d311, ftLastAccessTime.dwLowDateTime=0xa2eafc30, ftLastAccessTime.dwHighDateTime=0x1d4c9f0, ftLastWriteTime.dwLowDateTime=0xa2eafc30, ftLastWriteTime.dwHighDateTime=0x1d4c9f0, nFileSizeHigh=0x0, nFileSizeLow=0xecd8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="O9wse7c.bmp", cAlternateFileName="")) returned 0x2e8458 [0215.307] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd23c5e0, ftCreationTime.dwHighDateTime=0x1d4d311, ftLastAccessTime.dwLowDateTime=0xa2eafc30, ftLastAccessTime.dwHighDateTime=0x1d4c9f0, ftLastWriteTime.dwLowDateTime=0xa2eafc30, ftLastWriteTime.dwHighDateTime=0x1d4c9f0, nFileSizeHigh=0x0, nFileSizeLow=0xecd8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="O9wse7c.bmp", cAlternateFileName="")) returned 0 [0215.307] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0215.307] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\O9wse7c.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\o9wse7c.bmp")) returned 1 [0215.310] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\O9wse7c.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\o9wse7c.bmp")) returned 0xffffffff [0215.310] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad722e10, ftCreationTime.dwHighDateTime=0x1d4cf33, ftLastAccessTime.dwLowDateTime=0x65af38c0, ftLastAccessTime.dwHighDateTime=0x1d4d37a, ftLastWriteTime.dwLowDateTime=0x65af38c0, ftLastWriteTime.dwHighDateTime=0x1d4d37a, nFileSizeHigh=0x0, nFileSizeLow=0x707d, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="QJqn.m4a", cAlternateFileName="")) returned 1 [0215.310] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QJqn.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qjqn.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0215.310] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QJqn.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qjqn.m4a.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0215.311] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x707d [0215.311] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0215.311] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0215.418] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x707d, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x707d, lpOverlapped=0x0) returned 1 [0215.419] WriteFile (in: hFile=0xd4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x7080, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x7080, lpOverlapped=0x0) returned 1 [0215.420] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0215.443] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.454] CloseHandle (hObject=0xd8) returned 1 [0215.454] CloseHandle (hObject=0xd4) returned 1 [0215.456] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QJqn.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qjqn.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QJqn.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qjqn.m4a.dvodltmf")) returned 0 [0215.457] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QJqn.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qjqn.m4a.dvodltmf")) returned 0x20 [0215.457] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QJqn.m4a", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad722e10, ftCreationTime.dwHighDateTime=0x1d4cf33, ftLastAccessTime.dwLowDateTime=0x65af38c0, ftLastAccessTime.dwHighDateTime=0x1d4d37a, ftLastWriteTime.dwLowDateTime=0x65af38c0, ftLastWriteTime.dwHighDateTime=0x1d4d37a, nFileSizeHigh=0x0, nFileSizeLow=0x707d, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="QJqn.m4a", cAlternateFileName="")) returned 0x2e8458 [0215.457] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad722e10, ftCreationTime.dwHighDateTime=0x1d4cf33, ftLastAccessTime.dwLowDateTime=0x65af38c0, ftLastAccessTime.dwHighDateTime=0x1d4d37a, ftLastWriteTime.dwLowDateTime=0x65af38c0, ftLastWriteTime.dwHighDateTime=0x1d4d37a, nFileSizeHigh=0x0, nFileSizeLow=0x707d, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="QJqn.m4a", cAlternateFileName="")) returned 0 [0215.457] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0215.457] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QJqn.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qjqn.m4a")) returned 1 [0215.458] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QJqn.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qjqn.m4a")) returned 0xffffffff [0215.458] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b26150, ftCreationTime.dwHighDateTime=0x1d4c693, ftLastAccessTime.dwLowDateTime=0x18957c50, ftLastAccessTime.dwHighDateTime=0x1d4cfe4, ftLastWriteTime.dwLowDateTime=0x18957c50, ftLastWriteTime.dwHighDateTime=0x1d4cfe4, nFileSizeHigh=0x0, nFileSizeLow=0xa6d3, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="rje0DX.pdf", cAlternateFileName="")) returned 1 [0215.458] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rje0DX.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rje0dx.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0215.458] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rje0DX.pdf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rje0dx.pdf.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0215.459] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa6d3 [0215.460] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0215.460] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0215.562] ReadFile (in: hFile=0xd4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa6d3, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0xa6d3, lpOverlapped=0x0) returned 1 [0215.563] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa6e0, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0xa6e0, lpOverlapped=0x0) returned 1 [0215.565] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0215.587] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.598] CloseHandle (hObject=0xd4) returned 1 [0215.598] CloseHandle (hObject=0xd8) returned 1 [0215.599] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rje0DX.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rje0dx.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rje0DX.pdf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rje0dx.pdf.dvodltmf")) returned 0 [0215.600] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rje0DX.pdf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rje0dx.pdf.dvodltmf")) returned 0x20 [0215.600] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rje0DX.pdf", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b26150, ftCreationTime.dwHighDateTime=0x1d4c693, ftLastAccessTime.dwLowDateTime=0x18957c50, ftLastAccessTime.dwHighDateTime=0x1d4cfe4, ftLastWriteTime.dwLowDateTime=0x18957c50, ftLastWriteTime.dwHighDateTime=0x1d4cfe4, nFileSizeHigh=0x0, nFileSizeLow=0xa6d3, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="rje0DX.pdf", cAlternateFileName="")) returned 0x2e8458 [0215.600] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b26150, ftCreationTime.dwHighDateTime=0x1d4c693, ftLastAccessTime.dwLowDateTime=0x18957c50, ftLastAccessTime.dwHighDateTime=0x1d4cfe4, ftLastWriteTime.dwLowDateTime=0x18957c50, ftLastWriteTime.dwHighDateTime=0x1d4cfe4, nFileSizeHigh=0x0, nFileSizeLow=0xa6d3, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="rje0DX.pdf", cAlternateFileName="")) returned 0 [0215.600] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0215.600] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rje0DX.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rje0dx.pdf")) returned 1 [0215.601] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rje0DX.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rje0dx.pdf")) returned 0xffffffff [0215.602] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10834f10, ftCreationTime.dwHighDateTime=0x1d4d165, ftLastAccessTime.dwLowDateTime=0xc8e45ea0, ftLastAccessTime.dwHighDateTime=0x1d4ccba, ftLastWriteTime.dwLowDateTime=0xc8e45ea0, ftLastWriteTime.dwHighDateTime=0x1d4ccba, nFileSizeHigh=0x0, nFileSizeLow=0x149fd, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="RkROO3lHIfdWH3G.png", cAlternateFileName="RKROO3~1.PNG")) returned 1 [0215.602] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RkROO3lHIfdWH3G.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rkroo3lhifdwh3g.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0215.602] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RkROO3lHIfdWH3G.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rkroo3lhifdwh3g.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0215.603] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x149fd [0215.603] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0215.603] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0215.701] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x149fd, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x149fd, lpOverlapped=0x0) returned 1 [0215.703] WriteFile (in: hFile=0xd4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x14a00, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x14a00, lpOverlapped=0x0) returned 1 [0215.705] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0215.730] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.741] CloseHandle (hObject=0xd8) returned 1 [0215.741] CloseHandle (hObject=0xd4) returned 1 [0215.741] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RkROO3lHIfdWH3G.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rkroo3lhifdwh3g.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RkROO3lHIfdWH3G.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rkroo3lhifdwh3g.png.dvodltmf")) returned 0 [0215.742] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RkROO3lHIfdWH3G.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rkroo3lhifdwh3g.png.dvodltmf")) returned 0x20 [0215.742] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RkROO3lHIfdWH3G.png", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10834f10, ftCreationTime.dwHighDateTime=0x1d4d165, ftLastAccessTime.dwLowDateTime=0xc8e45ea0, ftLastAccessTime.dwHighDateTime=0x1d4ccba, ftLastWriteTime.dwLowDateTime=0xc8e45ea0, ftLastWriteTime.dwHighDateTime=0x1d4ccba, nFileSizeHigh=0x0, nFileSizeLow=0x149fd, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="RkROO3lHIfdWH3G.png", cAlternateFileName="RKROO3~1.PNG")) returned 0x2e8458 [0215.742] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10834f10, ftCreationTime.dwHighDateTime=0x1d4d165, ftLastAccessTime.dwLowDateTime=0xc8e45ea0, ftLastAccessTime.dwHighDateTime=0x1d4ccba, ftLastWriteTime.dwLowDateTime=0xc8e45ea0, ftLastWriteTime.dwHighDateTime=0x1d4ccba, nFileSizeHigh=0x0, nFileSizeLow=0x149fd, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="RkROO3lHIfdWH3G.png", cAlternateFileName="RKROO3~1.PNG")) returned 0 [0215.742] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0215.742] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RkROO3lHIfdWH3G.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rkroo3lhifdwh3g.png")) returned 1 [0215.744] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RkROO3lHIfdWH3G.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rkroo3lhifdwh3g.png")) returned 0xffffffff [0215.744] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcd78b80, ftCreationTime.dwHighDateTime=0x1d4c781, ftLastAccessTime.dwLowDateTime=0x875dba0, ftLastAccessTime.dwHighDateTime=0x1d4cd26, ftLastWriteTime.dwLowDateTime=0x875dba0, ftLastWriteTime.dwHighDateTime=0x1d4cd26, nFileSizeHigh=0x0, nFileSizeLow=0x18450, dwReserved0=0x0, dwReserved1=0x0, cFileName="RqnFuFX3oHfx.odt", cAlternateFileName="RQNFUF~1.ODT")) returned 1 [0215.744] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RqnFuFX3oHfx.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rqnfufx3ohfx.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0215.744] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RqnFuFX3oHfx.odt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rqnfufx3ohfx.odt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0215.745] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18450 [0215.745] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0215.745] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0215.851] ReadFile (in: hFile=0xd4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x18450, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x18450, lpOverlapped=0x0) returned 1 [0215.856] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x18460, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x18460, lpOverlapped=0x0) returned 1 [0215.859] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0215.884] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.895] CloseHandle (hObject=0xd4) returned 1 [0215.895] CloseHandle (hObject=0xd8) returned 1 [0215.895] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RqnFuFX3oHfx.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rqnfufx3ohfx.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RqnFuFX3oHfx.odt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rqnfufx3ohfx.odt.dvodltmf")) returned 0 [0215.896] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RqnFuFX3oHfx.odt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rqnfufx3ohfx.odt.dvodltmf")) returned 0x20 [0215.896] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RqnFuFX3oHfx.odt", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcd78b80, ftCreationTime.dwHighDateTime=0x1d4c781, ftLastAccessTime.dwLowDateTime=0x875dba0, ftLastAccessTime.dwHighDateTime=0x1d4cd26, ftLastWriteTime.dwLowDateTime=0x875dba0, ftLastWriteTime.dwHighDateTime=0x1d4cd26, nFileSizeHigh=0x0, nFileSizeLow=0x18450, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="RqnFuFX3oHfx.odt", cAlternateFileName="RQNFUF~1.ODT")) returned 0x2e8458 [0215.896] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcd78b80, ftCreationTime.dwHighDateTime=0x1d4c781, ftLastAccessTime.dwLowDateTime=0x875dba0, ftLastAccessTime.dwHighDateTime=0x1d4cd26, ftLastWriteTime.dwLowDateTime=0x875dba0, ftLastWriteTime.dwHighDateTime=0x1d4cd26, nFileSizeHigh=0x0, nFileSizeLow=0x18450, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="RqnFuFX3oHfx.odt", cAlternateFileName="RQNFUF~1.ODT")) returned 0 [0215.896] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0215.896] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RqnFuFX3oHfx.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rqnfufx3ohfx.odt")) returned 1 [0215.899] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RqnFuFX3oHfx.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rqnfufx3ohfx.odt")) returned 0xffffffff [0215.899] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e085bf0, ftCreationTime.dwHighDateTime=0x1d4c9f5, ftLastAccessTime.dwLowDateTime=0x92248580, ftLastAccessTime.dwHighDateTime=0x1d4cdc7, ftLastWriteTime.dwLowDateTime=0x92248580, ftLastWriteTime.dwHighDateTime=0x1d4cdc7, nFileSizeHigh=0x0, nFileSizeLow=0xed4f, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="sijS3.avi", cAlternateFileName="")) returned 1 [0215.899] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sijS3.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\sijs3.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0215.899] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sijS3.avi.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\sijs3.avi.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0215.900] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xed4f [0215.900] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0215.900] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0216.202] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xed4f, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0xed4f, lpOverlapped=0x0) returned 1 [0216.203] WriteFile (in: hFile=0xd4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xed50, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0xed50, lpOverlapped=0x0) returned 1 [0216.205] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0216.234] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0216.339] CloseHandle (hObject=0xd8) returned 1 [0216.339] CloseHandle (hObject=0xd4) returned 1 [0216.341] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sijS3.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\sijs3.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sijS3.avi.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\sijs3.avi.dvodltmf")) returned 0 [0216.342] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sijS3.avi.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\sijs3.avi.dvodltmf")) returned 0x20 [0216.342] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sijS3.avi", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e085bf0, ftCreationTime.dwHighDateTime=0x1d4c9f5, ftLastAccessTime.dwLowDateTime=0x92248580, ftLastAccessTime.dwHighDateTime=0x1d4cdc7, ftLastWriteTime.dwLowDateTime=0x92248580, ftLastWriteTime.dwHighDateTime=0x1d4cdc7, nFileSizeHigh=0x0, nFileSizeLow=0xed4f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="sijS3.avi", cAlternateFileName="")) returned 0x2e8458 [0216.343] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e085bf0, ftCreationTime.dwHighDateTime=0x1d4c9f5, ftLastAccessTime.dwLowDateTime=0x92248580, ftLastAccessTime.dwHighDateTime=0x1d4cdc7, ftLastWriteTime.dwLowDateTime=0x92248580, ftLastWriteTime.dwHighDateTime=0x1d4cdc7, nFileSizeHigh=0x0, nFileSizeLow=0xed4f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="sijS3.avi", cAlternateFileName="")) returned 0 [0216.343] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0216.343] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sijS3.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\sijs3.avi")) returned 1 [0216.344] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sijS3.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\sijs3.avi")) returned 0xffffffff [0216.344] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11268ca0, ftCreationTime.dwHighDateTime=0x1d4c951, ftLastAccessTime.dwLowDateTime=0xddb178f0, ftLastAccessTime.dwHighDateTime=0x1d4ce53, ftLastWriteTime.dwLowDateTime=0xddb178f0, ftLastWriteTime.dwHighDateTime=0x1d4ce53, nFileSizeHigh=0x0, nFileSizeLow=0x10fe0, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="SwAjWPG.swf", cAlternateFileName="")) returned 1 [0216.344] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SwAjWPG.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\swajwpg.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0216.344] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SwAjWPG.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\swajwpg.swf.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0216.346] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10fe0 [0216.346] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0216.346] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0216.433] ReadFile (in: hFile=0xd4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x10fe0, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x10fe0, lpOverlapped=0x0) returned 1 [0216.434] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10ff0, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x10ff0, lpOverlapped=0x0) returned 1 [0216.436] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0216.459] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0216.470] CloseHandle (hObject=0xd4) returned 1 [0216.470] CloseHandle (hObject=0xd8) returned 1 [0216.470] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SwAjWPG.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\swajwpg.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SwAjWPG.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\swajwpg.swf.dvodltmf")) returned 0 [0216.471] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SwAjWPG.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\swajwpg.swf.dvodltmf")) returned 0x20 [0216.471] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SwAjWPG.swf", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11268ca0, ftCreationTime.dwHighDateTime=0x1d4c951, ftLastAccessTime.dwLowDateTime=0xddb178f0, ftLastAccessTime.dwHighDateTime=0x1d4ce53, ftLastWriteTime.dwLowDateTime=0xddb178f0, ftLastWriteTime.dwHighDateTime=0x1d4ce53, nFileSizeHigh=0x0, nFileSizeLow=0x10fe0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="SwAjWPG.swf", cAlternateFileName="")) returned 0x2e8458 [0216.471] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11268ca0, ftCreationTime.dwHighDateTime=0x1d4c951, ftLastAccessTime.dwLowDateTime=0xddb178f0, ftLastAccessTime.dwHighDateTime=0x1d4ce53, ftLastWriteTime.dwLowDateTime=0xddb178f0, ftLastWriteTime.dwHighDateTime=0x1d4ce53, nFileSizeHigh=0x0, nFileSizeLow=0x10fe0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="SwAjWPG.swf", cAlternateFileName="")) returned 0 [0216.471] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0216.471] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SwAjWPG.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\swajwpg.swf")) returned 1 [0216.473] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SwAjWPG.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\swajwpg.swf")) returned 0xffffffff [0216.473] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd54a70, ftCreationTime.dwHighDateTime=0x1d4d2c0, ftLastAccessTime.dwLowDateTime=0x9e6e5dc0, ftLastAccessTime.dwHighDateTime=0x1d4d240, ftLastWriteTime.dwLowDateTime=0x9e6e5dc0, ftLastWriteTime.dwHighDateTime=0x1d4d240, nFileSizeHigh=0x0, nFileSizeLow=0x9632, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="t4AuBF7d7tfGJexOV5.mp4", cAlternateFileName="T4AUBF~1.MP4")) returned 1 [0216.473] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\t4AuBF7d7tfGJexOV5.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\t4aubf7d7tfgjexov5.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0216.473] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\t4AuBF7d7tfGJexOV5.mp4.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\t4aubf7d7tfgjexov5.mp4.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0216.474] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9632 [0216.474] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0216.474] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0216.597] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x9632, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x9632, lpOverlapped=0x0) returned 1 [0216.598] WriteFile (in: hFile=0xd4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x9640, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x9640, lpOverlapped=0x0) returned 1 [0216.600] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0216.622] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0216.634] CloseHandle (hObject=0xd8) returned 1 [0216.634] CloseHandle (hObject=0xd4) returned 1 [0216.635] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\t4AuBF7d7tfGJexOV5.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\t4aubf7d7tfgjexov5.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\t4AuBF7d7tfGJexOV5.mp4.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\t4aubf7d7tfgjexov5.mp4.dvodltmf")) returned 0 [0216.636] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\t4AuBF7d7tfGJexOV5.mp4.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\t4aubf7d7tfgjexov5.mp4.dvodltmf")) returned 0x20 [0216.636] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\t4AuBF7d7tfGJexOV5.mp4", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd54a70, ftCreationTime.dwHighDateTime=0x1d4d2c0, ftLastAccessTime.dwLowDateTime=0x9e6e5dc0, ftLastAccessTime.dwHighDateTime=0x1d4d240, ftLastWriteTime.dwLowDateTime=0x9e6e5dc0, ftLastWriteTime.dwHighDateTime=0x1d4d240, nFileSizeHigh=0x0, nFileSizeLow=0x9632, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="t4AuBF7d7tfGJexOV5.mp4", cAlternateFileName="T4AUBF~1.MP4")) returned 0x2e8458 [0216.636] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd54a70, ftCreationTime.dwHighDateTime=0x1d4d2c0, ftLastAccessTime.dwLowDateTime=0x9e6e5dc0, ftLastAccessTime.dwHighDateTime=0x1d4d240, ftLastWriteTime.dwLowDateTime=0x9e6e5dc0, ftLastWriteTime.dwHighDateTime=0x1d4d240, nFileSizeHigh=0x0, nFileSizeLow=0x9632, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="t4AuBF7d7tfGJexOV5.mp4", cAlternateFileName="T4AUBF~1.MP4")) returned 0 [0216.636] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0216.636] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\t4AuBF7d7tfGJexOV5.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\t4aubf7d7tfgjexov5.mp4")) returned 1 [0216.637] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\t4AuBF7d7tfGJexOV5.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\t4aubf7d7tfgjexov5.mp4")) returned 0xffffffff [0216.637] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58d71a30, ftCreationTime.dwHighDateTime=0x1d4c922, ftLastAccessTime.dwLowDateTime=0x6796ecb0, ftLastAccessTime.dwHighDateTime=0x1d4d0d6, ftLastWriteTime.dwLowDateTime=0x6796ecb0, ftLastWriteTime.dwHighDateTime=0x1d4d0d6, nFileSizeHigh=0x0, nFileSizeLow=0x15a1d, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="Xc_az0A.rtf", cAlternateFileName="")) returned 1 [0216.637] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xc_az0A.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xc_az0a.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0216.637] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xc_az0A.rtf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xc_az0a.rtf.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0216.638] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15a1d [0216.638] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0216.638] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0216.730] ReadFile (in: hFile=0xd4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x15a1d, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x15a1d, lpOverlapped=0x0) returned 1 [0216.732] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x15a20, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x15a20, lpOverlapped=0x0) returned 1 [0216.734] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0216.756] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0216.774] CloseHandle (hObject=0xd4) returned 1 [0216.774] CloseHandle (hObject=0xd8) returned 1 [0216.774] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xc_az0A.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xc_az0a.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xc_az0A.rtf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xc_az0a.rtf.dvodltmf")) returned 0 [0216.775] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xc_az0A.rtf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xc_az0a.rtf.dvodltmf")) returned 0x20 [0216.775] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xc_az0A.rtf", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58d71a30, ftCreationTime.dwHighDateTime=0x1d4c922, ftLastAccessTime.dwLowDateTime=0x6796ecb0, ftLastAccessTime.dwHighDateTime=0x1d4d0d6, ftLastWriteTime.dwLowDateTime=0x6796ecb0, ftLastWriteTime.dwHighDateTime=0x1d4d0d6, nFileSizeHigh=0x0, nFileSizeLow=0x15a1d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Xc_az0A.rtf", cAlternateFileName="")) returned 0x2e8458 [0216.775] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58d71a30, ftCreationTime.dwHighDateTime=0x1d4c922, ftLastAccessTime.dwLowDateTime=0x6796ecb0, ftLastAccessTime.dwHighDateTime=0x1d4d0d6, ftLastWriteTime.dwLowDateTime=0x6796ecb0, ftLastWriteTime.dwHighDateTime=0x1d4d0d6, nFileSizeHigh=0x0, nFileSizeLow=0x15a1d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Xc_az0A.rtf", cAlternateFileName="")) returned 0 [0216.775] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0216.775] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xc_az0A.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xc_az0a.rtf")) returned 1 [0216.777] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xc_az0A.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xc_az0a.rtf")) returned 0xffffffff [0216.777] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23cf76b0, ftCreationTime.dwHighDateTime=0x1d4d517, ftLastAccessTime.dwLowDateTime=0x7cbb14a0, ftLastAccessTime.dwHighDateTime=0x1d4d404, ftLastWriteTime.dwLowDateTime=0x7cbb14a0, ftLastWriteTime.dwHighDateTime=0x1d4d404, nFileSizeHigh=0x0, nFileSizeLow=0xde50, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="XDXf5ELkjgk ntWCWo.jpg", cAlternateFileName="XDXF5E~1.JPG")) returned 1 [0216.777] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\XDXf5ELkjgk ntWCWo.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xdxf5elkjgk ntwcwo.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0216.777] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\XDXf5ELkjgk ntWCWo.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xdxf5elkjgk ntwcwo.jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0216.778] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde50 [0216.778] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0216.778] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0216.868] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xde50, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0xde50, lpOverlapped=0x0) returned 1 [0216.870] WriteFile (in: hFile=0xd4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xde60, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0xde60, lpOverlapped=0x0) returned 1 [0216.871] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0216.894] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0216.906] CloseHandle (hObject=0xd8) returned 1 [0216.906] CloseHandle (hObject=0xd4) returned 1 [0216.906] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\XDXf5ELkjgk ntWCWo.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xdxf5elkjgk ntwcwo.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\XDXf5ELkjgk ntWCWo.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xdxf5elkjgk ntwcwo.jpg.dvodltmf")) returned 0 [0216.907] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\XDXf5ELkjgk ntWCWo.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xdxf5elkjgk ntwcwo.jpg.dvodltmf")) returned 0x20 [0216.907] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\XDXf5ELkjgk ntWCWo.jpg", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23cf76b0, ftCreationTime.dwHighDateTime=0x1d4d517, ftLastAccessTime.dwLowDateTime=0x7cbb14a0, ftLastAccessTime.dwHighDateTime=0x1d4d404, ftLastWriteTime.dwLowDateTime=0x7cbb14a0, ftLastWriteTime.dwHighDateTime=0x1d4d404, nFileSizeHigh=0x0, nFileSizeLow=0xde50, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="XDXf5ELkjgk ntWCWo.jpg", cAlternateFileName="XDXF5E~1.JPG")) returned 0x2e8458 [0216.907] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23cf76b0, ftCreationTime.dwHighDateTime=0x1d4d517, ftLastAccessTime.dwLowDateTime=0x7cbb14a0, ftLastAccessTime.dwHighDateTime=0x1d4d404, ftLastWriteTime.dwLowDateTime=0x7cbb14a0, ftLastWriteTime.dwHighDateTime=0x1d4d404, nFileSizeHigh=0x0, nFileSizeLow=0xde50, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="XDXf5ELkjgk ntWCWo.jpg", cAlternateFileName="XDXF5E~1.JPG")) returned 0 [0216.908] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0216.908] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\XDXf5ELkjgk ntWCWo.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xdxf5elkjgk ntwcwo.jpg")) returned 1 [0216.909] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\XDXf5ELkjgk ntWCWo.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xdxf5elkjgk ntwcwo.jpg")) returned 0xffffffff [0216.909] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b38990, ftCreationTime.dwHighDateTime=0x1d4cc1e, ftLastAccessTime.dwLowDateTime=0x518d0e40, ftLastAccessTime.dwHighDateTime=0x1d4d3bf, ftLastWriteTime.dwLowDateTime=0x518d0e40, ftLastWriteTime.dwHighDateTime=0x1d4d3bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="xmySE9uE", cAlternateFileName="")) returned 1 [0216.909] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b38990, ftCreationTime.dwHighDateTime=0x1d4cc1e, ftLastAccessTime.dwLowDateTime=0x518d0e40, ftLastAccessTime.dwHighDateTime=0x1d4d3bf, ftLastWriteTime.dwLowDateTime=0x518d0e40, ftLastWriteTime.dwHighDateTime=0x1d4d3bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0216.909] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b38990, ftCreationTime.dwHighDateTime=0x1d4cc1e, ftLastAccessTime.dwLowDateTime=0x518d0e40, ftLastAccessTime.dwHighDateTime=0x1d4d3bf, ftLastWriteTime.dwLowDateTime=0x518d0e40, ftLastWriteTime.dwHighDateTime=0x1d4d3bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.909] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e6603c0, ftCreationTime.dwHighDateTime=0x1d4d37b, ftLastAccessTime.dwLowDateTime=0x4e9caa20, ftLastAccessTime.dwHighDateTime=0x1d4c900, ftLastWriteTime.dwLowDateTime=0x4e9caa20, ftLastWriteTime.dwHighDateTime=0x1d4c900, nFileSizeHigh=0x0, nFileSizeLow=0x1623d, dwReserved0=0x78, dwReserved1=0x0, cFileName="9t9C WEEH7Mb0lRFGHf.ods", cAlternateFileName="9T9CWE~1.ODS")) returned 1 [0216.909] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\9t9C WEEH7Mb0lRFGHf.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\9t9c weeh7mb0lrfghf.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0216.909] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\9t9C WEEH7Mb0lRFGHf.ods.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\9t9c weeh7mb0lrfghf.ods.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0216.910] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1623d [0216.910] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0216.910] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0217.002] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1623d, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x1623d, lpOverlapped=0x0) returned 1 [0217.004] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x16240, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x16240, lpOverlapped=0x0) returned 1 [0217.006] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0217.029] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0217.040] CloseHandle (hObject=0xd8) returned 1 [0217.041] CloseHandle (hObject=0xec) returned 1 [0217.041] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\9t9C WEEH7Mb0lRFGHf.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\9t9c weeh7mb0lrfghf.ods"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\9t9C WEEH7Mb0lRFGHf.ods.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\9t9c weeh7mb0lrfghf.ods.dvodltmf")) returned 0 [0217.042] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\9t9C WEEH7Mb0lRFGHf.ods.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\9t9c weeh7mb0lrfghf.ods.dvodltmf")) returned 0x20 [0217.042] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\9t9C WEEH7Mb0lRFGHf.ods", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e6603c0, ftCreationTime.dwHighDateTime=0x1d4d37b, ftLastAccessTime.dwLowDateTime=0x4e9caa20, ftLastAccessTime.dwHighDateTime=0x1d4c900, ftLastWriteTime.dwLowDateTime=0x4e9caa20, ftLastWriteTime.dwHighDateTime=0x1d4c900, nFileSizeHigh=0x0, nFileSizeLow=0x1623d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="9t9C WEEH7Mb0lRFGHf.ods", cAlternateFileName="9T9CWE~1.ODS")) returned 0x2e8498 [0217.042] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e6603c0, ftCreationTime.dwHighDateTime=0x1d4d37b, ftLastAccessTime.dwLowDateTime=0x4e9caa20, ftLastAccessTime.dwHighDateTime=0x1d4c900, ftLastWriteTime.dwLowDateTime=0x4e9caa20, ftLastWriteTime.dwHighDateTime=0x1d4c900, nFileSizeHigh=0x0, nFileSizeLow=0x1623d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="9t9C WEEH7Mb0lRFGHf.ods", cAlternateFileName="9T9CWE~1.ODS")) returned 0 [0217.042] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0217.042] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\9t9C WEEH7Mb0lRFGHf.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\9t9c weeh7mb0lrfghf.ods")) returned 1 [0217.044] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\9t9C WEEH7Mb0lRFGHf.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\9t9c weeh7mb0lrfghf.ods")) returned 0xffffffff [0217.044] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x175d01e0, ftCreationTime.dwHighDateTime=0x1d4d28d, ftLastAccessTime.dwLowDateTime=0x616d4910, ftLastAccessTime.dwHighDateTime=0x1d4d1a8, ftLastWriteTime.dwLowDateTime=0x616d4910, ftLastWriteTime.dwHighDateTime=0x1d4d1a8, nFileSizeHigh=0x0, nFileSizeLow=0x132b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="CVtKR8c6b.gif", cAlternateFileName="CVTKR8~1.GIF")) returned 1 [0217.044] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\CVtKR8c6b.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\cvtkr8c6b.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0217.044] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\CVtKR8c6b.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\cvtkr8c6b.gif.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0217.045] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x132b4 [0217.045] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0217.045] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0217.144] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x132b4, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x132b4, lpOverlapped=0x0) returned 1 [0217.144] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x132c0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x132c0, lpOverlapped=0x0) returned 1 [0217.147] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0217.169] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0217.180] CloseHandle (hObject=0xec) returned 1 [0217.180] CloseHandle (hObject=0xd8) returned 1 [0217.180] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\CVtKR8c6b.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\cvtkr8c6b.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\CVtKR8c6b.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\cvtkr8c6b.gif.dvodltmf")) returned 0 [0217.181] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\CVtKR8c6b.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\cvtkr8c6b.gif.dvodltmf")) returned 0x20 [0217.181] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\CVtKR8c6b.gif", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x175d01e0, ftCreationTime.dwHighDateTime=0x1d4d28d, ftLastAccessTime.dwLowDateTime=0x616d4910, ftLastAccessTime.dwHighDateTime=0x1d4d1a8, ftLastWriteTime.dwLowDateTime=0x616d4910, ftLastWriteTime.dwHighDateTime=0x1d4d1a8, nFileSizeHigh=0x0, nFileSizeLow=0x132b4, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="CVtKR8c6b.gif", cAlternateFileName="CVTKR8~1.GIF")) returned 0x2e8498 [0217.181] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x175d01e0, ftCreationTime.dwHighDateTime=0x1d4d28d, ftLastAccessTime.dwLowDateTime=0x616d4910, ftLastAccessTime.dwHighDateTime=0x1d4d1a8, ftLastWriteTime.dwLowDateTime=0x616d4910, ftLastWriteTime.dwHighDateTime=0x1d4d1a8, nFileSizeHigh=0x0, nFileSizeLow=0x132b4, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="CVtKR8c6b.gif", cAlternateFileName="CVTKR8~1.GIF")) returned 0 [0217.182] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0217.182] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\CVtKR8c6b.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\cvtkr8c6b.gif")) returned 1 [0217.183] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\CVtKR8c6b.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\cvtkr8c6b.gif")) returned 0xffffffff [0217.183] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfde89ee0, ftCreationTime.dwHighDateTime=0x1d4c6e8, ftLastAccessTime.dwLowDateTime=0x1399fd50, ftLastAccessTime.dwHighDateTime=0x1d4c5d2, ftLastWriteTime.dwLowDateTime=0x1399fd50, ftLastWriteTime.dwHighDateTime=0x1d4c5d2, nFileSizeHigh=0x0, nFileSizeLow=0xc88, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="kZZV.m4a", cAlternateFileName="")) returned 1 [0217.183] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\kZZV.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\kzzv.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0217.183] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\kZZV.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\kzzv.m4a.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0217.184] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc88 [0217.184] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0217.184] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0217.303] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xc88, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0xc88, lpOverlapped=0x0) returned 1 [0217.304] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0xc90, lpOverlapped=0x0) returned 1 [0217.305] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0217.328] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0217.339] CloseHandle (hObject=0xd8) returned 1 [0217.339] CloseHandle (hObject=0xec) returned 1 [0217.340] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\kZZV.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\kzzv.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\kZZV.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\kzzv.m4a.dvodltmf")) returned 0 [0217.341] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\kZZV.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\kzzv.m4a.dvodltmf")) returned 0x20 [0217.341] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\kZZV.m4a", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfde89ee0, ftCreationTime.dwHighDateTime=0x1d4c6e8, ftLastAccessTime.dwLowDateTime=0x1399fd50, ftLastAccessTime.dwHighDateTime=0x1d4c5d2, ftLastWriteTime.dwLowDateTime=0x1399fd50, ftLastWriteTime.dwHighDateTime=0x1d4c5d2, nFileSizeHigh=0x0, nFileSizeLow=0xc88, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="kZZV.m4a", cAlternateFileName="")) returned 0x2e8498 [0217.341] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfde89ee0, ftCreationTime.dwHighDateTime=0x1d4c6e8, ftLastAccessTime.dwLowDateTime=0x1399fd50, ftLastAccessTime.dwHighDateTime=0x1d4c5d2, ftLastWriteTime.dwLowDateTime=0x1399fd50, ftLastWriteTime.dwHighDateTime=0x1d4c5d2, nFileSizeHigh=0x0, nFileSizeLow=0xc88, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="kZZV.m4a", cAlternateFileName="")) returned 0 [0217.341] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0217.341] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\kZZV.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\kzzv.m4a")) returned 1 [0217.342] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\kZZV.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\kzzv.m4a")) returned 0xffffffff [0217.342] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39f8e100, ftCreationTime.dwHighDateTime=0x1d4c72b, ftLastAccessTime.dwLowDateTime=0xb95cbf20, ftLastAccessTime.dwHighDateTime=0x1d4c802, ftLastWriteTime.dwLowDateTime=0xb95cbf20, ftLastWriteTime.dwHighDateTime=0x1d4c802, nFileSizeHigh=0x0, nFileSizeLow=0xdcb2, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="lC-PUX8CoTL1XDIC.png", cAlternateFileName="LC-PUX~1.PNG")) returned 1 [0217.342] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\lC-PUX8CoTL1XDIC.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\lc-pux8cotl1xdic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0217.342] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\lC-PUX8CoTL1XDIC.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\lc-pux8cotl1xdic.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0217.343] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdcb2 [0217.343] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0217.343] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0217.460] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xdcb2, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0xdcb2, lpOverlapped=0x0) returned 1 [0217.462] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xdcc0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0xdcc0, lpOverlapped=0x0) returned 1 [0217.463] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0217.486] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0217.497] CloseHandle (hObject=0xec) returned 1 [0217.497] CloseHandle (hObject=0xd8) returned 1 [0217.497] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\lC-PUX8CoTL1XDIC.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\lc-pux8cotl1xdic.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\lC-PUX8CoTL1XDIC.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\lc-pux8cotl1xdic.png.dvodltmf")) returned 0 [0217.498] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\lC-PUX8CoTL1XDIC.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\lc-pux8cotl1xdic.png.dvodltmf")) returned 0x20 [0217.498] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\lC-PUX8CoTL1XDIC.png", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39f8e100, ftCreationTime.dwHighDateTime=0x1d4c72b, ftLastAccessTime.dwLowDateTime=0xb95cbf20, ftLastAccessTime.dwHighDateTime=0x1d4c802, ftLastWriteTime.dwLowDateTime=0xb95cbf20, ftLastWriteTime.dwHighDateTime=0x1d4c802, nFileSizeHigh=0x0, nFileSizeLow=0xdcb2, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="lC-PUX8CoTL1XDIC.png", cAlternateFileName="LC-PUX~1.PNG")) returned 0x2e8498 [0217.498] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39f8e100, ftCreationTime.dwHighDateTime=0x1d4c72b, ftLastAccessTime.dwLowDateTime=0xb95cbf20, ftLastAccessTime.dwHighDateTime=0x1d4c802, ftLastWriteTime.dwLowDateTime=0xb95cbf20, ftLastWriteTime.dwHighDateTime=0x1d4c802, nFileSizeHigh=0x0, nFileSizeLow=0xdcb2, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="lC-PUX8CoTL1XDIC.png", cAlternateFileName="LC-PUX~1.PNG")) returned 0 [0217.498] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0217.499] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\lC-PUX8CoTL1XDIC.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\lc-pux8cotl1xdic.png")) returned 1 [0217.501] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\lC-PUX8CoTL1XDIC.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\lc-pux8cotl1xdic.png")) returned 0xffffffff [0217.501] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51413900, ftCreationTime.dwHighDateTime=0x1d4c75a, ftLastAccessTime.dwLowDateTime=0xa712eb60, ftLastAccessTime.dwHighDateTime=0x1d4c608, ftLastWriteTime.dwLowDateTime=0xa712eb60, ftLastWriteTime.dwHighDateTime=0x1d4c608, nFileSizeHigh=0x0, nFileSizeLow=0x11e94, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="U7OayEQ.jpg", cAlternateFileName="")) returned 1 [0217.501] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\U7OayEQ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\u7oayeq.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0217.501] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\U7OayEQ.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\u7oayeq.jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0217.502] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11e94 [0217.502] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0217.502] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0217.649] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x11e94, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x11e94, lpOverlapped=0x0) returned 1 [0217.650] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x11ea0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x11ea0, lpOverlapped=0x0) returned 1 [0217.652] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0217.675] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0217.686] CloseHandle (hObject=0xd8) returned 1 [0217.687] CloseHandle (hObject=0xec) returned 1 [0217.687] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\U7OayEQ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\u7oayeq.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\U7OayEQ.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\u7oayeq.jpg.dvodltmf")) returned 0 [0217.688] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\U7OayEQ.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\u7oayeq.jpg.dvodltmf")) returned 0x20 [0217.688] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\U7OayEQ.jpg", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51413900, ftCreationTime.dwHighDateTime=0x1d4c75a, ftLastAccessTime.dwLowDateTime=0xa712eb60, ftLastAccessTime.dwHighDateTime=0x1d4c608, ftLastWriteTime.dwLowDateTime=0xa712eb60, ftLastWriteTime.dwHighDateTime=0x1d4c608, nFileSizeHigh=0x0, nFileSizeLow=0x11e94, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="U7OayEQ.jpg", cAlternateFileName="")) returned 0x2e8498 [0217.688] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51413900, ftCreationTime.dwHighDateTime=0x1d4c75a, ftLastAccessTime.dwLowDateTime=0xa712eb60, ftLastAccessTime.dwHighDateTime=0x1d4c608, ftLastWriteTime.dwLowDateTime=0xa712eb60, ftLastWriteTime.dwHighDateTime=0x1d4c608, nFileSizeHigh=0x0, nFileSizeLow=0x11e94, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="U7OayEQ.jpg", cAlternateFileName="")) returned 0 [0217.688] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0217.688] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\U7OayEQ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\u7oayeq.jpg")) returned 1 [0217.727] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\U7OayEQ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\u7oayeq.jpg")) returned 0xffffffff [0217.727] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27326980, ftCreationTime.dwHighDateTime=0x1d4d4a3, ftLastAccessTime.dwLowDateTime=0x90f89310, ftLastAccessTime.dwHighDateTime=0x1d4c7fd, ftLastWriteTime.dwLowDateTime=0x90f89310, ftLastWriteTime.dwHighDateTime=0x1d4c7fd, nFileSizeHigh=0x0, nFileSizeLow=0x17829, dwReserved0=0x0, dwReserved1=0x0, cFileName="VOPq3KBIR16-9-WvhCH.wav", cAlternateFileName="VOPQ3K~1.WAV")) returned 1 [0217.727] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\VOPq3KBIR16-9-WvhCH.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\vopq3kbir16-9-wvhch.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0217.727] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\VOPq3KBIR16-9-WvhCH.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\vopq3kbir16-9-wvhch.wav.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0217.728] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17829 [0217.728] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0217.728] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0217.827] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x17829, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x17829, lpOverlapped=0x0) returned 1 [0217.828] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x17830, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x17830, lpOverlapped=0x0) returned 1 [0217.831] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0217.853] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0217.865] CloseHandle (hObject=0xec) returned 1 [0217.865] CloseHandle (hObject=0xd8) returned 1 [0217.865] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\VOPq3KBIR16-9-WvhCH.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\vopq3kbir16-9-wvhch.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\VOPq3KBIR16-9-WvhCH.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\vopq3kbir16-9-wvhch.wav.dvodltmf")) returned 0 [0217.866] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\VOPq3KBIR16-9-WvhCH.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\vopq3kbir16-9-wvhch.wav.dvodltmf")) returned 0x20 [0217.866] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\VOPq3KBIR16-9-WvhCH.wav", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27326980, ftCreationTime.dwHighDateTime=0x1d4d4a3, ftLastAccessTime.dwLowDateTime=0x90f89310, ftLastAccessTime.dwHighDateTime=0x1d4c7fd, ftLastWriteTime.dwLowDateTime=0x90f89310, ftLastWriteTime.dwHighDateTime=0x1d4c7fd, nFileSizeHigh=0x0, nFileSizeLow=0x17829, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="VOPq3KBIR16-9-WvhCH.wav", cAlternateFileName="VOPQ3K~1.WAV")) returned 0x2e8498 [0217.866] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27326980, ftCreationTime.dwHighDateTime=0x1d4d4a3, ftLastAccessTime.dwLowDateTime=0x90f89310, ftLastAccessTime.dwHighDateTime=0x1d4c7fd, ftLastWriteTime.dwLowDateTime=0x90f89310, ftLastWriteTime.dwHighDateTime=0x1d4c7fd, nFileSizeHigh=0x0, nFileSizeLow=0x17829, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="VOPq3KBIR16-9-WvhCH.wav", cAlternateFileName="VOPQ3K~1.WAV")) returned 0 [0217.866] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0217.867] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\VOPq3KBIR16-9-WvhCH.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\vopq3kbir16-9-wvhch.wav")) returned 1 [0217.868] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\VOPq3KBIR16-9-WvhCH.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\vopq3kbir16-9-wvhch.wav")) returned 0xffffffff [0217.868] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b620690, ftCreationTime.dwHighDateTime=0x1d4ce5a, ftLastAccessTime.dwLowDateTime=0xa8daa2a0, ftLastAccessTime.dwHighDateTime=0x1d4c732, ftLastWriteTime.dwLowDateTime=0xa8daa2a0, ftLastWriteTime.dwHighDateTime=0x1d4c732, nFileSizeHigh=0x0, nFileSizeLow=0x2047, dwReserved0=0x0, dwReserved1=0x0, cFileName="XVdPHUlLm7.ods", cAlternateFileName="XVDPHU~1.ODS")) returned 1 [0217.868] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\XVdPHUlLm7.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\xvdphullm7.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0217.868] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\XVdPHUlLm7.ods.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\xvdphullm7.ods.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0217.869] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2047 [0217.869] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0217.870] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0217.959] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2047, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x2047, lpOverlapped=0x0) returned 1 [0217.960] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x2050, lpOverlapped=0x0) returned 1 [0217.961] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0217.984] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0217.996] CloseHandle (hObject=0xd8) returned 1 [0217.996] CloseHandle (hObject=0xec) returned 1 [0217.999] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\XVdPHUlLm7.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\xvdphullm7.ods"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\XVdPHUlLm7.ods.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\xvdphullm7.ods.dvodltmf")) returned 0 [0218.000] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\XVdPHUlLm7.ods.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\xvdphullm7.ods.dvodltmf")) returned 0x20 [0218.000] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\XVdPHUlLm7.ods", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b620690, ftCreationTime.dwHighDateTime=0x1d4ce5a, ftLastAccessTime.dwLowDateTime=0xa8daa2a0, ftLastAccessTime.dwHighDateTime=0x1d4c732, ftLastWriteTime.dwLowDateTime=0xa8daa2a0, ftLastWriteTime.dwHighDateTime=0x1d4c732, nFileSizeHigh=0x0, nFileSizeLow=0x2047, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="XVdPHUlLm7.ods", cAlternateFileName="XVDPHU~1.ODS")) returned 0x2e8498 [0218.000] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b620690, ftCreationTime.dwHighDateTime=0x1d4ce5a, ftLastAccessTime.dwLowDateTime=0xa8daa2a0, ftLastAccessTime.dwHighDateTime=0x1d4c732, ftLastWriteTime.dwLowDateTime=0xa8daa2a0, ftLastWriteTime.dwHighDateTime=0x1d4c732, nFileSizeHigh=0x0, nFileSizeLow=0x2047, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="XVdPHUlLm7.ods", cAlternateFileName="XVDPHU~1.ODS")) returned 0 [0218.000] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0218.000] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\XVdPHUlLm7.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\xvdphullm7.ods")) returned 1 [0218.002] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xmySE9uE\\XVdPHUlLm7.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmyse9ue\\xvdphullm7.ods")) returned 0xffffffff [0218.002] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b620690, ftCreationTime.dwHighDateTime=0x1d4ce5a, ftLastAccessTime.dwLowDateTime=0xa8daa2a0, ftLastAccessTime.dwHighDateTime=0x1d4c732, ftLastWriteTime.dwLowDateTime=0xa8daa2a0, ftLastWriteTime.dwHighDateTime=0x1d4c732, nFileSizeHigh=0x0, nFileSizeLow=0x2047, dwReserved0=0x0, dwReserved1=0x0, cFileName="XVdPHUlLm7.ods", cAlternateFileName="XVDPHU~1.ODS")) returned 0 [0218.002] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0218.002] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8d90d50, ftCreationTime.dwHighDateTime=0x1d4ce8a, ftLastAccessTime.dwLowDateTime=0x1a85920, ftLastAccessTime.dwHighDateTime=0x1d4cfb4, ftLastWriteTime.dwLowDateTime=0x1a85920, ftLastWriteTime.dwHighDateTime=0x1d4cfb4, nFileSizeHigh=0x0, nFileSizeLow=0xa4cc, dwReserved0=0x5773646f, dwReserved1=0x48436876, cFileName="YlfWlu.flv", cAlternateFileName="")) returned 1 [0218.002] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YlfWlu.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ylfwlu.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0218.002] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YlfWlu.flv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ylfwlu.flv.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0218.003] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa4cc [0218.003] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0218.003] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0218.096] ReadFile (in: hFile=0xd4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa4cc, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0xa4cc, lpOverlapped=0x0) returned 1 [0218.098] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa4d0, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0xa4d0, lpOverlapped=0x0) returned 1 [0218.099] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0218.123] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0218.134] CloseHandle (hObject=0xd4) returned 1 [0218.134] CloseHandle (hObject=0xec) returned 1 [0218.134] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YlfWlu.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ylfwlu.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YlfWlu.flv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ylfwlu.flv.dvodltmf")) returned 0 [0218.135] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YlfWlu.flv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ylfwlu.flv.dvodltmf")) returned 0x20 [0218.135] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YlfWlu.flv", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8d90d50, ftCreationTime.dwHighDateTime=0x1d4ce8a, ftLastAccessTime.dwLowDateTime=0x1a85920, ftLastAccessTime.dwHighDateTime=0x1d4cfb4, ftLastWriteTime.dwLowDateTime=0x1a85920, ftLastWriteTime.dwHighDateTime=0x1d4cfb4, nFileSizeHigh=0x0, nFileSizeLow=0xa4cc, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="YlfWlu.flv", cAlternateFileName="")) returned 0x2e8458 [0218.136] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8d90d50, ftCreationTime.dwHighDateTime=0x1d4ce8a, ftLastAccessTime.dwLowDateTime=0x1a85920, ftLastAccessTime.dwHighDateTime=0x1d4cfb4, ftLastWriteTime.dwLowDateTime=0x1a85920, ftLastWriteTime.dwHighDateTime=0x1d4cfb4, nFileSizeHigh=0x0, nFileSizeLow=0xa4cc, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="YlfWlu.flv", cAlternateFileName="")) returned 0 [0218.136] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0218.136] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YlfWlu.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ylfwlu.flv")) returned 1 [0218.137] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YlfWlu.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ylfwlu.flv")) returned 0xffffffff [0218.137] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43328880, ftCreationTime.dwHighDateTime=0x1d4cba3, ftLastAccessTime.dwLowDateTime=0x404e4760, ftLastAccessTime.dwHighDateTime=0x1d4d2c1, ftLastWriteTime.dwLowDateTime=0x404e4760, ftLastWriteTime.dwHighDateTime=0x1d4d2c1, nFileSizeHigh=0x0, nFileSizeLow=0x137ba, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="zor5VOrpZBAiatFo-64I.wav", cAlternateFileName="ZOR5VO~1.WAV")) returned 1 [0218.137] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zor5VOrpZBAiatFo-64I.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zor5vorpzbaiatfo-64i.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0218.138] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zor5VOrpZBAiatFo-64I.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zor5vorpzbaiatfo-64i.wav.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0218.138] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x137ba [0218.139] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0218.139] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0218.231] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x137ba, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x137ba, lpOverlapped=0x0) returned 1 [0218.232] WriteFile (in: hFile=0xd4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x137c0, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x137c0, lpOverlapped=0x0) returned 1 [0218.234] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0218.260] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0218.272] CloseHandle (hObject=0xec) returned 1 [0218.272] CloseHandle (hObject=0xd4) returned 1 [0218.272] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zor5VOrpZBAiatFo-64I.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zor5vorpzbaiatfo-64i.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zor5VOrpZBAiatFo-64I.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zor5vorpzbaiatfo-64i.wav.dvodltmf")) returned 0 [0218.273] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zor5VOrpZBAiatFo-64I.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zor5vorpzbaiatfo-64i.wav.dvodltmf")) returned 0x20 [0218.273] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zor5VOrpZBAiatFo-64I.wav", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43328880, ftCreationTime.dwHighDateTime=0x1d4cba3, ftLastAccessTime.dwLowDateTime=0x404e4760, ftLastAccessTime.dwHighDateTime=0x1d4d2c1, ftLastWriteTime.dwLowDateTime=0x404e4760, ftLastWriteTime.dwHighDateTime=0x1d4d2c1, nFileSizeHigh=0x0, nFileSizeLow=0x137ba, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="zor5VOrpZBAiatFo-64I.wav", cAlternateFileName="ZOR5VO~1.WAV")) returned 0x2e8458 [0218.273] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43328880, ftCreationTime.dwHighDateTime=0x1d4cba3, ftLastAccessTime.dwLowDateTime=0x404e4760, ftLastAccessTime.dwHighDateTime=0x1d4d2c1, ftLastWriteTime.dwLowDateTime=0x404e4760, ftLastWriteTime.dwHighDateTime=0x1d4d2c1, nFileSizeHigh=0x0, nFileSizeLow=0x137ba, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="zor5VOrpZBAiatFo-64I.wav", cAlternateFileName="ZOR5VO~1.WAV")) returned 0 [0218.273] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0218.273] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zor5VOrpZBAiatFo-64I.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zor5vorpzbaiatfo-64i.wav")) returned 1 [0218.275] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zor5VOrpZBAiatFo-64I.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zor5vorpzbaiatfo-64i.wav")) returned 0xffffffff [0218.275] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43328880, ftCreationTime.dwHighDateTime=0x1d4cba3, ftLastAccessTime.dwLowDateTime=0x404e4760, ftLastAccessTime.dwHighDateTime=0x1d4d2c1, ftLastWriteTime.dwLowDateTime=0x404e4760, ftLastWriteTime.dwHighDateTime=0x1d4d2c1, nFileSizeHigh=0x0, nFileSizeLow=0x137ba, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="zor5VOrpZBAiatFo-64I.wav", cAlternateFileName="ZOR5VO~1.WAV")) returned 0 [0218.275] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0218.275] FindNextFileA (in: hFindFile=0x2dab90, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7272ba80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7272ba80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x46746169, dwReserved1=0x34362d6f, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0218.275] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7272ba80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7272ba80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0218.275] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7272ba80, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7272ba80, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="..", cAlternateFileName="")) returned 1 [0218.275] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48d53810, ftCreationTime.dwHighDateTime=0x1d571b5, ftLastAccessTime.dwLowDateTime=0x3bb49380, ftLastAccessTime.dwHighDateTime=0x1d57cc1, ftLastWriteTime.dwLowDateTime=0x3bb49380, ftLastWriteTime.dwHighDateTime=0x1d57cc1, nFileSizeHigh=0x0, nFileSizeLow=0xc983, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="2TLciQ138M.pptx", cAlternateFileName="2TLCIQ~1.PPT")) returned 1 [0218.275] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2TLciQ138M.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2tlciq138m.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0218.275] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2TLciQ138M.pptx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2tlciq138m.pptx.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0218.276] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc983 [0218.276] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0218.276] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0218.370] ReadFile (in: hFile=0xd4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xc983, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0xc983, lpOverlapped=0x0) returned 1 [0218.372] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc990, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0xc990, lpOverlapped=0x0) returned 1 [0218.373] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0218.398] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0218.409] CloseHandle (hObject=0xd4) returned 1 [0218.409] CloseHandle (hObject=0xec) returned 1 [0218.409] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2TLciQ138M.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2tlciq138m.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2TLciQ138M.pptx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2tlciq138m.pptx.dvodltmf")) returned 0 [0218.410] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2TLciQ138M.pptx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2tlciq138m.pptx.dvodltmf")) returned 0x20 [0218.410] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2TLciQ138M.pptx", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48d53810, ftCreationTime.dwHighDateTime=0x1d571b5, ftLastAccessTime.dwLowDateTime=0x3bb49380, ftLastAccessTime.dwHighDateTime=0x1d57cc1, ftLastWriteTime.dwLowDateTime=0x3bb49380, ftLastWriteTime.dwHighDateTime=0x1d57cc1, nFileSizeHigh=0x0, nFileSizeLow=0xc983, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="2TLciQ138M.pptx", cAlternateFileName="2TLCIQ~1.PPT")) returned 0x2e8458 [0218.410] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48d53810, ftCreationTime.dwHighDateTime=0x1d571b5, ftLastAccessTime.dwLowDateTime=0x3bb49380, ftLastAccessTime.dwHighDateTime=0x1d57cc1, ftLastWriteTime.dwLowDateTime=0x3bb49380, ftLastWriteTime.dwHighDateTime=0x1d57cc1, nFileSizeHigh=0x0, nFileSizeLow=0xc983, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="2TLciQ138M.pptx", cAlternateFileName="2TLCIQ~1.PPT")) returned 0 [0218.410] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0218.410] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2TLciQ138M.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2tlciq138m.pptx")) returned 1 [0218.412] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2TLciQ138M.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2tlciq138m.pptx")) returned 0xffffffff [0218.412] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dc80320, ftCreationTime.dwHighDateTime=0x1d58c78, ftLastAccessTime.dwLowDateTime=0xa70040, ftLastAccessTime.dwHighDateTime=0x1d5bc39, ftLastWriteTime.dwLowDateTime=0xa70040, ftLastWriteTime.dwHighDateTime=0x1d5bc39, nFileSizeHigh=0x0, nFileSizeLow=0x189b8, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="A hOJQ.docx", cAlternateFileName="AHOJQ~1.DOC")) returned 1 [0218.412] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\A hOJQ.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\a hojq.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0218.412] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\A hOJQ.docx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\a hojq.docx.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0218.413] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x189b8 [0218.413] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0218.413] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0218.515] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x189b8, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x189b8, lpOverlapped=0x0) returned 1 [0218.517] WriteFile (in: hFile=0xd4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x189c0, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x189c0, lpOverlapped=0x0) returned 1 [0218.530] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0218.552] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0218.562] CloseHandle (hObject=0xec) returned 1 [0218.563] CloseHandle (hObject=0xd4) returned 1 [0218.563] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\A hOJQ.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\a hojq.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\A hOJQ.docx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\a hojq.docx.dvodltmf")) returned 0 [0218.564] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\A hOJQ.docx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\a hojq.docx.dvodltmf")) returned 0x20 [0218.564] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\A hOJQ.docx", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dc80320, ftCreationTime.dwHighDateTime=0x1d58c78, ftLastAccessTime.dwLowDateTime=0xa70040, ftLastAccessTime.dwHighDateTime=0x1d5bc39, ftLastWriteTime.dwLowDateTime=0xa70040, ftLastWriteTime.dwHighDateTime=0x1d5bc39, nFileSizeHigh=0x0, nFileSizeLow=0x189b8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="A hOJQ.docx", cAlternateFileName="AHOJQ~1.DOC")) returned 0x2e8458 [0218.564] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dc80320, ftCreationTime.dwHighDateTime=0x1d58c78, ftLastAccessTime.dwLowDateTime=0xa70040, ftLastAccessTime.dwHighDateTime=0x1d5bc39, ftLastWriteTime.dwLowDateTime=0xa70040, ftLastWriteTime.dwHighDateTime=0x1d5bc39, nFileSizeHigh=0x0, nFileSizeLow=0x189b8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="A hOJQ.docx", cAlternateFileName="AHOJQ~1.DOC")) returned 0 [0218.564] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0218.564] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\A hOJQ.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\a hojq.docx")) returned 1 [0218.567] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\A hOJQ.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\a hojq.docx")) returned 0xffffffff [0218.567] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x612015e0, ftCreationTime.dwHighDateTime=0x1d4c9c5, ftLastAccessTime.dwLowDateTime=0x25dc9e40, ftLastAccessTime.dwHighDateTime=0x1d4d537, ftLastWriteTime.dwLowDateTime=0x25dc9e40, ftLastWriteTime.dwHighDateTime=0x1d4d537, nFileSizeHigh=0x0, nFileSizeLow=0x14567, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="A2F9i3GigO6CRtVsg.ods", cAlternateFileName="A2F9I3~1.ODS")) returned 1 [0218.567] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\A2F9i3GigO6CRtVsg.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\a2f9i3gigo6crtvsg.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0218.568] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\A2F9i3GigO6CRtVsg.ods.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\a2f9i3gigo6crtvsg.ods.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0218.568] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14567 [0218.568] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0218.569] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0218.660] ReadFile (in: hFile=0xd4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x14567, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x14567, lpOverlapped=0x0) returned 1 [0218.662] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x14570, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x14570, lpOverlapped=0x0) returned 1 [0218.664] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0218.686] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0218.703] CloseHandle (hObject=0xd4) returned 1 [0218.703] CloseHandle (hObject=0xec) returned 1 [0218.704] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\A2F9i3GigO6CRtVsg.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\a2f9i3gigo6crtvsg.ods"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\A2F9i3GigO6CRtVsg.ods.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\a2f9i3gigo6crtvsg.ods.dvodltmf")) returned 0 [0218.705] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\A2F9i3GigO6CRtVsg.ods.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\a2f9i3gigo6crtvsg.ods.dvodltmf")) returned 0x20 [0218.705] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\A2F9i3GigO6CRtVsg.ods", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x612015e0, ftCreationTime.dwHighDateTime=0x1d4c9c5, ftLastAccessTime.dwLowDateTime=0x25dc9e40, ftLastAccessTime.dwHighDateTime=0x1d4d537, ftLastWriteTime.dwLowDateTime=0x25dc9e40, ftLastWriteTime.dwHighDateTime=0x1d4d537, nFileSizeHigh=0x0, nFileSizeLow=0x14567, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="A2F9i3GigO6CRtVsg.ods", cAlternateFileName="A2F9I3~1.ODS")) returned 0x2e8458 [0218.705] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x612015e0, ftCreationTime.dwHighDateTime=0x1d4c9c5, ftLastAccessTime.dwLowDateTime=0x25dc9e40, ftLastAccessTime.dwHighDateTime=0x1d4d537, ftLastWriteTime.dwLowDateTime=0x25dc9e40, ftLastWriteTime.dwHighDateTime=0x1d4d537, nFileSizeHigh=0x0, nFileSizeLow=0x14567, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="A2F9i3GigO6CRtVsg.ods", cAlternateFileName="A2F9I3~1.ODS")) returned 0 [0218.705] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0218.705] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\A2F9i3GigO6CRtVsg.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\a2f9i3gigo6crtvsg.ods")) returned 1 [0218.707] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\A2F9i3GigO6CRtVsg.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\a2f9i3gigo6crtvsg.ods")) returned 0xffffffff [0218.708] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0218.708] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0218.708] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0218.708] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x192 [0218.709] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0218.709] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0218.804] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x192, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x192, lpOverlapped=0x0) returned 1 [0218.805] WriteFile (in: hFile=0xd4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x1a0, lpOverlapped=0x0) returned 1 [0218.806] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0218.828] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0218.840] CloseHandle (hObject=0xec) returned 1 [0218.840] CloseHandle (hObject=0xd4) returned 1 [0218.840] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\desktop.ini.dvodltmf")) returned 0 [0218.841] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\desktop.ini.dvodltmf")) returned 0x20 [0218.841] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8458 [0218.841] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0218.841] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0218.842] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\desktop.ini")) returned 1 [0218.842] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\desktop.ini")) returned 0xffffffff [0218.842] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f8f050, ftCreationTime.dwHighDateTime=0x1d5853a, ftLastAccessTime.dwLowDateTime=0x397a8790, ftLastAccessTime.dwHighDateTime=0x1d55107, ftLastWriteTime.dwLowDateTime=0x397a8790, ftLastWriteTime.dwHighDateTime=0x1d55107, nFileSizeHigh=0x0, nFileSizeLow=0xb813, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="dk0FrGz.docx", cAlternateFileName="DK0FRG~1.DOC")) returned 1 [0218.842] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dk0FrGz.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\dk0frgz.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0218.843] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dk0FrGz.docx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\dk0frgz.docx.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0218.843] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb813 [0218.843] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0218.844] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0218.933] ReadFile (in: hFile=0xd4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb813, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0xb813, lpOverlapped=0x0) returned 1 [0218.934] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb820, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0xb820, lpOverlapped=0x0) returned 1 [0218.936] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0218.959] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0218.970] CloseHandle (hObject=0xd4) returned 1 [0218.970] CloseHandle (hObject=0xec) returned 1 [0218.970] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dk0FrGz.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\dk0frgz.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dk0FrGz.docx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\dk0frgz.docx.dvodltmf")) returned 0 [0218.971] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dk0FrGz.docx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\dk0frgz.docx.dvodltmf")) returned 0x20 [0218.971] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dk0FrGz.docx", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f8f050, ftCreationTime.dwHighDateTime=0x1d5853a, ftLastAccessTime.dwLowDateTime=0x397a8790, ftLastAccessTime.dwHighDateTime=0x1d55107, ftLastWriteTime.dwLowDateTime=0x397a8790, ftLastWriteTime.dwHighDateTime=0x1d55107, nFileSizeHigh=0x0, nFileSizeLow=0xb813, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="dk0FrGz.docx", cAlternateFileName="DK0FRG~1.DOC")) returned 0x2e8458 [0218.972] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f8f050, ftCreationTime.dwHighDateTime=0x1d5853a, ftLastAccessTime.dwLowDateTime=0x397a8790, ftLastAccessTime.dwHighDateTime=0x1d55107, ftLastWriteTime.dwLowDateTime=0x397a8790, ftLastWriteTime.dwHighDateTime=0x1d55107, nFileSizeHigh=0x0, nFileSizeLow=0xb813, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="dk0FrGz.docx", cAlternateFileName="DK0FRG~1.DOC")) returned 0 [0218.972] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0218.972] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dk0FrGz.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\dk0frgz.docx")) returned 1 [0218.973] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dk0FrGz.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\dk0frgz.docx")) returned 0xffffffff [0218.973] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81c45480, ftCreationTime.dwHighDateTime=0x1d4cc29, ftLastAccessTime.dwLowDateTime=0xcfd0ad50, ftLastAccessTime.dwHighDateTime=0x1d4d4ac, ftLastWriteTime.dwLowDateTime=0xcfd0ad50, ftLastWriteTime.dwHighDateTime=0x1d4d4ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="e27qH-jv", cAlternateFileName="")) returned 1 [0218.973] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e27qH-jv\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81c45480, ftCreationTime.dwHighDateTime=0x1d4cc29, ftLastAccessTime.dwLowDateTime=0xcfd0ad50, ftLastAccessTime.dwHighDateTime=0x1d4d4ac, ftLastWriteTime.dwLowDateTime=0xcfd0ad50, ftLastWriteTime.dwHighDateTime=0x1d4d4ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0218.974] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81c45480, ftCreationTime.dwHighDateTime=0x1d4cc29, ftLastAccessTime.dwLowDateTime=0xcfd0ad50, ftLastAccessTime.dwHighDateTime=0x1d4d4ac, ftLastWriteTime.dwLowDateTime=0xcfd0ad50, ftLastWriteTime.dwHighDateTime=0x1d4d4ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.974] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa11a2f60, ftCreationTime.dwHighDateTime=0x1d4c825, ftLastAccessTime.dwLowDateTime=0x636ae7b0, ftLastAccessTime.dwHighDateTime=0x1d4cc1f, ftLastWriteTime.dwLowDateTime=0x636ae7b0, ftLastWriteTime.dwHighDateTime=0x1d4cc1f, nFileSizeHigh=0x0, nFileSizeLow=0x18c8e, dwReserved0=0x68, dwReserved1=0x0, cFileName="9AAcEoE6H8 3wYJD4.ots", cAlternateFileName="9AACEO~1.OTS")) returned 1 [0218.974] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e27qH-jv\\9AAcEoE6H8 3wYJD4.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\e27qh-jv\\9aaceoe6h8 3wyjd4.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0218.974] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e27qH-jv\\9AAcEoE6H8 3wYJD4.ots.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\e27qh-jv\\9aaceoe6h8 3wyjd4.ots.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0218.976] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18c8e [0218.976] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0218.977] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0219.347] ReadFile (in: hFile=0xd4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x18c8e, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x18c8e, lpOverlapped=0x0) returned 1 [0219.349] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x18c90, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x18c90, lpOverlapped=0x0) returned 1 [0219.351] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0219.499] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0219.511] CloseHandle (hObject=0xd4) returned 1 [0219.511] CloseHandle (hObject=0xd8) returned 1 [0219.511] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e27qH-jv\\9AAcEoE6H8 3wYJD4.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\e27qh-jv\\9aaceoe6h8 3wyjd4.ots"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e27qH-jv\\9AAcEoE6H8 3wYJD4.ots.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\e27qh-jv\\9aaceoe6h8 3wyjd4.ots.dvodltmf")) returned 0 [0219.512] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e27qH-jv\\9AAcEoE6H8 3wYJD4.ots.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\e27qh-jv\\9aaceoe6h8 3wyjd4.ots.dvodltmf")) returned 0x20 [0219.512] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e27qH-jv\\9AAcEoE6H8 3wYJD4.ots", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa11a2f60, ftCreationTime.dwHighDateTime=0x1d4c825, ftLastAccessTime.dwLowDateTime=0x636ae7b0, ftLastAccessTime.dwHighDateTime=0x1d4cc1f, ftLastWriteTime.dwLowDateTime=0x636ae7b0, ftLastWriteTime.dwHighDateTime=0x1d4cc1f, nFileSizeHigh=0x0, nFileSizeLow=0x18c8e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="9AAcEoE6H8 3wYJD4.ots", cAlternateFileName="9AACEO~1.OTS")) returned 0x2e8498 [0219.512] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa11a2f60, ftCreationTime.dwHighDateTime=0x1d4c825, ftLastAccessTime.dwLowDateTime=0x636ae7b0, ftLastAccessTime.dwHighDateTime=0x1d4cc1f, ftLastWriteTime.dwLowDateTime=0x636ae7b0, ftLastWriteTime.dwHighDateTime=0x1d4cc1f, nFileSizeHigh=0x0, nFileSizeLow=0x18c8e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="9AAcEoE6H8 3wYJD4.ots", cAlternateFileName="9AACEO~1.OTS")) returned 0 [0219.512] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0219.512] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e27qH-jv\\9AAcEoE6H8 3wYJD4.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\e27qh-jv\\9aaceoe6h8 3wyjd4.ots")) returned 1 [0220.011] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e27qH-jv\\9AAcEoE6H8 3wYJD4.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\e27qh-jv\\9aaceoe6h8 3wyjd4.ots")) returned 0xffffffff [0220.011] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc8a7790, ftCreationTime.dwHighDateTime=0x1d4ce4c, ftLastAccessTime.dwLowDateTime=0xbba684b0, ftLastAccessTime.dwHighDateTime=0x1d4d40e, ftLastWriteTime.dwLowDateTime=0xbba684b0, ftLastWriteTime.dwHighDateTime=0x1d4d40e, nFileSizeHigh=0x0, nFileSizeLow=0x15bf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="OcPkNI8w.pps", cAlternateFileName="")) returned 1 [0220.011] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e27qH-jv\\OcPkNI8w.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\e27qh-jv\\ocpkni8w.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0220.011] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e27qH-jv\\OcPkNI8w.pps.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\e27qh-jv\\ocpkni8w.pps.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0220.012] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15bf1 [0220.012] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0220.012] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0220.102] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x15bf1, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x15bf1, lpOverlapped=0x0) returned 1 [0220.103] WriteFile (in: hFile=0xd4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x15c00, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x15c00, lpOverlapped=0x0) returned 1 [0220.105] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0220.128] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0220.138] CloseHandle (hObject=0xd8) returned 1 [0220.138] CloseHandle (hObject=0xd4) returned 1 [0220.139] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e27qH-jv\\OcPkNI8w.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\e27qh-jv\\ocpkni8w.pps"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e27qH-jv\\OcPkNI8w.pps.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\e27qh-jv\\ocpkni8w.pps.dvodltmf")) returned 0 [0220.140] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e27qH-jv\\OcPkNI8w.pps.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\e27qh-jv\\ocpkni8w.pps.dvodltmf")) returned 0x20 [0220.140] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e27qH-jv\\OcPkNI8w.pps", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc8a7790, ftCreationTime.dwHighDateTime=0x1d4ce4c, ftLastAccessTime.dwLowDateTime=0xbba684b0, ftLastAccessTime.dwHighDateTime=0x1d4d40e, ftLastWriteTime.dwLowDateTime=0xbba684b0, ftLastWriteTime.dwHighDateTime=0x1d4d40e, nFileSizeHigh=0x0, nFileSizeLow=0x15bf1, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="OcPkNI8w.pps", cAlternateFileName="")) returned 0x2e8498 [0220.140] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc8a7790, ftCreationTime.dwHighDateTime=0x1d4ce4c, ftLastAccessTime.dwLowDateTime=0xbba684b0, ftLastAccessTime.dwHighDateTime=0x1d4d40e, ftLastWriteTime.dwLowDateTime=0xbba684b0, ftLastWriteTime.dwHighDateTime=0x1d4d40e, nFileSizeHigh=0x0, nFileSizeLow=0x15bf1, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="OcPkNI8w.pps", cAlternateFileName="")) returned 0 [0220.140] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0220.140] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e27qH-jv\\OcPkNI8w.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\e27qh-jv\\ocpkni8w.pps")) returned 1 [0220.142] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e27qH-jv\\OcPkNI8w.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\e27qh-jv\\ocpkni8w.pps")) returned 0xffffffff [0220.142] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbd33f00, ftCreationTime.dwHighDateTime=0x1d4c57f, ftLastAccessTime.dwLowDateTime=0x9a724000, ftLastAccessTime.dwHighDateTime=0x1d4cd55, ftLastWriteTime.dwLowDateTime=0x9a724000, ftLastWriteTime.dwHighDateTime=0x1d4cd55, nFileSizeHigh=0x0, nFileSizeLow=0x9aa4, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="twPPIMyU4z4b.pptx", cAlternateFileName="TWPPIM~1.PPT")) returned 1 [0220.142] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e27qH-jv\\twPPIMyU4z4b.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\e27qh-jv\\twppimyu4z4b.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0220.142] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e27qH-jv\\twPPIMyU4z4b.pptx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\e27qh-jv\\twppimyu4z4b.pptx.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0220.143] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9aa4 [0220.143] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0220.143] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0220.230] ReadFile (in: hFile=0xd4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x9aa4, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x9aa4, lpOverlapped=0x0) returned 1 [0220.231] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x9ab0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x9ab0, lpOverlapped=0x0) returned 1 [0220.233] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0220.256] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0220.267] CloseHandle (hObject=0xd4) returned 1 [0220.267] CloseHandle (hObject=0xd8) returned 1 [0220.267] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e27qH-jv\\twPPIMyU4z4b.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\e27qh-jv\\twppimyu4z4b.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e27qH-jv\\twPPIMyU4z4b.pptx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\e27qh-jv\\twppimyu4z4b.pptx.dvodltmf")) returned 0 [0220.268] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e27qH-jv\\twPPIMyU4z4b.pptx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\e27qh-jv\\twppimyu4z4b.pptx.dvodltmf")) returned 0x20 [0220.268] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e27qH-jv\\twPPIMyU4z4b.pptx", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbd33f00, ftCreationTime.dwHighDateTime=0x1d4c57f, ftLastAccessTime.dwLowDateTime=0x9a724000, ftLastAccessTime.dwHighDateTime=0x1d4cd55, ftLastWriteTime.dwLowDateTime=0x9a724000, ftLastWriteTime.dwHighDateTime=0x1d4cd55, nFileSizeHigh=0x0, nFileSizeLow=0x9aa4, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="twPPIMyU4z4b.pptx", cAlternateFileName="TWPPIM~1.PPT")) returned 0x2e8498 [0220.269] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbd33f00, ftCreationTime.dwHighDateTime=0x1d4c57f, ftLastAccessTime.dwLowDateTime=0x9a724000, ftLastAccessTime.dwHighDateTime=0x1d4cd55, ftLastWriteTime.dwLowDateTime=0x9a724000, ftLastWriteTime.dwHighDateTime=0x1d4cd55, nFileSizeHigh=0x0, nFileSizeLow=0x9aa4, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="twPPIMyU4z4b.pptx", cAlternateFileName="TWPPIM~1.PPT")) returned 0 [0220.269] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0220.269] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e27qH-jv\\twPPIMyU4z4b.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\e27qh-jv\\twppimyu4z4b.pptx")) returned 1 [0220.270] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e27qH-jv\\twPPIMyU4z4b.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\e27qh-jv\\twppimyu4z4b.pptx")) returned 0xffffffff [0220.270] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbd33f00, ftCreationTime.dwHighDateTime=0x1d4c57f, ftLastAccessTime.dwLowDateTime=0x9a724000, ftLastAccessTime.dwHighDateTime=0x1d4cd55, ftLastWriteTime.dwLowDateTime=0x9a724000, ftLastWriteTime.dwHighDateTime=0x1d4cd55, nFileSizeHigh=0x0, nFileSizeLow=0x9aa4, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="twPPIMyU4z4b.pptx", cAlternateFileName="TWPPIM~1.PPT")) returned 0 [0220.270] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0220.270] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x955e63d0, ftCreationTime.dwHighDateTime=0x1d56b04, ftLastAccessTime.dwLowDateTime=0x6e57eb50, ftLastAccessTime.dwHighDateTime=0x1d53920, ftLastWriteTime.dwLowDateTime=0x6e57eb50, ftLastWriteTime.dwHighDateTime=0x1d53920, nFileSizeHigh=0x0, nFileSizeLow=0x6b34, dwReserved0=0x70702e62, dwReserved1=0x6f2e7874, cFileName="g81m6ECGCroGTY.xlsx", cAlternateFileName="G81M6E~1.XLS")) returned 1 [0220.270] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\g81m6ECGCroGTY.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\g81m6ecgcrogty.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0220.270] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\g81m6ECGCroGTY.xlsx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\g81m6ecgcrogty.xlsx.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0220.271] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6b34 [0220.271] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0220.272] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0220.359] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x6b34, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x6b34, lpOverlapped=0x0) returned 1 [0220.365] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x6b40, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x6b40, lpOverlapped=0x0) returned 1 [0220.366] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0220.388] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0220.399] CloseHandle (hObject=0xec) returned 1 [0220.400] CloseHandle (hObject=0xd8) returned 1 [0220.400] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\g81m6ECGCroGTY.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\g81m6ecgcrogty.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\g81m6ECGCroGTY.xlsx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\g81m6ecgcrogty.xlsx.dvodltmf")) returned 0 [0220.401] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\g81m6ECGCroGTY.xlsx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\g81m6ecgcrogty.xlsx.dvodltmf")) returned 0x20 [0220.401] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\g81m6ECGCroGTY.xlsx", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x955e63d0, ftCreationTime.dwHighDateTime=0x1d56b04, ftLastAccessTime.dwLowDateTime=0x6e57eb50, ftLastAccessTime.dwHighDateTime=0x1d53920, ftLastWriteTime.dwLowDateTime=0x6e57eb50, ftLastWriteTime.dwHighDateTime=0x1d53920, nFileSizeHigh=0x0, nFileSizeLow=0x6b34, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="g81m6ECGCroGTY.xlsx", cAlternateFileName="G81M6E~1.XLS")) returned 0x2e8458 [0220.401] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x955e63d0, ftCreationTime.dwHighDateTime=0x1d56b04, ftLastAccessTime.dwLowDateTime=0x6e57eb50, ftLastAccessTime.dwHighDateTime=0x1d53920, ftLastWriteTime.dwLowDateTime=0x6e57eb50, ftLastWriteTime.dwHighDateTime=0x1d53920, nFileSizeHigh=0x0, nFileSizeLow=0x6b34, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="g81m6ECGCroGTY.xlsx", cAlternateFileName="G81M6E~1.XLS")) returned 0 [0220.401] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0220.401] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\g81m6ECGCroGTY.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\g81m6ecgcrogty.xlsx")) returned 1 [0220.403] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\g81m6ECGCroGTY.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\g81m6ecgcrogty.xlsx")) returned 0xffffffff [0220.404] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60fd1d40, ftCreationTime.dwHighDateTime=0x1d536e1, ftLastAccessTime.dwLowDateTime=0x70cb8080, ftLastAccessTime.dwHighDateTime=0x1d59e43, ftLastWriteTime.dwLowDateTime=0x70cb8080, ftLastWriteTime.dwHighDateTime=0x1d59e43, nFileSizeHigh=0x0, nFileSizeLow=0x6432, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIzzqolE22rY6ywiGA.pptx", cAlternateFileName="GIZZQO~1.PPT")) returned 1 [0220.404] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GIzzqolE22rY6ywiGA.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gizzqole22ry6ywiga.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0220.404] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GIzzqolE22rY6ywiGA.pptx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gizzqole22ry6ywiga.pptx.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0220.405] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6432 [0220.405] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0220.405] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0220.501] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x6432, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x6432, lpOverlapped=0x0) returned 1 [0220.502] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x6440, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x6440, lpOverlapped=0x0) returned 1 [0220.504] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0220.526] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0220.537] CloseHandle (hObject=0xd8) returned 1 [0220.537] CloseHandle (hObject=0xec) returned 1 [0220.538] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GIzzqolE22rY6ywiGA.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gizzqole22ry6ywiga.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GIzzqolE22rY6ywiGA.pptx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gizzqole22ry6ywiga.pptx.dvodltmf")) returned 0 [0220.539] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GIzzqolE22rY6ywiGA.pptx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gizzqole22ry6ywiga.pptx.dvodltmf")) returned 0x20 [0220.539] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GIzzqolE22rY6ywiGA.pptx", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60fd1d40, ftCreationTime.dwHighDateTime=0x1d536e1, ftLastAccessTime.dwLowDateTime=0x70cb8080, ftLastAccessTime.dwHighDateTime=0x1d59e43, ftLastWriteTime.dwLowDateTime=0x70cb8080, ftLastWriteTime.dwHighDateTime=0x1d59e43, nFileSizeHigh=0x0, nFileSizeLow=0x6432, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="GIzzqolE22rY6ywiGA.pptx", cAlternateFileName="GIZZQO~1.PPT")) returned 0x2e8458 [0220.539] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60fd1d40, ftCreationTime.dwHighDateTime=0x1d536e1, ftLastAccessTime.dwLowDateTime=0x70cb8080, ftLastAccessTime.dwHighDateTime=0x1d59e43, ftLastWriteTime.dwLowDateTime=0x70cb8080, ftLastWriteTime.dwHighDateTime=0x1d59e43, nFileSizeHigh=0x0, nFileSizeLow=0x6432, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="GIzzqolE22rY6ywiGA.pptx", cAlternateFileName="GIZZQO~1.PPT")) returned 0 [0220.539] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0220.539] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GIzzqolE22rY6ywiGA.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gizzqole22ry6ywiga.pptx")) returned 1 [0220.541] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GIzzqolE22rY6ywiGA.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gizzqole22ry6ywiga.pptx")) returned 0xffffffff [0220.541] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x798d88d0, ftCreationTime.dwHighDateTime=0x1d534a3, ftLastAccessTime.dwLowDateTime=0x5b3ff070, ftLastAccessTime.dwHighDateTime=0x1d5866a, ftLastWriteTime.dwLowDateTime=0x5b3ff070, ftLastWriteTime.dwHighDateTime=0x1d5866a, nFileSizeHigh=0x0, nFileSizeLow=0xc339, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="Gm91LIlj.docx", cAlternateFileName="GM91LI~1.DOC")) returned 1 [0220.541] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Gm91LIlj.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gm91lilj.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0220.541] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Gm91LIlj.docx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gm91lilj.docx.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0220.542] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc339 [0220.542] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0220.542] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0220.641] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xc339, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0xc339, lpOverlapped=0x0) returned 1 [0220.642] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc340, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0xc340, lpOverlapped=0x0) returned 1 [0220.644] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0220.666] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0220.678] CloseHandle (hObject=0xec) returned 1 [0220.678] CloseHandle (hObject=0xd8) returned 1 [0220.678] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Gm91LIlj.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gm91lilj.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Gm91LIlj.docx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gm91lilj.docx.dvodltmf")) returned 0 [0220.679] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Gm91LIlj.docx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gm91lilj.docx.dvodltmf")) returned 0x20 [0220.679] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Gm91LIlj.docx", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x798d88d0, ftCreationTime.dwHighDateTime=0x1d534a3, ftLastAccessTime.dwLowDateTime=0x5b3ff070, ftLastAccessTime.dwHighDateTime=0x1d5866a, ftLastWriteTime.dwLowDateTime=0x5b3ff070, ftLastWriteTime.dwHighDateTime=0x1d5866a, nFileSizeHigh=0x0, nFileSizeLow=0xc339, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Gm91LIlj.docx", cAlternateFileName="GM91LI~1.DOC")) returned 0x2e8458 [0220.680] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x798d88d0, ftCreationTime.dwHighDateTime=0x1d534a3, ftLastAccessTime.dwLowDateTime=0x5b3ff070, ftLastAccessTime.dwHighDateTime=0x1d5866a, ftLastWriteTime.dwLowDateTime=0x5b3ff070, ftLastWriteTime.dwHighDateTime=0x1d5866a, nFileSizeHigh=0x0, nFileSizeLow=0xc339, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Gm91LIlj.docx", cAlternateFileName="GM91LI~1.DOC")) returned 0 [0220.680] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0220.680] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Gm91LIlj.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gm91lilj.docx")) returned 1 [0220.681] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Gm91LIlj.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gm91lilj.docx")) returned 0xffffffff [0220.681] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a0dfb30, ftCreationTime.dwHighDateTime=0x1d4cc51, ftLastAccessTime.dwLowDateTime=0xf3c757c0, ftLastAccessTime.dwHighDateTime=0x1d4c919, ftLastWriteTime.dwLowDateTime=0xf3c757c0, ftLastWriteTime.dwHighDateTime=0x1d4c919, nFileSizeHigh=0x0, nFileSizeLow=0x150cb, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="jCU5Ya9sOXF7kCd.ods", cAlternateFileName="JCU5YA~1.ODS")) returned 1 [0220.681] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jCU5Ya9sOXF7kCd.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jcu5ya9soxf7kcd.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0220.681] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jCU5Ya9sOXF7kCd.ods.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jcu5ya9soxf7kcd.ods.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0220.682] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x150cb [0220.683] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0220.683] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0220.797] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x150cb, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x150cb, lpOverlapped=0x0) returned 1 [0220.799] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x150d0, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x150d0, lpOverlapped=0x0) returned 1 [0220.801] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0220.824] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0220.835] CloseHandle (hObject=0xd8) returned 1 [0220.835] CloseHandle (hObject=0xec) returned 1 [0220.835] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jCU5Ya9sOXF7kCd.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jcu5ya9soxf7kcd.ods"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jCU5Ya9sOXF7kCd.ods.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jcu5ya9soxf7kcd.ods.dvodltmf")) returned 0 [0220.836] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jCU5Ya9sOXF7kCd.ods.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jcu5ya9soxf7kcd.ods.dvodltmf")) returned 0x20 [0220.837] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jCU5Ya9sOXF7kCd.ods", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a0dfb30, ftCreationTime.dwHighDateTime=0x1d4cc51, ftLastAccessTime.dwLowDateTime=0xf3c757c0, ftLastAccessTime.dwHighDateTime=0x1d4c919, ftLastWriteTime.dwLowDateTime=0xf3c757c0, ftLastWriteTime.dwHighDateTime=0x1d4c919, nFileSizeHigh=0x0, nFileSizeLow=0x150cb, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="jCU5Ya9sOXF7kCd.ods", cAlternateFileName="JCU5YA~1.ODS")) returned 0x2e8458 [0220.837] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a0dfb30, ftCreationTime.dwHighDateTime=0x1d4cc51, ftLastAccessTime.dwLowDateTime=0xf3c757c0, ftLastAccessTime.dwHighDateTime=0x1d4c919, ftLastWriteTime.dwLowDateTime=0xf3c757c0, ftLastWriteTime.dwHighDateTime=0x1d4c919, nFileSizeHigh=0x0, nFileSizeLow=0x150cb, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="jCU5Ya9sOXF7kCd.ods", cAlternateFileName="JCU5YA~1.ODS")) returned 0 [0220.837] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0220.837] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jCU5Ya9sOXF7kCd.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jcu5ya9soxf7kcd.ods")) returned 1 [0220.839] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jCU5Ya9sOXF7kCd.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jcu5ya9soxf7kcd.ods")) returned 0xffffffff [0220.839] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12cca90, ftCreationTime.dwHighDateTime=0x1d4ce82, ftLastAccessTime.dwLowDateTime=0x72703b30, ftLastAccessTime.dwHighDateTime=0x1d4ce8f, ftLastWriteTime.dwLowDateTime=0x72703b30, ftLastWriteTime.dwHighDateTime=0x1d4ce8f, nFileSizeHigh=0x0, nFileSizeLow=0xaa70, dwReserved0=0x0, dwReserved1=0x0, cFileName="L2XwmTRRwQf6I.rtf", cAlternateFileName="L2XWMT~1.RTF")) returned 1 [0220.839] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\L2XwmTRRwQf6I.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\l2xwmtrrwqf6i.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0220.839] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\L2XwmTRRwQf6I.rtf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\l2xwmtrrwqf6i.rtf.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0220.840] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaa70 [0220.840] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0220.840] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0220.933] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xaa70, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0xaa70, lpOverlapped=0x0) returned 1 [0220.935] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xaa80, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0xaa80, lpOverlapped=0x0) returned 1 [0220.938] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0220.960] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0220.971] CloseHandle (hObject=0xec) returned 1 [0220.972] CloseHandle (hObject=0xd8) returned 1 [0220.972] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\L2XwmTRRwQf6I.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\l2xwmtrrwqf6i.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\L2XwmTRRwQf6I.rtf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\l2xwmtrrwqf6i.rtf.dvodltmf")) returned 0 [0220.974] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\L2XwmTRRwQf6I.rtf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\l2xwmtrrwqf6i.rtf.dvodltmf")) returned 0x20 [0220.974] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\L2XwmTRRwQf6I.rtf", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12cca90, ftCreationTime.dwHighDateTime=0x1d4ce82, ftLastAccessTime.dwLowDateTime=0x72703b30, ftLastAccessTime.dwHighDateTime=0x1d4ce8f, ftLastWriteTime.dwLowDateTime=0x72703b30, ftLastWriteTime.dwHighDateTime=0x1d4ce8f, nFileSizeHigh=0x0, nFileSizeLow=0xaa70, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="L2XwmTRRwQf6I.rtf", cAlternateFileName="L2XWMT~1.RTF")) returned 0x2e8458 [0220.974] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12cca90, ftCreationTime.dwHighDateTime=0x1d4ce82, ftLastAccessTime.dwLowDateTime=0x72703b30, ftLastAccessTime.dwHighDateTime=0x1d4ce8f, ftLastWriteTime.dwLowDateTime=0x72703b30, ftLastWriteTime.dwHighDateTime=0x1d4ce8f, nFileSizeHigh=0x0, nFileSizeLow=0xaa70, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="L2XwmTRRwQf6I.rtf", cAlternateFileName="L2XWMT~1.RTF")) returned 0 [0220.974] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0220.974] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\L2XwmTRRwQf6I.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\l2xwmtrrwqf6i.rtf")) returned 1 [0220.976] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\L2XwmTRRwQf6I.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\l2xwmtrrwqf6i.rtf")) returned 0xffffffff [0220.976] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0220.976] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2cf6b0, ftCreationTime.dwLowDateTime=0x18f544, ftCreationTime.dwHighDateTime=0x7715e003, ftLastAccessTime.dwLowDateTime=0xffffffff, ftLastAccessTime.dwHighDateTime=0x18f578, ftLastWriteTime.dwLowDateTime=0x1c21844, ftLastWriteTime.dwHighDateTime=0x2cf6b0, nFileSizeHigh=0x18f558, nFileSizeLow=0x7715e688, dwReserved0=0x2c0000, dwReserved1=0x0, cFileName="¸ö,", cAlternateFileName="\x18\x84.")) returned 0xffffffff [0220.977] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0220.977] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2cf6b0, ftCreationTime.dwLowDateTime=0x18f544, ftCreationTime.dwHighDateTime=0x7715e003, ftLastAccessTime.dwLowDateTime=0xffffffff, ftLastAccessTime.dwHighDateTime=0x18f578, ftLastWriteTime.dwLowDateTime=0x1c21844, ftLastWriteTime.dwHighDateTime=0x2cf6b0, nFileSizeHigh=0x18f558, nFileSizeLow=0x7715e688, dwReserved0=0x2c0000, dwReserved1=0x0, cFileName="¸ö,", cAlternateFileName="\x18\x84.")) returned 0xffffffff [0220.977] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0220.977] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0220.979] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.979] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x72, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0220.979] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0220.980] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0220.982] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd8 [0220.982] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0220.983] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0221.071] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0xd8, lpOverlapped=0x0) returned 1 [0221.072] WriteFile (in: hFile=0xd4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0xe0, lpOverlapped=0x0) returned 1 [0221.073] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0221.095] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0221.106] CloseHandle (hObject=0xec) returned 1 [0221.106] CloseHandle (hObject=0xd4) returned 1 [0221.106] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\desktop.ini.dvodltmf")) returned 0 [0221.107] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\desktop.ini.dvodltmf")) returned 0x20 [0221.107] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8498 [0221.107] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0221.107] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0221.108] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\desktop.ini")) returned 1 [0221.109] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\desktop.ini")) returned 0xffffffff [0221.109] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9e9e4460, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9e9e4460, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="Favorites.vss", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0221.109] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0221.109] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0221.110] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0221.110] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0221.110] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0221.197] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x10, lpOverlapped=0x0) returned 1 [0221.198] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0221.220] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0221.231] CloseHandle (hObject=0xd4) returned 1 [0221.231] CloseHandle (hObject=0xec) returned 1 [0221.231] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss.dvodltmf")) returned 0 [0221.232] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss.dvodltmf")) returned 0x20 [0221.232] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9e9e4460, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9e9e4460, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Favorites.vss", cAlternateFileName="FAVORI~1.VSS")) returned 0x2e8498 [0221.232] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9e9e4460, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9e9e4460, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Favorites.vss", cAlternateFileName="FAVORI~1.VSS")) returned 0 [0221.232] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0221.232] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss")) returned 1 [0221.233] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss")) returned 0xffffffff [0221.233] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="_private", cAlternateFileName="")) returned 1 [0221.233] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0221.234] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.234] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x7e, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0221.234] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0221.235] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0221.235] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x74e6 [0221.235] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0221.236] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0221.342] ReadFile (in: hFile=0xd4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x74e6, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x74e6, lpOverlapped=0x0) returned 1 [0221.344] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x74f0, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x74f0, lpOverlapped=0x0) returned 1 [0221.346] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0221.382] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0221.393] CloseHandle (hObject=0xd4) returned 1 [0221.393] CloseHandle (hObject=0xdc) returned 1 [0221.393] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico.dvodltmf")) returned 0 [0221.394] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico.dvodltmf")) returned 0x20 [0221.395] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="folder.ico", cAlternateFileName="")) returned 0x2e84d8 [0221.395] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="folder.ico", cAlternateFileName="")) returned 0 [0221.395] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0221.395] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico")) returned 1 [0221.396] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico")) returned 0xffffffff [0221.396] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x7e, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 0 [0221.396] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0221.396] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="_private", cAlternateFileName="")) returned 0 [0221.396] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0221.396] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0221.396] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="_private", cAlternateFileName="\x18\x84.")) returned 0xffffffff [0221.397] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42612ea0, ftCreationTime.dwHighDateTime=0x1d4d47e, ftLastAccessTime.dwLowDateTime=0xe0a984f0, ftLastAccessTime.dwHighDateTime=0x1d4d211, ftLastWriteTime.dwLowDateTime=0xe0a984f0, ftLastWriteTime.dwHighDateTime=0x1d4d211, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="o4uP", cAlternateFileName="")) returned 1 [0221.397] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42612ea0, ftCreationTime.dwHighDateTime=0x1d4d47e, ftLastAccessTime.dwLowDateTime=0xe0a984f0, ftLastAccessTime.dwHighDateTime=0x1d4d211, ftLastWriteTime.dwLowDateTime=0xe0a984f0, ftLastWriteTime.dwHighDateTime=0x1d4d211, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0221.397] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42612ea0, ftCreationTime.dwHighDateTime=0x1d4d47e, ftLastAccessTime.dwLowDateTime=0xe0a984f0, ftLastAccessTime.dwHighDateTime=0x1d4d211, ftLastWriteTime.dwLowDateTime=0xe0a984f0, ftLastWriteTime.dwHighDateTime=0x1d4d211, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="..", cAlternateFileName="")) returned 1 [0221.397] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9193dda0, ftCreationTime.dwHighDateTime=0x1d4c93a, ftLastAccessTime.dwLowDateTime=0x83042580, ftLastAccessTime.dwHighDateTime=0x1d4c75d, ftLastWriteTime.dwLowDateTime=0x83042580, ftLastWriteTime.dwHighDateTime=0x1d4c75d, nFileSizeHigh=0x0, nFileSizeLow=0x11c03, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="-3aYPU.docx", cAlternateFileName="-3AYPU~1.DOC")) returned 1 [0221.397] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\-3aYPU.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\-3aypu.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0221.397] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\-3aYPU.docx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\-3aypu.docx.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0221.398] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11c03 [0221.398] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0221.398] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0221.493] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x11c03, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x11c03, lpOverlapped=0x0) returned 1 [0221.495] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x11c10, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x11c10, lpOverlapped=0x0) returned 1 [0221.497] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0221.522] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0221.533] CloseHandle (hObject=0xec) returned 1 [0221.533] CloseHandle (hObject=0xdc) returned 1 [0221.533] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\-3aYPU.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\-3aypu.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\-3aYPU.docx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\-3aypu.docx.dvodltmf")) returned 0 [0221.534] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\-3aYPU.docx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\-3aypu.docx.dvodltmf")) returned 0x20 [0221.534] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\-3aYPU.docx", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9193dda0, ftCreationTime.dwHighDateTime=0x1d4c93a, ftLastAccessTime.dwLowDateTime=0x83042580, ftLastAccessTime.dwHighDateTime=0x1d4c75d, ftLastWriteTime.dwLowDateTime=0x83042580, ftLastWriteTime.dwHighDateTime=0x1d4c75d, nFileSizeHigh=0x0, nFileSizeLow=0x11c03, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="-3aYPU.docx", cAlternateFileName="-3AYPU~1.DOC")) returned 0x2e8498 [0221.535] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9193dda0, ftCreationTime.dwHighDateTime=0x1d4c93a, ftLastAccessTime.dwLowDateTime=0x83042580, ftLastAccessTime.dwHighDateTime=0x1d4c75d, ftLastWriteTime.dwLowDateTime=0x83042580, ftLastWriteTime.dwHighDateTime=0x1d4c75d, nFileSizeHigh=0x0, nFileSizeLow=0x11c03, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="-3aYPU.docx", cAlternateFileName="-3AYPU~1.DOC")) returned 0 [0221.535] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0221.535] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\-3aYPU.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\-3aypu.docx")) returned 1 [0221.537] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\-3aYPU.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\-3aypu.docx")) returned 0xffffffff [0221.537] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16e7ef10, ftCreationTime.dwHighDateTime=0x1d4ca20, ftLastAccessTime.dwLowDateTime=0xf12b9e30, ftLastAccessTime.dwHighDateTime=0x1d4c76c, ftLastWriteTime.dwLowDateTime=0xf12b9e30, ftLastWriteTime.dwHighDateTime=0x1d4c76c, nFileSizeHigh=0x0, nFileSizeLow=0x17f27, dwReserved0=0x0, dwReserved1=0x0, cFileName="31Q pP.ods", cAlternateFileName="31QPP~1.ODS")) returned 1 [0221.537] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\31Q pP.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\31q pp.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0221.537] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\31Q pP.ods.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\31q pp.ods.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0221.537] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17f27 [0221.538] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0221.538] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0221.638] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x17f27, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x17f27, lpOverlapped=0x0) returned 1 [0221.640] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x17f30, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x17f30, lpOverlapped=0x0) returned 1 [0221.643] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0221.665] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0221.676] CloseHandle (hObject=0xdc) returned 1 [0221.676] CloseHandle (hObject=0xec) returned 1 [0221.676] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\31Q pP.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\31q pp.ods"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\31Q pP.ods.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\31q pp.ods.dvodltmf")) returned 0 [0221.677] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\31Q pP.ods.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\31q pp.ods.dvodltmf")) returned 0x20 [0221.677] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\31Q pP.ods", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16e7ef10, ftCreationTime.dwHighDateTime=0x1d4ca20, ftLastAccessTime.dwLowDateTime=0xf12b9e30, ftLastAccessTime.dwHighDateTime=0x1d4c76c, ftLastWriteTime.dwLowDateTime=0xf12b9e30, ftLastWriteTime.dwHighDateTime=0x1d4c76c, nFileSizeHigh=0x0, nFileSizeLow=0x17f27, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="31Q pP.ods", cAlternateFileName="31QPP~1.ODS")) returned 0x2e8498 [0221.677] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16e7ef10, ftCreationTime.dwHighDateTime=0x1d4ca20, ftLastAccessTime.dwLowDateTime=0xf12b9e30, ftLastAccessTime.dwHighDateTime=0x1d4c76c, ftLastWriteTime.dwLowDateTime=0xf12b9e30, ftLastWriteTime.dwHighDateTime=0x1d4c76c, nFileSizeHigh=0x0, nFileSizeLow=0x17f27, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="31Q pP.ods", cAlternateFileName="31QPP~1.ODS")) returned 0 [0221.677] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0221.677] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\31Q pP.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\31q pp.ods")) returned 1 [0221.679] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\31Q pP.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\31q pp.ods")) returned 0xffffffff [0221.679] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce0c19a0, ftCreationTime.dwHighDateTime=0x1d4d39e, ftLastAccessTime.dwLowDateTime=0xc2ecc570, ftLastAccessTime.dwHighDateTime=0x1d4ce66, ftLastWriteTime.dwLowDateTime=0xc2ecc570, ftLastWriteTime.dwHighDateTime=0x1d4ce66, nFileSizeHigh=0x0, nFileSizeLow=0x95dc, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="6fOsplrpzN.ods", cAlternateFileName="6FOSPL~1.ODS")) returned 1 [0221.679] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\6fOsplrpzN.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\6fosplrpzn.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0221.679] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\6fOsplrpzN.ods.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\6fosplrpzn.ods.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0221.680] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x95dc [0221.680] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0221.680] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0221.770] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x95dc, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x95dc, lpOverlapped=0x0) returned 1 [0221.771] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x95e0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x95e0, lpOverlapped=0x0) returned 1 [0221.772] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0221.796] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0221.807] CloseHandle (hObject=0xec) returned 1 [0221.807] CloseHandle (hObject=0xdc) returned 1 [0221.807] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\6fOsplrpzN.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\6fosplrpzn.ods"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\6fOsplrpzN.ods.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\6fosplrpzn.ods.dvodltmf")) returned 0 [0221.808] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\6fOsplrpzN.ods.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\6fosplrpzn.ods.dvodltmf")) returned 0x20 [0221.808] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\6fOsplrpzN.ods", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce0c19a0, ftCreationTime.dwHighDateTime=0x1d4d39e, ftLastAccessTime.dwLowDateTime=0xc2ecc570, ftLastAccessTime.dwHighDateTime=0x1d4ce66, ftLastWriteTime.dwLowDateTime=0xc2ecc570, ftLastWriteTime.dwHighDateTime=0x1d4ce66, nFileSizeHigh=0x0, nFileSizeLow=0x95dc, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="6fOsplrpzN.ods", cAlternateFileName="6FOSPL~1.ODS")) returned 0x2e8498 [0221.808] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce0c19a0, ftCreationTime.dwHighDateTime=0x1d4d39e, ftLastAccessTime.dwLowDateTime=0xc2ecc570, ftLastAccessTime.dwHighDateTime=0x1d4ce66, ftLastWriteTime.dwLowDateTime=0xc2ecc570, ftLastWriteTime.dwHighDateTime=0x1d4ce66, nFileSizeHigh=0x0, nFileSizeLow=0x95dc, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="6fOsplrpzN.ods", cAlternateFileName="6FOSPL~1.ODS")) returned 0 [0221.808] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0221.808] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\6fOsplrpzN.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\6fosplrpzn.ods")) returned 1 [0221.810] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\6fOsplrpzN.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\6fosplrpzn.ods")) returned 0xffffffff [0221.810] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf56ac660, ftCreationTime.dwHighDateTime=0x1d4c94c, ftLastAccessTime.dwLowDateTime=0x8018ff80, ftLastAccessTime.dwHighDateTime=0x1d4c5c8, ftLastWriteTime.dwLowDateTime=0x8018ff80, ftLastWriteTime.dwHighDateTime=0x1d4c5c8, nFileSizeHigh=0x0, nFileSizeLow=0x43ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="6ZeRihtSXKkhKq9.xlsx", cAlternateFileName="6ZERIH~1.XLS")) returned 1 [0221.810] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\6ZeRihtSXKkhKq9.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\6zerihtsxkkhkq9.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0221.810] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\6ZeRihtSXKkhKq9.xlsx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\6zerihtsxkkhkq9.xlsx.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0221.811] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43ae [0221.811] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0221.811] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0221.915] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x43ae, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x43ae, lpOverlapped=0x0) returned 1 [0221.916] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x43b0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x43b0, lpOverlapped=0x0) returned 1 [0221.918] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0221.945] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0221.957] CloseHandle (hObject=0xdc) returned 1 [0221.957] CloseHandle (hObject=0xec) returned 1 [0221.958] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\6ZeRihtSXKkhKq9.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\6zerihtsxkkhkq9.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\6ZeRihtSXKkhKq9.xlsx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\6zerihtsxkkhkq9.xlsx.dvodltmf")) returned 0 [0221.959] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\6ZeRihtSXKkhKq9.xlsx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\6zerihtsxkkhkq9.xlsx.dvodltmf")) returned 0x20 [0221.959] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\6ZeRihtSXKkhKq9.xlsx", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf56ac660, ftCreationTime.dwHighDateTime=0x1d4c94c, ftLastAccessTime.dwLowDateTime=0x8018ff80, ftLastAccessTime.dwHighDateTime=0x1d4c5c8, ftLastWriteTime.dwLowDateTime=0x8018ff80, ftLastWriteTime.dwHighDateTime=0x1d4c5c8, nFileSizeHigh=0x0, nFileSizeLow=0x43ae, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="6ZeRihtSXKkhKq9.xlsx", cAlternateFileName="6ZERIH~1.XLS")) returned 0x2e8498 [0221.960] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf56ac660, ftCreationTime.dwHighDateTime=0x1d4c94c, ftLastAccessTime.dwLowDateTime=0x8018ff80, ftLastAccessTime.dwHighDateTime=0x1d4c5c8, ftLastWriteTime.dwLowDateTime=0x8018ff80, ftLastWriteTime.dwHighDateTime=0x1d4c5c8, nFileSizeHigh=0x0, nFileSizeLow=0x43ae, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="6ZeRihtSXKkhKq9.xlsx", cAlternateFileName="6ZERIH~1.XLS")) returned 0 [0221.960] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0221.960] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\6ZeRihtSXKkhKq9.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\6zerihtsxkkhkq9.xlsx")) returned 1 [0221.962] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\6ZeRihtSXKkhKq9.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\6zerihtsxkkhkq9.xlsx")) returned 0xffffffff [0221.963] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38943bc0, ftCreationTime.dwHighDateTime=0x1d4cedd, ftLastAccessTime.dwLowDateTime=0x3f33070, ftLastAccessTime.dwHighDateTime=0x1d4d099, ftLastWriteTime.dwLowDateTime=0x3f33070, ftLastWriteTime.dwHighDateTime=0x1d4d099, nFileSizeHigh=0x0, nFileSizeLow=0x15fa9, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="8 fmo.ppt", cAlternateFileName="8FMO~1.PPT")) returned 1 [0221.963] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\8 fmo.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\8 fmo.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0221.963] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\8 fmo.ppt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\8 fmo.ppt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0221.964] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15fa9 [0221.964] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0221.964] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0222.091] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x15fa9, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x15fa9, lpOverlapped=0x0) returned 1 [0222.093] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x15fb0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x15fb0, lpOverlapped=0x0) returned 1 [0222.095] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0222.118] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0222.130] CloseHandle (hObject=0xec) returned 1 [0222.130] CloseHandle (hObject=0xdc) returned 1 [0222.130] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\8 fmo.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\8 fmo.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\8 fmo.ppt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\8 fmo.ppt.dvodltmf")) returned 0 [0222.131] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\8 fmo.ppt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\8 fmo.ppt.dvodltmf")) returned 0x20 [0222.131] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\8 fmo.ppt", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38943bc0, ftCreationTime.dwHighDateTime=0x1d4cedd, ftLastAccessTime.dwLowDateTime=0x3f33070, ftLastAccessTime.dwHighDateTime=0x1d4d099, ftLastWriteTime.dwLowDateTime=0x3f33070, ftLastWriteTime.dwHighDateTime=0x1d4d099, nFileSizeHigh=0x0, nFileSizeLow=0x15fa9, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="8 fmo.ppt", cAlternateFileName="8FMO~1.PPT")) returned 0x2e8498 [0222.131] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38943bc0, ftCreationTime.dwHighDateTime=0x1d4cedd, ftLastAccessTime.dwLowDateTime=0x3f33070, ftLastAccessTime.dwHighDateTime=0x1d4d099, ftLastWriteTime.dwLowDateTime=0x3f33070, ftLastWriteTime.dwHighDateTime=0x1d4d099, nFileSizeHigh=0x0, nFileSizeLow=0x15fa9, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="8 fmo.ppt", cAlternateFileName="8FMO~1.PPT")) returned 0 [0222.131] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0222.131] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\8 fmo.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\8 fmo.ppt")) returned 1 [0222.133] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\8 fmo.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\8 fmo.ppt")) returned 0xffffffff [0222.133] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a4f270, ftCreationTime.dwHighDateTime=0x1d4c7a2, ftLastAccessTime.dwLowDateTime=0x26185570, ftLastAccessTime.dwHighDateTime=0x1d4d05a, ftLastWriteTime.dwLowDateTime=0x26185570, ftLastWriteTime.dwHighDateTime=0x1d4d05a, nFileSizeHigh=0x0, nFileSizeLow=0x647b, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="dMF-.docx", cAlternateFileName="DMF-~1.DOC")) returned 1 [0222.133] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\dMF-.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\dmf-.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0222.133] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\dMF-.docx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\dmf-.docx.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0222.134] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x647b [0222.134] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0222.135] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0222.224] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x647b, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x647b, lpOverlapped=0x0) returned 1 [0222.225] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x6480, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x6480, lpOverlapped=0x0) returned 1 [0222.227] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0222.250] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0222.261] CloseHandle (hObject=0xdc) returned 1 [0222.261] CloseHandle (hObject=0xec) returned 1 [0222.261] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\dMF-.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\dmf-.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\dMF-.docx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\dmf-.docx.dvodltmf")) returned 0 [0222.262] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\dMF-.docx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\dmf-.docx.dvodltmf")) returned 0x20 [0222.262] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\dMF-.docx", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a4f270, ftCreationTime.dwHighDateTime=0x1d4c7a2, ftLastAccessTime.dwLowDateTime=0x26185570, ftLastAccessTime.dwHighDateTime=0x1d4d05a, ftLastWriteTime.dwLowDateTime=0x26185570, ftLastWriteTime.dwHighDateTime=0x1d4d05a, nFileSizeHigh=0x0, nFileSizeLow=0x647b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="dMF-.docx", cAlternateFileName="DMF-~1.DOC")) returned 0x2e8498 [0222.262] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a4f270, ftCreationTime.dwHighDateTime=0x1d4c7a2, ftLastAccessTime.dwLowDateTime=0x26185570, ftLastAccessTime.dwHighDateTime=0x1d4d05a, ftLastWriteTime.dwLowDateTime=0x26185570, ftLastWriteTime.dwHighDateTime=0x1d4d05a, nFileSizeHigh=0x0, nFileSizeLow=0x647b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="dMF-.docx", cAlternateFileName="DMF-~1.DOC")) returned 0 [0222.262] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0222.262] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\dMF-.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\dmf-.docx")) returned 1 [0222.264] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\dMF-.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\dmf-.docx")) returned 0xffffffff [0222.264] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7da0d00, ftCreationTime.dwHighDateTime=0x1d4d259, ftLastAccessTime.dwLowDateTime=0xd9373db0, ftLastAccessTime.dwHighDateTime=0x1d4d4f1, ftLastWriteTime.dwLowDateTime=0xd9373db0, ftLastWriteTime.dwHighDateTime=0x1d4d4f1, nFileSizeHigh=0x0, nFileSizeLow=0x73c9, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="dyxnQIlp.csv", cAlternateFileName="")) returned 1 [0222.264] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\dyxnQIlp.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\dyxnqilp.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0222.264] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\dyxnQIlp.csv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\dyxnqilp.csv.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0222.265] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x73c9 [0222.265] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0222.265] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0222.352] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x73c9, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x73c9, lpOverlapped=0x0) returned 1 [0222.353] WriteFile (in: hFile=0xdc, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x73d0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x73d0, lpOverlapped=0x0) returned 1 [0222.354] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0222.384] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0222.395] CloseHandle (hObject=0xec) returned 1 [0222.395] CloseHandle (hObject=0xdc) returned 1 [0222.395] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\dyxnQIlp.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\dyxnqilp.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\dyxnQIlp.csv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\dyxnqilp.csv.dvodltmf")) returned 0 [0222.396] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\dyxnQIlp.csv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\dyxnqilp.csv.dvodltmf")) returned 0x20 [0222.396] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\dyxnQIlp.csv", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7da0d00, ftCreationTime.dwHighDateTime=0x1d4d259, ftLastAccessTime.dwLowDateTime=0xd9373db0, ftLastAccessTime.dwHighDateTime=0x1d4d4f1, ftLastWriteTime.dwLowDateTime=0xd9373db0, ftLastWriteTime.dwHighDateTime=0x1d4d4f1, nFileSizeHigh=0x0, nFileSizeLow=0x73c9, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="dyxnQIlp.csv", cAlternateFileName="")) returned 0x2e8498 [0222.397] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7da0d00, ftCreationTime.dwHighDateTime=0x1d4d259, ftLastAccessTime.dwLowDateTime=0xd9373db0, ftLastAccessTime.dwHighDateTime=0x1d4d4f1, ftLastWriteTime.dwLowDateTime=0xd9373db0, ftLastWriteTime.dwHighDateTime=0x1d4d4f1, nFileSizeHigh=0x0, nFileSizeLow=0x73c9, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="dyxnQIlp.csv", cAlternateFileName="")) returned 0 [0222.397] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0222.397] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\dyxnQIlp.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\dyxnqilp.csv")) returned 1 [0222.398] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\dyxnQIlp.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\dyxnqilp.csv")) returned 0xffffffff [0222.398] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2babf770, ftCreationTime.dwHighDateTime=0x1d4cd13, ftLastAccessTime.dwLowDateTime=0xb3cb80f0, ftLastAccessTime.dwHighDateTime=0x1d4d577, ftLastWriteTime.dwLowDateTime=0xb3cb80f0, ftLastWriteTime.dwHighDateTime=0x1d4d577, nFileSizeHigh=0x0, nFileSizeLow=0x98e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu3HQB.odp", cAlternateFileName="")) returned 1 [0222.398] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\hu3HQB.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\hu3hqb.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0222.398] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\hu3HQB.odp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\hu3hqb.odp.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0222.399] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x98e7 [0222.399] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0222.399] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0222.506] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x98e7, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x98e7, lpOverlapped=0x0) returned 1 [0222.507] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x98f0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x98f0, lpOverlapped=0x0) returned 1 [0222.509] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0222.532] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0222.543] CloseHandle (hObject=0xdc) returned 1 [0222.543] CloseHandle (hObject=0xec) returned 1 [0222.544] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\hu3HQB.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\hu3hqb.odp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\hu3HQB.odp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\hu3hqb.odp.dvodltmf")) returned 0 [0222.545] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\hu3HQB.odp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\hu3hqb.odp.dvodltmf")) returned 0x20 [0222.545] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\hu3HQB.odp", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2babf770, ftCreationTime.dwHighDateTime=0x1d4cd13, ftLastAccessTime.dwLowDateTime=0xb3cb80f0, ftLastAccessTime.dwHighDateTime=0x1d4d577, ftLastWriteTime.dwLowDateTime=0xb3cb80f0, ftLastWriteTime.dwHighDateTime=0x1d4d577, nFileSizeHigh=0x0, nFileSizeLow=0x98e7, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="hu3HQB.odp", cAlternateFileName="")) returned 0x2e8498 [0222.545] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2babf770, ftCreationTime.dwHighDateTime=0x1d4cd13, ftLastAccessTime.dwLowDateTime=0xb3cb80f0, ftLastAccessTime.dwHighDateTime=0x1d4d577, ftLastWriteTime.dwLowDateTime=0xb3cb80f0, ftLastWriteTime.dwHighDateTime=0x1d4d577, nFileSizeHigh=0x0, nFileSizeLow=0x98e7, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="hu3HQB.odp", cAlternateFileName="")) returned 0 [0222.545] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0222.545] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\hu3HQB.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\hu3hqb.odp")) returned 1 [0222.547] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\hu3HQB.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\hu3hqb.odp")) returned 0xffffffff [0222.547] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffe6ed20, ftCreationTime.dwHighDateTime=0x1d4d1ef, ftLastAccessTime.dwLowDateTime=0xcb852640, ftLastAccessTime.dwHighDateTime=0x1d4d583, ftLastWriteTime.dwLowDateTime=0xcb852640, ftLastWriteTime.dwHighDateTime=0x1d4d583, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="l34EmG", cAlternateFileName="")) returned 1 [0222.547] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffe6ed20, ftCreationTime.dwHighDateTime=0x1d4d1ef, ftLastAccessTime.dwLowDateTime=0xcb852640, ftLastAccessTime.dwHighDateTime=0x1d4d583, ftLastWriteTime.dwLowDateTime=0xcb852640, ftLastWriteTime.dwHighDateTime=0x1d4d583, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0222.548] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffe6ed20, ftCreationTime.dwHighDateTime=0x1d4d1ef, ftLastAccessTime.dwLowDateTime=0xcb852640, ftLastAccessTime.dwHighDateTime=0x1d4d583, ftLastWriteTime.dwLowDateTime=0xcb852640, ftLastWriteTime.dwHighDateTime=0x1d4d583, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.548] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9f5b4c0, ftCreationTime.dwHighDateTime=0x1d4d1a7, ftLastAccessTime.dwLowDateTime=0xcfcb8fe0, ftLastAccessTime.dwHighDateTime=0x1d4c909, ftLastWriteTime.dwLowDateTime=0xcfcb8fe0, ftLastWriteTime.dwHighDateTime=0x1d4c909, nFileSizeHigh=0x0, nFileSizeLow=0x3e3a, dwReserved0=0x6e, dwReserved1=0x0, cFileName="-O Kjbqp.ods", cAlternateFileName="-OKJBQ~1.ODS")) returned 1 [0222.548] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\-O Kjbqp.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\-o kjbqp.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0222.548] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\-O Kjbqp.ods.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\-o kjbqp.ods.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0222.549] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e3a [0222.549] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0222.549] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0222.651] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3e3a, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x3e3a, lpOverlapped=0x0) returned 1 [0222.652] WriteFile (in: hFile=0xd4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3e40, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x3e40, lpOverlapped=0x0) returned 1 [0222.653] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0222.676] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0222.687] CloseHandle (hObject=0xdc) returned 1 [0222.687] CloseHandle (hObject=0xd4) returned 1 [0222.688] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\-O Kjbqp.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\-o kjbqp.ods"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\-O Kjbqp.ods.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\-o kjbqp.ods.dvodltmf")) returned 0 [0222.689] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\-O Kjbqp.ods.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\-o kjbqp.ods.dvodltmf")) returned 0x20 [0222.689] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\-O Kjbqp.ods", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9f5b4c0, ftCreationTime.dwHighDateTime=0x1d4d1a7, ftLastAccessTime.dwLowDateTime=0xcfcb8fe0, ftLastAccessTime.dwHighDateTime=0x1d4c909, ftLastWriteTime.dwLowDateTime=0xcfcb8fe0, ftLastWriteTime.dwHighDateTime=0x1d4c909, nFileSizeHigh=0x0, nFileSizeLow=0x3e3a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="-O Kjbqp.ods", cAlternateFileName="-OKJBQ~1.ODS")) returned 0x2e84d8 [0222.689] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9f5b4c0, ftCreationTime.dwHighDateTime=0x1d4d1a7, ftLastAccessTime.dwLowDateTime=0xcfcb8fe0, ftLastAccessTime.dwHighDateTime=0x1d4c909, ftLastWriteTime.dwLowDateTime=0xcfcb8fe0, ftLastWriteTime.dwHighDateTime=0x1d4c909, nFileSizeHigh=0x0, nFileSizeLow=0x3e3a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="-O Kjbqp.ods", cAlternateFileName="-OKJBQ~1.ODS")) returned 0 [0222.689] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0222.689] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\-O Kjbqp.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\-o kjbqp.ods")) returned 1 [0222.690] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\-O Kjbqp.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\-o kjbqp.ods")) returned 0xffffffff [0222.691] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ff4ea90, ftCreationTime.dwHighDateTime=0x1d4d2ec, ftLastAccessTime.dwLowDateTime=0xab54be60, ftLastAccessTime.dwHighDateTime=0x1d4cc98, ftLastWriteTime.dwLowDateTime=0xab54be60, ftLastWriteTime.dwHighDateTime=0x1d4cc98, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f054, cFileName="11yxE6YnXM8XXe7Vwj", cAlternateFileName="11YXE6~1")) returned 1 [0222.691] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\11yxE6YnXM8XXe7Vwj\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ff4ea90, ftCreationTime.dwHighDateTime=0x1d4d2ec, ftLastAccessTime.dwLowDateTime=0xab54be60, ftLastAccessTime.dwHighDateTime=0x1d4cc98, ftLastWriteTime.dwLowDateTime=0xab54be60, ftLastWriteTime.dwHighDateTime=0x1d4cc98, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0222.691] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ff4ea90, ftCreationTime.dwHighDateTime=0x1d4d2ec, ftLastAccessTime.dwLowDateTime=0xab54be60, ftLastAccessTime.dwHighDateTime=0x1d4cc98, ftLastWriteTime.dwLowDateTime=0xab54be60, ftLastWriteTime.dwHighDateTime=0x1d4cc98, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.691] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca3f7880, ftCreationTime.dwHighDateTime=0x1d4d0f1, ftLastAccessTime.dwLowDateTime=0xb2418700, ftLastAccessTime.dwHighDateTime=0x1d4c64c, ftLastWriteTime.dwLowDateTime=0xb2418700, ftLastWriteTime.dwHighDateTime=0x1d4c64c, nFileSizeHigh=0x0, nFileSizeLow=0x5333, dwReserved0=0x80, dwReserved1=0x0, cFileName="CVGOKKt.doc", cAlternateFileName="")) returned 1 [0222.691] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\11yxE6YnXM8XXe7Vwj\\CVGOKKt.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\11yxe6ynxm8xxe7vwj\\cvgokkt.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0222.691] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\11yxE6YnXM8XXe7Vwj\\CVGOKKt.doc.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\11yxe6ynxm8xxe7vwj\\cvgokkt.doc.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0222.692] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5333 [0222.692] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0222.692] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0222.817] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x5333, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x5333, lpOverlapped=0x0) returned 1 [0222.818] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x5340, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x5340, lpOverlapped=0x0) returned 1 [0222.819] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0222.844] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0222.855] CloseHandle (hObject=0xdc) returned 1 [0222.855] CloseHandle (hObject=0xe4) returned 1 [0222.855] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\11yxE6YnXM8XXe7Vwj\\CVGOKKt.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\11yxe6ynxm8xxe7vwj\\cvgokkt.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\11yxE6YnXM8XXe7Vwj\\CVGOKKt.doc.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\11yxe6ynxm8xxe7vwj\\cvgokkt.doc.dvodltmf")) returned 0 [0222.856] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\11yxE6YnXM8XXe7Vwj\\CVGOKKt.doc.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\11yxe6ynxm8xxe7vwj\\cvgokkt.doc.dvodltmf")) returned 0x20 [0222.856] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\11yxE6YnXM8XXe7Vwj\\CVGOKKt.doc", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca3f7880, ftCreationTime.dwHighDateTime=0x1d4d0f1, ftLastAccessTime.dwLowDateTime=0xb2418700, ftLastAccessTime.dwHighDateTime=0x1d4c64c, ftLastWriteTime.dwLowDateTime=0xb2418700, ftLastWriteTime.dwHighDateTime=0x1d4c64c, nFileSizeHigh=0x0, nFileSizeLow=0x5333, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="CVGOKKt.doc", cAlternateFileName="")) returned 0x2e8518 [0222.857] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca3f7880, ftCreationTime.dwHighDateTime=0x1d4d0f1, ftLastAccessTime.dwLowDateTime=0xb2418700, ftLastAccessTime.dwHighDateTime=0x1d4c64c, ftLastWriteTime.dwLowDateTime=0xb2418700, ftLastWriteTime.dwHighDateTime=0x1d4c64c, nFileSizeHigh=0x0, nFileSizeLow=0x5333, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="CVGOKKt.doc", cAlternateFileName="")) returned 0 [0222.857] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0222.857] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\11yxE6YnXM8XXe7Vwj\\CVGOKKt.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\11yxe6ynxm8xxe7vwj\\cvgokkt.doc")) returned 1 [0222.858] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\11yxE6YnXM8XXe7Vwj\\CVGOKKt.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\11yxe6ynxm8xxe7vwj\\cvgokkt.doc")) returned 0xffffffff [0222.858] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x72672ef0, ftCreationTime.dwHighDateTime=0x1d4ce99, ftLastAccessTime.dwLowDateTime=0xa88bc7e0, ftLastAccessTime.dwHighDateTime=0x1d4d37e, ftLastWriteTime.dwLowDateTime=0xa88bc7e0, ftLastWriteTime.dwHighDateTime=0x1d4d37e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18edec, cFileName="Q8s3Cbpihf9JdPqZEpa", cAlternateFileName="Q8S3CB~1")) returned 1 [0222.858] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\11yxE6YnXM8XXe7Vwj\\Q8s3Cbpihf9JdPqZEpa\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x72672ef0, ftCreationTime.dwHighDateTime=0x1d4ce99, ftLastAccessTime.dwLowDateTime=0xa88bc7e0, ftLastAccessTime.dwHighDateTime=0x1d4d37e, ftLastWriteTime.dwLowDateTime=0xa88bc7e0, ftLastWriteTime.dwHighDateTime=0x1d4d37e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0222.858] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x72672ef0, ftCreationTime.dwHighDateTime=0x1d4ce99, ftLastAccessTime.dwLowDateTime=0xa88bc7e0, ftLastAccessTime.dwHighDateTime=0x1d4d37e, ftLastWriteTime.dwLowDateTime=0xa88bc7e0, ftLastWriteTime.dwHighDateTime=0x1d4d37e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.858] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf69dce30, ftCreationTime.dwHighDateTime=0x1d4d20a, ftLastAccessTime.dwLowDateTime=0x40fc0930, ftLastAccessTime.dwHighDateTime=0x1d4d2e5, ftLastWriteTime.dwLowDateTime=0x40fc0930, ftLastWriteTime.dwHighDateTime=0x1d4d2e5, nFileSizeHigh=0x0, nFileSizeLow=0x4e94, dwReserved0=0xa4, dwReserved1=0x0, cFileName="5QpK.ots", cAlternateFileName="")) returned 1 [0222.859] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\11yxE6YnXM8XXe7Vwj\\Q8s3Cbpihf9JdPqZEpa\\5QpK.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\11yxe6ynxm8xxe7vwj\\q8s3cbpihf9jdpqzepa\\5qpk.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0222.859] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\11yxE6YnXM8XXe7Vwj\\Q8s3Cbpihf9JdPqZEpa\\5QpK.ots.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\11yxe6ynxm8xxe7vwj\\q8s3cbpihf9jdpqzepa\\5qpk.ots.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0222.859] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4e94 [0222.859] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0222.860] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0222.951] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4e94, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x4e94, lpOverlapped=0x0) returned 1 [0222.951] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4ea0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x4ea0, lpOverlapped=0x0) returned 1 [0222.953] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0222.977] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0222.989] CloseHandle (hObject=0xdc) returned 1 [0222.989] CloseHandle (hObject=0xe8) returned 1 [0222.989] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\11yxE6YnXM8XXe7Vwj\\Q8s3Cbpihf9JdPqZEpa\\5QpK.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\11yxe6ynxm8xxe7vwj\\q8s3cbpihf9jdpqzepa\\5qpk.ots"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\11yxE6YnXM8XXe7Vwj\\Q8s3Cbpihf9JdPqZEpa\\5QpK.ots.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\11yxe6ynxm8xxe7vwj\\q8s3cbpihf9jdpqzepa\\5qpk.ots.dvodltmf")) returned 0 [0222.990] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\11yxE6YnXM8XXe7Vwj\\Q8s3Cbpihf9JdPqZEpa\\5QpK.ots.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\11yxe6ynxm8xxe7vwj\\q8s3cbpihf9jdpqzepa\\5qpk.ots.dvodltmf")) returned 0x20 [0222.990] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\11yxE6YnXM8XXe7Vwj\\Q8s3Cbpihf9JdPqZEpa\\5QpK.ots", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf69dce30, ftCreationTime.dwHighDateTime=0x1d4d20a, ftLastAccessTime.dwLowDateTime=0x40fc0930, ftLastAccessTime.dwHighDateTime=0x1d4d2e5, ftLastWriteTime.dwLowDateTime=0x40fc0930, ftLastWriteTime.dwHighDateTime=0x1d4d2e5, nFileSizeHigh=0x0, nFileSizeLow=0x4e94, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5QpK.ots", cAlternateFileName="")) returned 0x2e8558 [0222.991] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf69dce30, ftCreationTime.dwHighDateTime=0x1d4d20a, ftLastAccessTime.dwLowDateTime=0x40fc0930, ftLastAccessTime.dwHighDateTime=0x1d4d2e5, ftLastWriteTime.dwLowDateTime=0x40fc0930, ftLastWriteTime.dwHighDateTime=0x1d4d2e5, nFileSizeHigh=0x0, nFileSizeLow=0x4e94, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5QpK.ots", cAlternateFileName="")) returned 0 [0222.991] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0222.991] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\11yxE6YnXM8XXe7Vwj\\Q8s3Cbpihf9JdPqZEpa\\5QpK.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\11yxe6ynxm8xxe7vwj\\q8s3cbpihf9jdpqzepa\\5qpk.ots")) returned 1 [0222.992] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\11yxE6YnXM8XXe7Vwj\\Q8s3Cbpihf9JdPqZEpa\\5QpK.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\11yxe6ynxm8xxe7vwj\\q8s3cbpihf9jdpqzepa\\5qpk.ots")) returned 0xffffffff [0222.992] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26179ba0, ftCreationTime.dwHighDateTime=0x1d4ceb9, ftLastAccessTime.dwLowDateTime=0x5aaa7580, ftLastAccessTime.dwHighDateTime=0x1d4cfc3, ftLastWriteTime.dwLowDateTime=0x5aaa7580, ftLastWriteTime.dwHighDateTime=0x1d4cfc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18eb84, cFileName="_mJ1tFH", cAlternateFileName="")) returned 1 [0222.992] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\11yxE6YnXM8XXe7Vwj\\Q8s3Cbpihf9JdPqZEpa\\_mJ1tFH\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26179ba0, ftCreationTime.dwHighDateTime=0x1d4ceb9, ftLastAccessTime.dwLowDateTime=0x5aaa7580, ftLastAccessTime.dwHighDateTime=0x1d4cfc3, ftLastWriteTime.dwLowDateTime=0x5aaa7580, ftLastWriteTime.dwHighDateTime=0x1d4cfc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0222.992] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26179ba0, ftCreationTime.dwHighDateTime=0x1d4ceb9, ftLastAccessTime.dwLowDateTime=0x5aaa7580, ftLastAccessTime.dwHighDateTime=0x1d4cfc3, ftLastWriteTime.dwLowDateTime=0x5aaa7580, ftLastWriteTime.dwHighDateTime=0x1d4cfc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.992] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a66d300, ftCreationTime.dwHighDateTime=0x1d4c66b, ftLastAccessTime.dwLowDateTime=0xbbf0100, ftLastAccessTime.dwHighDateTime=0x1d4d51a, ftLastWriteTime.dwLowDateTime=0xbbf0100, ftLastWriteTime.dwHighDateTime=0x1d4d51a, nFileSizeHigh=0x0, nFileSizeLow=0xd415, dwReserved0=0xc6, dwReserved1=0x0, cFileName="V8dZzoq2O8osR.xls", cAlternateFileName="V8DZZO~1.XLS")) returned 1 [0222.992] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\11yxE6YnXM8XXe7Vwj\\Q8s3Cbpihf9JdPqZEpa\\_mJ1tFH\\V8dZzoq2O8osR.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\11yxe6ynxm8xxe7vwj\\q8s3cbpihf9jdpqzepa\\_mj1tfh\\v8dzzoq2o8osr.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0222.993] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\11yxE6YnXM8XXe7Vwj\\Q8s3Cbpihf9JdPqZEpa\\_mJ1tFH\\V8dZzoq2O8osR.xls.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\11yxe6ynxm8xxe7vwj\\q8s3cbpihf9jdpqzepa\\_mj1tfh\\v8dzzoq2o8osr.xls.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0222.993] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd415 [0222.993] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0222.993] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0223.083] ReadFile (in: hFile=0xdc, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd415, lpNumberOfBytesRead=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18e910*=0xd415, lpOverlapped=0x0) returned 1 [0223.085] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd420, lpNumberOfBytesWritten=0x18e910, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18e910*=0xd420, lpOverlapped=0x0) returned 1 [0223.086] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0223.110] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0223.120] CloseHandle (hObject=0xdc) returned 1 [0223.120] CloseHandle (hObject=0xe0) returned 1 [0223.121] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\11yxE6YnXM8XXe7Vwj\\Q8s3Cbpihf9JdPqZEpa\\_mJ1tFH\\V8dZzoq2O8osR.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\11yxe6ynxm8xxe7vwj\\q8s3cbpihf9jdpqzepa\\_mj1tfh\\v8dzzoq2o8osr.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\11yxE6YnXM8XXe7Vwj\\Q8s3Cbpihf9JdPqZEpa\\_mJ1tFH\\V8dZzoq2O8osR.xls.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\11yxe6ynxm8xxe7vwj\\q8s3cbpihf9jdpqzepa\\_mj1tfh\\v8dzzoq2o8osr.xls.dvodltmf")) returned 0 [0223.122] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\11yxE6YnXM8XXe7Vwj\\Q8s3Cbpihf9JdPqZEpa\\_mJ1tFH\\V8dZzoq2O8osR.xls.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\11yxe6ynxm8xxe7vwj\\q8s3cbpihf9jdpqzepa\\_mj1tfh\\v8dzzoq2o8osr.xls.dvodltmf")) returned 0x20 [0223.122] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\11yxE6YnXM8XXe7Vwj\\Q8s3Cbpihf9JdPqZEpa\\_mJ1tFH\\V8dZzoq2O8osR.xls", lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a66d300, ftCreationTime.dwHighDateTime=0x1d4c66b, ftLastAccessTime.dwLowDateTime=0xbbf0100, ftLastAccessTime.dwHighDateTime=0x1d4d51a, ftLastWriteTime.dwLowDateTime=0xbbf0100, ftLastWriteTime.dwHighDateTime=0x1d4d51a, nFileSizeHigh=0x0, nFileSizeLow=0xd415, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="V8dZzoq2O8osR.xls", cAlternateFileName="V8DZZO~1.XLS")) returned 0x2e8598 [0223.122] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18e80c | out: lpFindFileData=0x18e80c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a66d300, ftCreationTime.dwHighDateTime=0x1d4c66b, ftLastAccessTime.dwLowDateTime=0xbbf0100, ftLastAccessTime.dwHighDateTime=0x1d4d51a, ftLastWriteTime.dwLowDateTime=0xbbf0100, ftLastWriteTime.dwHighDateTime=0x1d4d51a, nFileSizeHigh=0x0, nFileSizeLow=0xd415, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="V8dZzoq2O8osR.xls", cAlternateFileName="V8DZZO~1.XLS")) returned 0 [0223.122] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0223.122] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\11yxE6YnXM8XXe7Vwj\\Q8s3Cbpihf9JdPqZEpa\\_mJ1tFH\\V8dZzoq2O8osR.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\11yxe6ynxm8xxe7vwj\\q8s3cbpihf9jdpqzepa\\_mj1tfh\\v8dzzoq2o8osr.xls")) returned 1 [0223.124] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\11yxE6YnXM8XXe7Vwj\\Q8s3Cbpihf9JdPqZEpa\\_mJ1tFH\\V8dZzoq2O8osR.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\11yxe6ynxm8xxe7vwj\\q8s3cbpihf9jdpqzepa\\_mj1tfh\\v8dzzoq2o8osr.xls")) returned 0xffffffff [0223.124] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a66d300, ftCreationTime.dwHighDateTime=0x1d4c66b, ftLastAccessTime.dwLowDateTime=0xbbf0100, ftLastAccessTime.dwHighDateTime=0x1d4d51a, ftLastWriteTime.dwLowDateTime=0xbbf0100, ftLastWriteTime.dwHighDateTime=0x1d4d51a, nFileSizeHigh=0x0, nFileSizeLow=0xd415, dwReserved0=0xc6, dwReserved1=0x0, cFileName="V8dZzoq2O8osR.xls", cAlternateFileName="V8DZZO~1.XLS")) returned 0 [0223.124] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0223.124] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26179ba0, ftCreationTime.dwHighDateTime=0x1d4ceb9, ftLastAccessTime.dwLowDateTime=0x5aaa7580, ftLastAccessTime.dwHighDateTime=0x1d4cfc3, ftLastWriteTime.dwLowDateTime=0x5aaa7580, ftLastWriteTime.dwHighDateTime=0x1d4cfc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18eb84, cFileName="_mJ1tFH", cAlternateFileName="")) returned 0 [0223.124] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0223.124] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41f86cc0, ftCreationTime.dwHighDateTime=0x1d4d2f4, ftLastAccessTime.dwLowDateTime=0xa812ee90, ftLastAccessTime.dwHighDateTime=0x1d4cec1, ftLastWriteTime.dwLowDateTime=0xa812ee90, ftLastWriteTime.dwHighDateTime=0x1d4cec1, nFileSizeHigh=0x0, nFileSizeLow=0xf64f, dwReserved0=0x2dbbd0, dwReserved1=0x18edec, cFileName="sfQH6A2H0uM5a.ppt", cAlternateFileName="SFQH6A~1.PPT")) returned 1 [0223.124] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\11yxE6YnXM8XXe7Vwj\\sfQH6A2H0uM5a.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\11yxe6ynxm8xxe7vwj\\sfqh6a2h0um5a.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0223.124] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\11yxE6YnXM8XXe7Vwj\\sfQH6A2H0uM5a.ppt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\11yxe6ynxm8xxe7vwj\\sfqh6a2h0um5a.ppt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0223.125] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf64f [0223.125] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0223.125] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0223.234] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xf64f, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0xf64f, lpOverlapped=0x0) returned 1 [0223.235] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf650, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0xf650, lpOverlapped=0x0) returned 1 [0223.237] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0223.260] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0223.271] CloseHandle (hObject=0xe4) returned 1 [0223.271] CloseHandle (hObject=0xe8) returned 1 [0223.271] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\11yxE6YnXM8XXe7Vwj\\sfQH6A2H0uM5a.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\11yxe6ynxm8xxe7vwj\\sfqh6a2h0um5a.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\11yxE6YnXM8XXe7Vwj\\sfQH6A2H0uM5a.ppt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\11yxe6ynxm8xxe7vwj\\sfqh6a2h0um5a.ppt.dvodltmf")) returned 0 [0223.272] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\11yxE6YnXM8XXe7Vwj\\sfQH6A2H0uM5a.ppt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\11yxe6ynxm8xxe7vwj\\sfqh6a2h0um5a.ppt.dvodltmf")) returned 0x20 [0223.273] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\11yxE6YnXM8XXe7Vwj\\sfQH6A2H0uM5a.ppt", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41f86cc0, ftCreationTime.dwHighDateTime=0x1d4d2f4, ftLastAccessTime.dwLowDateTime=0xa812ee90, ftLastAccessTime.dwHighDateTime=0x1d4cec1, ftLastWriteTime.dwLowDateTime=0xa812ee90, ftLastWriteTime.dwHighDateTime=0x1d4cec1, nFileSizeHigh=0x0, nFileSizeLow=0xf64f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="sfQH6A2H0uM5a.ppt", cAlternateFileName="SFQH6A~1.PPT")) returned 0x2e8518 [0223.273] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41f86cc0, ftCreationTime.dwHighDateTime=0x1d4d2f4, ftLastAccessTime.dwLowDateTime=0xa812ee90, ftLastAccessTime.dwHighDateTime=0x1d4cec1, ftLastWriteTime.dwLowDateTime=0xa812ee90, ftLastWriteTime.dwHighDateTime=0x1d4cec1, nFileSizeHigh=0x0, nFileSizeLow=0xf64f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="sfQH6A2H0uM5a.ppt", cAlternateFileName="SFQH6A~1.PPT")) returned 0 [0223.273] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0223.273] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\11yxE6YnXM8XXe7Vwj\\sfQH6A2H0uM5a.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\11yxe6ynxm8xxe7vwj\\sfqh6a2h0um5a.ppt")) returned 1 [0223.275] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\11yxE6YnXM8XXe7Vwj\\sfQH6A2H0uM5a.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\11yxe6ynxm8xxe7vwj\\sfqh6a2h0um5a.ppt")) returned 0xffffffff [0223.275] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41f86cc0, ftCreationTime.dwHighDateTime=0x1d4d2f4, ftLastAccessTime.dwLowDateTime=0xa812ee90, ftLastAccessTime.dwHighDateTime=0x1d4cec1, ftLastWriteTime.dwLowDateTime=0xa812ee90, ftLastWriteTime.dwHighDateTime=0x1d4cec1, nFileSizeHigh=0x0, nFileSizeLow=0xf64f, dwReserved0=0x2dbbd0, dwReserved1=0x18edec, cFileName="sfQH6A2H0uM5a.ppt", cAlternateFileName="SFQH6A~1.PPT")) returned 0 [0223.275] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0223.275] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecab38c0, ftCreationTime.dwHighDateTime=0x1d4cfc8, ftLastAccessTime.dwLowDateTime=0x3931d7f0, ftLastAccessTime.dwHighDateTime=0x1d4d396, ftLastWriteTime.dwLowDateTime=0x3931d7f0, ftLastWriteTime.dwHighDateTime=0x1d4d396, nFileSizeHigh=0x0, nFileSizeLow=0x50f0, dwReserved0=0x702e6135, dwReserved1=0x61707470, cFileName="cFa2Xdk.ots", cAlternateFileName="")) returned 1 [0223.275] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\cFa2Xdk.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\cfa2xdk.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0223.275] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\cFa2Xdk.ots.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\cfa2xdk.ots.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0223.276] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x50f0 [0223.276] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0223.276] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0223.375] ReadFile (in: hFile=0xd4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x50f0, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x50f0, lpOverlapped=0x0) returned 1 [0223.376] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x5100, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x5100, lpOverlapped=0x0) returned 1 [0223.377] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0223.400] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0223.411] CloseHandle (hObject=0xd4) returned 1 [0223.411] CloseHandle (hObject=0xe8) returned 1 [0223.411] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\cFa2Xdk.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\cfa2xdk.ots"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\cFa2Xdk.ots.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\cfa2xdk.ots.dvodltmf")) returned 0 [0223.412] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\cFa2Xdk.ots.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\cfa2xdk.ots.dvodltmf")) returned 0x20 [0223.412] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\cFa2Xdk.ots", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecab38c0, ftCreationTime.dwHighDateTime=0x1d4cfc8, ftLastAccessTime.dwLowDateTime=0x3931d7f0, ftLastAccessTime.dwHighDateTime=0x1d4d396, ftLastWriteTime.dwLowDateTime=0x3931d7f0, ftLastWriteTime.dwHighDateTime=0x1d4d396, nFileSizeHigh=0x0, nFileSizeLow=0x50f0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="cFa2Xdk.ots", cAlternateFileName="")) returned 0x2e84d8 [0223.412] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecab38c0, ftCreationTime.dwHighDateTime=0x1d4cfc8, ftLastAccessTime.dwLowDateTime=0x3931d7f0, ftLastAccessTime.dwHighDateTime=0x1d4d396, ftLastWriteTime.dwLowDateTime=0x3931d7f0, ftLastWriteTime.dwHighDateTime=0x1d4d396, nFileSizeHigh=0x0, nFileSizeLow=0x50f0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="cFa2Xdk.ots", cAlternateFileName="")) returned 0 [0223.413] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0223.413] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\cFa2Xdk.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\cfa2xdk.ots")) returned 1 [0223.414] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\cFa2Xdk.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\cfa2xdk.ots")) returned 0xffffffff [0223.414] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6fe20950, ftCreationTime.dwHighDateTime=0x1d4d0cb, ftLastAccessTime.dwLowDateTime=0x20ce89a0, ftLastAccessTime.dwHighDateTime=0x1d4c85c, ftLastWriteTime.dwLowDateTime=0x20ce89a0, ftLastWriteTime.dwHighDateTime=0x1d4c85c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f054, cFileName="tYMP8", cAlternateFileName="")) returned 1 [0223.414] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6fe20950, ftCreationTime.dwHighDateTime=0x1d4d0cb, ftLastAccessTime.dwLowDateTime=0x20ce89a0, ftLastAccessTime.dwHighDateTime=0x1d4c85c, ftLastWriteTime.dwLowDateTime=0x20ce89a0, ftLastWriteTime.dwHighDateTime=0x1d4c85c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0223.414] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6fe20950, ftCreationTime.dwHighDateTime=0x1d4d0cb, ftLastAccessTime.dwLowDateTime=0x20ce89a0, ftLastAccessTime.dwHighDateTime=0x1d4c85c, ftLastWriteTime.dwLowDateTime=0x20ce89a0, ftLastWriteTime.dwHighDateTime=0x1d4c85c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.414] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cd74f20, ftCreationTime.dwHighDateTime=0x1d4cd00, ftLastAccessTime.dwLowDateTime=0x4bf44a40, ftLastAccessTime.dwHighDateTime=0x1d4d273, ftLastWriteTime.dwLowDateTime=0x4bf44a40, ftLastWriteTime.dwHighDateTime=0x1d4d273, nFileSizeHigh=0x0, nFileSizeLow=0x1429b, dwReserved0=0x7e, dwReserved1=0x0, cFileName="a4d7Zvt65 zTYB1q.csv", cAlternateFileName="A4D7ZV~1.CSV")) returned 1 [0223.414] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\a4d7Zvt65 zTYB1q.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\a4d7zvt65 ztyb1q.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0223.414] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\a4d7Zvt65 zTYB1q.csv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\a4d7zvt65 ztyb1q.csv.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0223.415] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1429b [0223.415] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0223.415] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0223.507] ReadFile (in: hFile=0xd4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1429b, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x1429b, lpOverlapped=0x0) returned 1 [0223.509] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x142a0, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x142a0, lpOverlapped=0x0) returned 1 [0223.511] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0223.534] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0223.545] CloseHandle (hObject=0xd4) returned 1 [0223.545] CloseHandle (hObject=0xe4) returned 1 [0223.545] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\a4d7Zvt65 zTYB1q.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\a4d7zvt65 ztyb1q.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\a4d7Zvt65 zTYB1q.csv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\a4d7zvt65 ztyb1q.csv.dvodltmf")) returned 0 [0223.546] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\a4d7Zvt65 zTYB1q.csv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\a4d7zvt65 ztyb1q.csv.dvodltmf")) returned 0x20 [0223.546] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\a4d7Zvt65 zTYB1q.csv", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cd74f20, ftCreationTime.dwHighDateTime=0x1d4cd00, ftLastAccessTime.dwLowDateTime=0x4bf44a40, ftLastAccessTime.dwHighDateTime=0x1d4d273, ftLastWriteTime.dwLowDateTime=0x4bf44a40, ftLastWriteTime.dwHighDateTime=0x1d4d273, nFileSizeHigh=0x0, nFileSizeLow=0x1429b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="a4d7Zvt65 zTYB1q.csv", cAlternateFileName="A4D7ZV~1.CSV")) returned 0x2e8518 [0223.547] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cd74f20, ftCreationTime.dwHighDateTime=0x1d4cd00, ftLastAccessTime.dwLowDateTime=0x4bf44a40, ftLastAccessTime.dwHighDateTime=0x1d4d273, ftLastWriteTime.dwLowDateTime=0x4bf44a40, ftLastWriteTime.dwHighDateTime=0x1d4d273, nFileSizeHigh=0x0, nFileSizeLow=0x1429b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="a4d7Zvt65 zTYB1q.csv", cAlternateFileName="A4D7ZV~1.CSV")) returned 0 [0223.547] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0223.547] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\a4d7Zvt65 zTYB1q.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\a4d7zvt65 ztyb1q.csv")) returned 1 [0223.548] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\a4d7Zvt65 zTYB1q.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\a4d7zvt65 ztyb1q.csv")) returned 0xffffffff [0223.548] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aed3870, ftCreationTime.dwHighDateTime=0x1d4cbfa, ftLastAccessTime.dwLowDateTime=0x8368d250, ftLastAccessTime.dwHighDateTime=0x1d4caa0, ftLastWriteTime.dwLowDateTime=0x8368d250, ftLastWriteTime.dwHighDateTime=0x1d4caa0, nFileSizeHigh=0x0, nFileSizeLow=0xc2d1, dwReserved0=0x2dbbd0, dwReserved1=0x18edec, cFileName="dCH4fBzVmdH.ots", cAlternateFileName="DCH4FB~1.OTS")) returned 1 [0223.549] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\dCH4fBzVmdH.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\dch4fbzvmdh.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0223.549] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\dCH4fBzVmdH.ots.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\dch4fbzvmdh.ots.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0223.549] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc2d1 [0223.549] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0223.550] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0223.652] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xc2d1, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0xc2d1, lpOverlapped=0x0) returned 1 [0223.653] WriteFile (in: hFile=0xd4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc2e0, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0xc2e0, lpOverlapped=0x0) returned 1 [0223.655] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0223.678] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0223.689] CloseHandle (hObject=0xe4) returned 1 [0223.689] CloseHandle (hObject=0xd4) returned 1 [0223.689] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\dCH4fBzVmdH.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\dch4fbzvmdh.ots"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\dCH4fBzVmdH.ots.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\dch4fbzvmdh.ots.dvodltmf")) returned 0 [0223.690] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\dCH4fBzVmdH.ots.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\dch4fbzvmdh.ots.dvodltmf")) returned 0x20 [0223.690] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\dCH4fBzVmdH.ots", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aed3870, ftCreationTime.dwHighDateTime=0x1d4cbfa, ftLastAccessTime.dwLowDateTime=0x8368d250, ftLastAccessTime.dwHighDateTime=0x1d4caa0, ftLastWriteTime.dwLowDateTime=0x8368d250, ftLastWriteTime.dwHighDateTime=0x1d4caa0, nFileSizeHigh=0x0, nFileSizeLow=0xc2d1, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="dCH4fBzVmdH.ots", cAlternateFileName="DCH4FB~1.OTS")) returned 0x2e8518 [0223.690] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aed3870, ftCreationTime.dwHighDateTime=0x1d4cbfa, ftLastAccessTime.dwLowDateTime=0x8368d250, ftLastAccessTime.dwHighDateTime=0x1d4caa0, ftLastWriteTime.dwLowDateTime=0x8368d250, ftLastWriteTime.dwHighDateTime=0x1d4caa0, nFileSizeHigh=0x0, nFileSizeLow=0xc2d1, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="dCH4fBzVmdH.ots", cAlternateFileName="DCH4FB~1.OTS")) returned 0 [0223.690] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0223.690] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\dCH4fBzVmdH.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\dch4fbzvmdh.ots")) returned 1 [0223.692] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\dCH4fBzVmdH.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\dch4fbzvmdh.ots")) returned 0xffffffff [0223.692] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x772a97b0, ftCreationTime.dwHighDateTime=0x1d4cecb, ftLastAccessTime.dwLowDateTime=0xd15e4010, ftLastAccessTime.dwHighDateTime=0x1d4cac5, ftLastWriteTime.dwLowDateTime=0xd15e4010, ftLastWriteTime.dwHighDateTime=0x1d4cac5, nFileSizeHigh=0x0, nFileSizeLow=0x17bab, dwReserved0=0x0, dwReserved1=0x0, cFileName="pM0CwGS1-lc.pdf", cAlternateFileName="PM0CWG~1.PDF")) returned 1 [0223.692] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\pM0CwGS1-lc.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\pm0cwgs1-lc.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0223.692] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\pM0CwGS1-lc.pdf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\pm0cwgs1-lc.pdf.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0223.693] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17bab [0223.693] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0223.693] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0223.801] ReadFile (in: hFile=0xd4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x17bab, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x17bab, lpOverlapped=0x0) returned 1 [0223.802] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x17bb0, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x17bb0, lpOverlapped=0x0) returned 1 [0223.805] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0223.828] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0223.839] CloseHandle (hObject=0xd4) returned 1 [0223.839] CloseHandle (hObject=0xe4) returned 1 [0223.839] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\pM0CwGS1-lc.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\pm0cwgs1-lc.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\pM0CwGS1-lc.pdf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\pm0cwgs1-lc.pdf.dvodltmf")) returned 0 [0223.840] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\pM0CwGS1-lc.pdf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\pm0cwgs1-lc.pdf.dvodltmf")) returned 0x20 [0223.841] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\pM0CwGS1-lc.pdf", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x772a97b0, ftCreationTime.dwHighDateTime=0x1d4cecb, ftLastAccessTime.dwLowDateTime=0xd15e4010, ftLastAccessTime.dwHighDateTime=0x1d4cac5, ftLastWriteTime.dwLowDateTime=0xd15e4010, ftLastWriteTime.dwHighDateTime=0x1d4cac5, nFileSizeHigh=0x0, nFileSizeLow=0x17bab, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="pM0CwGS1-lc.pdf", cAlternateFileName="PM0CWG~1.PDF")) returned 0x2e8518 [0223.841] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x772a97b0, ftCreationTime.dwHighDateTime=0x1d4cecb, ftLastAccessTime.dwLowDateTime=0xd15e4010, ftLastAccessTime.dwHighDateTime=0x1d4cac5, ftLastWriteTime.dwLowDateTime=0xd15e4010, ftLastWriteTime.dwHighDateTime=0x1d4cac5, nFileSizeHigh=0x0, nFileSizeLow=0x17bab, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="pM0CwGS1-lc.pdf", cAlternateFileName="PM0CWG~1.PDF")) returned 0 [0223.841] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0223.841] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\pM0CwGS1-lc.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\pm0cwgs1-lc.pdf")) returned 1 [0223.843] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\pM0CwGS1-lc.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\pm0cwgs1-lc.pdf")) returned 0xffffffff [0223.843] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbb63590, ftCreationTime.dwHighDateTime=0x1d4c7fa, ftLastAccessTime.dwLowDateTime=0x56cd76b0, ftLastAccessTime.dwHighDateTime=0x1d4cff5, ftLastWriteTime.dwLowDateTime=0x56cd76b0, ftLastWriteTime.dwHighDateTime=0x1d4cff5, nFileSizeHigh=0x0, nFileSizeLow=0x1708a, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMcql.rtf", cAlternateFileName="")) returned 1 [0223.843] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\RMcql.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\rmcql.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0223.843] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\RMcql.rtf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\rmcql.rtf.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0223.844] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1708a [0223.844] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0223.844] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0223.934] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1708a, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x1708a, lpOverlapped=0x0) returned 1 [0223.936] WriteFile (in: hFile=0xd4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x17090, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x17090, lpOverlapped=0x0) returned 1 [0223.938] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0223.960] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0223.985] CloseHandle (hObject=0xe4) returned 1 [0223.985] CloseHandle (hObject=0xd4) returned 1 [0223.986] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\RMcql.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\rmcql.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\RMcql.rtf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\rmcql.rtf.dvodltmf")) returned 0 [0223.987] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\RMcql.rtf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\rmcql.rtf.dvodltmf")) returned 0x20 [0223.987] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\RMcql.rtf", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbb63590, ftCreationTime.dwHighDateTime=0x1d4c7fa, ftLastAccessTime.dwLowDateTime=0x56cd76b0, ftLastAccessTime.dwHighDateTime=0x1d4cff5, ftLastWriteTime.dwLowDateTime=0x56cd76b0, ftLastWriteTime.dwHighDateTime=0x1d4cff5, nFileSizeHigh=0x0, nFileSizeLow=0x1708a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="RMcql.rtf", cAlternateFileName="")) returned 0x2e8518 [0223.987] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbb63590, ftCreationTime.dwHighDateTime=0x1d4c7fa, ftLastAccessTime.dwLowDateTime=0x56cd76b0, ftLastAccessTime.dwHighDateTime=0x1d4cff5, ftLastWriteTime.dwLowDateTime=0x56cd76b0, ftLastWriteTime.dwHighDateTime=0x1d4cff5, nFileSizeHigh=0x0, nFileSizeLow=0x1708a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="RMcql.rtf", cAlternateFileName="")) returned 0 [0223.987] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0223.987] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\RMcql.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\rmcql.rtf")) returned 1 [0223.989] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\RMcql.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\rmcql.rtf")) returned 0xffffffff [0223.989] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde4b69b0, ftCreationTime.dwHighDateTime=0x1d4d25e, ftLastAccessTime.dwLowDateTime=0x52c592c0, ftLastAccessTime.dwHighDateTime=0x1d4d4c6, ftLastWriteTime.dwLowDateTime=0x52c592c0, ftLastWriteTime.dwHighDateTime=0x1d4d4c6, nFileSizeHigh=0x0, nFileSizeLow=0xaf89, dwReserved0=0x2dbbd0, dwReserved1=0x18edec, cFileName="ToDmkBSUVqEx5k.doc", cAlternateFileName="TODMKB~1.DOC")) returned 1 [0223.989] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\ToDmkBSUVqEx5k.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\todmkbsuvqex5k.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0223.989] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\ToDmkBSUVqEx5k.doc.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\todmkbsuvqex5k.doc.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0223.990] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaf89 [0223.990] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0223.990] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0224.079] ReadFile (in: hFile=0xd4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xaf89, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0xaf89, lpOverlapped=0x0) returned 1 [0224.080] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xaf90, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0xaf90, lpOverlapped=0x0) returned 1 [0224.081] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0224.106] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0224.117] CloseHandle (hObject=0xd4) returned 1 [0224.117] CloseHandle (hObject=0xe4) returned 1 [0224.117] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\ToDmkBSUVqEx5k.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\todmkbsuvqex5k.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\ToDmkBSUVqEx5k.doc.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\todmkbsuvqex5k.doc.dvodltmf")) returned 0 [0224.118] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\ToDmkBSUVqEx5k.doc.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\todmkbsuvqex5k.doc.dvodltmf")) returned 0x20 [0224.118] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\ToDmkBSUVqEx5k.doc", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde4b69b0, ftCreationTime.dwHighDateTime=0x1d4d25e, ftLastAccessTime.dwLowDateTime=0x52c592c0, ftLastAccessTime.dwHighDateTime=0x1d4d4c6, ftLastWriteTime.dwLowDateTime=0x52c592c0, ftLastWriteTime.dwHighDateTime=0x1d4d4c6, nFileSizeHigh=0x0, nFileSizeLow=0xaf89, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ToDmkBSUVqEx5k.doc", cAlternateFileName="TODMKB~1.DOC")) returned 0x2e8518 [0224.118] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde4b69b0, ftCreationTime.dwHighDateTime=0x1d4d25e, ftLastAccessTime.dwLowDateTime=0x52c592c0, ftLastAccessTime.dwHighDateTime=0x1d4d4c6, ftLastWriteTime.dwLowDateTime=0x52c592c0, ftLastWriteTime.dwHighDateTime=0x1d4d4c6, nFileSizeHigh=0x0, nFileSizeLow=0xaf89, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ToDmkBSUVqEx5k.doc", cAlternateFileName="TODMKB~1.DOC")) returned 0 [0224.118] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0224.118] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\ToDmkBSUVqEx5k.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\todmkbsuvqex5k.doc")) returned 1 [0224.120] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\ToDmkBSUVqEx5k.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\todmkbsuvqex5k.doc")) returned 0xffffffff [0224.120] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59bc840, ftCreationTime.dwHighDateTime=0x1d4c902, ftLastAccessTime.dwLowDateTime=0x8a75ede0, ftLastAccessTime.dwHighDateTime=0x1d4cadb, ftLastWriteTime.dwLowDateTime=0x8a75ede0, ftLastWriteTime.dwHighDateTime=0x1d4cadb, nFileSizeHigh=0x0, nFileSizeLow=0x4f0a, dwReserved0=0x2dbbd0, dwReserved1=0x18edec, cFileName="whvR.xls", cAlternateFileName="")) returned 1 [0224.120] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\whvR.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\whvr.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0224.120] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\whvR.xls.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\whvr.xls.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0224.121] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4f0a [0224.121] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0224.121] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0224.210] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4f0a, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x4f0a, lpOverlapped=0x0) returned 1 [0224.211] WriteFile (in: hFile=0xd4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4f10, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x4f10, lpOverlapped=0x0) returned 1 [0224.212] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0224.235] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0224.246] CloseHandle (hObject=0xe4) returned 1 [0224.246] CloseHandle (hObject=0xd4) returned 1 [0224.246] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\whvR.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\whvr.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\whvR.xls.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\whvr.xls.dvodltmf")) returned 0 [0224.247] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\whvR.xls.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\whvr.xls.dvodltmf")) returned 0x20 [0224.248] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\whvR.xls", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59bc840, ftCreationTime.dwHighDateTime=0x1d4c902, ftLastAccessTime.dwLowDateTime=0x8a75ede0, ftLastAccessTime.dwHighDateTime=0x1d4cadb, ftLastWriteTime.dwLowDateTime=0x8a75ede0, ftLastWriteTime.dwHighDateTime=0x1d4cadb, nFileSizeHigh=0x0, nFileSizeLow=0x4f0a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="whvR.xls", cAlternateFileName="")) returned 0x2e8518 [0224.248] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59bc840, ftCreationTime.dwHighDateTime=0x1d4c902, ftLastAccessTime.dwLowDateTime=0x8a75ede0, ftLastAccessTime.dwHighDateTime=0x1d4cadb, ftLastWriteTime.dwLowDateTime=0x8a75ede0, ftLastWriteTime.dwHighDateTime=0x1d4cadb, nFileSizeHigh=0x0, nFileSizeLow=0x4f0a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="whvR.xls", cAlternateFileName="")) returned 0 [0224.248] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0224.248] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\whvR.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\whvr.xls")) returned 1 [0224.249] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\whvR.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\whvr.xls")) returned 0xffffffff [0224.249] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3486f900, ftCreationTime.dwHighDateTime=0x1d4c81b, ftLastAccessTime.dwLowDateTime=0xba301610, ftLastAccessTime.dwHighDateTime=0x1d4c841, ftLastWriteTime.dwLowDateTime=0xba301610, ftLastWriteTime.dwHighDateTime=0x1d4c841, nFileSizeHigh=0x0, nFileSizeLow=0x173a1, dwReserved0=0x2dbbd0, dwReserved1=0x18edec, cFileName="zVFGNQwrF5RuQW7.csv", cAlternateFileName="ZVFGNQ~1.CSV")) returned 1 [0224.249] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\zVFGNQwrF5RuQW7.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\zvfgnqwrf5ruqw7.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0224.250] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\zVFGNQwrF5RuQW7.csv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\zvfgnqwrf5ruqw7.csv.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0224.250] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x173a1 [0224.250] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0224.251] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0224.340] ReadFile (in: hFile=0xd4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x173a1, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x173a1, lpOverlapped=0x0) returned 1 [0224.342] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x173b0, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x173b0, lpOverlapped=0x0) returned 1 [0224.344] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0224.413] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0224.424] CloseHandle (hObject=0xd4) returned 1 [0224.425] CloseHandle (hObject=0xe4) returned 1 [0224.425] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\zVFGNQwrF5RuQW7.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\zvfgnqwrf5ruqw7.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\zVFGNQwrF5RuQW7.csv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\zvfgnqwrf5ruqw7.csv.dvodltmf")) returned 0 [0224.426] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\zVFGNQwrF5RuQW7.csv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\zvfgnqwrf5ruqw7.csv.dvodltmf")) returned 0x20 [0224.426] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\zVFGNQwrF5RuQW7.csv", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3486f900, ftCreationTime.dwHighDateTime=0x1d4c81b, ftLastAccessTime.dwLowDateTime=0xba301610, ftLastAccessTime.dwHighDateTime=0x1d4c841, ftLastWriteTime.dwLowDateTime=0xba301610, ftLastWriteTime.dwHighDateTime=0x1d4c841, nFileSizeHigh=0x0, nFileSizeLow=0x173a1, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="zVFGNQwrF5RuQW7.csv", cAlternateFileName="ZVFGNQ~1.CSV")) returned 0x2e8518 [0224.426] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3486f900, ftCreationTime.dwHighDateTime=0x1d4c81b, ftLastAccessTime.dwLowDateTime=0xba301610, ftLastAccessTime.dwHighDateTime=0x1d4c841, ftLastWriteTime.dwLowDateTime=0xba301610, ftLastWriteTime.dwHighDateTime=0x1d4c841, nFileSizeHigh=0x0, nFileSizeLow=0x173a1, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="zVFGNQwrF5RuQW7.csv", cAlternateFileName="ZVFGNQ~1.CSV")) returned 0 [0224.426] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0224.426] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\zVFGNQwrF5RuQW7.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\zvfgnqwrf5ruqw7.csv")) returned 1 [0224.428] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\tYMP8\\zVFGNQwrF5RuQW7.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\tymp8\\zvfgnqwrf5ruqw7.csv")) returned 0xffffffff [0224.428] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3486f900, ftCreationTime.dwHighDateTime=0x1d4c81b, ftLastAccessTime.dwLowDateTime=0xba301610, ftLastAccessTime.dwHighDateTime=0x1d4c841, ftLastWriteTime.dwLowDateTime=0xba301610, ftLastWriteTime.dwHighDateTime=0x1d4c841, nFileSizeHigh=0x0, nFileSizeLow=0x173a1, dwReserved0=0x2dbbd0, dwReserved1=0x18edec, cFileName="zVFGNQwrF5RuQW7.csv", cAlternateFileName="ZVFGNQ~1.CSV")) returned 0 [0224.428] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0224.428] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97b8d00, ftCreationTime.dwHighDateTime=0x1d4ca32, ftLastAccessTime.dwLowDateTime=0xeed95110, ftLastAccessTime.dwHighDateTime=0x1d4cd0f, ftLastWriteTime.dwLowDateTime=0xeed95110, ftLastWriteTime.dwHighDateTime=0x1d4cd0f, nFileSizeHigh=0x0, nFileSizeLow=0x15b61, dwReserved0=0x37575175, dwReserved1=0x7673632e, cFileName="uiX5BdPsFMDFbsKCrR.xls", cAlternateFileName="UIX5BD~1.XLS")) returned 1 [0224.429] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\uiX5BdPsFMDFbsKCrR.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\uix5bdpsfmdfbskcrr.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0224.429] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\uiX5BdPsFMDFbsKCrR.xls.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\uix5bdpsfmdfbskcrr.xls.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0224.429] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15b61 [0224.429] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0224.430] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0224.522] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x15b61, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x15b61, lpOverlapped=0x0) returned 1 [0224.524] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x15b70, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x15b70, lpOverlapped=0x0) returned 1 [0224.526] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0224.549] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0224.561] CloseHandle (hObject=0xe8) returned 1 [0224.561] CloseHandle (hObject=0xe4) returned 1 [0224.561] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\uiX5BdPsFMDFbsKCrR.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\uix5bdpsfmdfbskcrr.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\uiX5BdPsFMDFbsKCrR.xls.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\uix5bdpsfmdfbskcrr.xls.dvodltmf")) returned 0 [0224.562] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\uiX5BdPsFMDFbsKCrR.xls.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\uix5bdpsfmdfbskcrr.xls.dvodltmf")) returned 0x20 [0224.562] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\uiX5BdPsFMDFbsKCrR.xls", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97b8d00, ftCreationTime.dwHighDateTime=0x1d4ca32, ftLastAccessTime.dwLowDateTime=0xeed95110, ftLastAccessTime.dwHighDateTime=0x1d4cd0f, ftLastWriteTime.dwLowDateTime=0xeed95110, ftLastWriteTime.dwHighDateTime=0x1d4cd0f, nFileSizeHigh=0x0, nFileSizeLow=0x15b61, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="uiX5BdPsFMDFbsKCrR.xls", cAlternateFileName="UIX5BD~1.XLS")) returned 0x2e84d8 [0224.563] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97b8d00, ftCreationTime.dwHighDateTime=0x1d4ca32, ftLastAccessTime.dwLowDateTime=0xeed95110, ftLastAccessTime.dwHighDateTime=0x1d4cd0f, ftLastWriteTime.dwLowDateTime=0xeed95110, ftLastWriteTime.dwHighDateTime=0x1d4cd0f, nFileSizeHigh=0x0, nFileSizeLow=0x15b61, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="uiX5BdPsFMDFbsKCrR.xls", cAlternateFileName="UIX5BD~1.XLS")) returned 0 [0224.563] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0224.563] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\uiX5BdPsFMDFbsKCrR.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\uix5bdpsfmdfbskcrr.xls")) returned 1 [0224.565] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\l34EmG\\uiX5BdPsFMDFbsKCrR.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\l34emg\\uix5bdpsfmdfbskcrr.xls")) returned 0xffffffff [0224.565] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97b8d00, ftCreationTime.dwHighDateTime=0x1d4ca32, ftLastAccessTime.dwLowDateTime=0xeed95110, ftLastAccessTime.dwHighDateTime=0x1d4cd0f, ftLastWriteTime.dwLowDateTime=0xeed95110, ftLastWriteTime.dwHighDateTime=0x1d4cd0f, nFileSizeHigh=0x0, nFileSizeLow=0x15b61, dwReserved0=0x37575175, dwReserved1=0x7673632e, cFileName="uiX5BdPsFMDFbsKCrR.xls", cAlternateFileName="UIX5BD~1.XLS")) returned 0 [0224.565] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0224.565] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x546d93b0, ftCreationTime.dwHighDateTime=0x1d4cad1, ftLastAccessTime.dwLowDateTime=0x9cc69340, ftLastAccessTime.dwHighDateTime=0x1d4cd34, ftLastWriteTime.dwLowDateTime=0x9cc69340, ftLastWriteTime.dwHighDateTime=0x1d4cd34, nFileSizeHigh=0x0, nFileSizeLow=0x646f, dwReserved0=0x4b736246, dwReserved1=0x2e527243, cFileName="P5HgB-k6NjG.docx", cAlternateFileName="P5HGB-~1.DOC")) returned 1 [0224.565] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\P5HgB-k6NjG.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\p5hgb-k6njg.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0224.565] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\P5HgB-k6NjG.docx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\p5hgb-k6njg.docx.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0224.566] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x646f [0224.566] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0224.566] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0224.666] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x646f, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x646f, lpOverlapped=0x0) returned 1 [0224.667] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x6470, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x6470, lpOverlapped=0x0) returned 1 [0224.668] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0224.692] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0224.704] CloseHandle (hObject=0xec) returned 1 [0224.704] CloseHandle (hObject=0xe4) returned 1 [0224.704] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\P5HgB-k6NjG.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\p5hgb-k6njg.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\P5HgB-k6NjG.docx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\p5hgb-k6njg.docx.dvodltmf")) returned 0 [0224.705] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\P5HgB-k6NjG.docx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\p5hgb-k6njg.docx.dvodltmf")) returned 0x20 [0224.705] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\P5HgB-k6NjG.docx", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x546d93b0, ftCreationTime.dwHighDateTime=0x1d4cad1, ftLastAccessTime.dwLowDateTime=0x9cc69340, ftLastAccessTime.dwHighDateTime=0x1d4cd34, ftLastWriteTime.dwLowDateTime=0x9cc69340, ftLastWriteTime.dwHighDateTime=0x1d4cd34, nFileSizeHigh=0x0, nFileSizeLow=0x646f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="P5HgB-k6NjG.docx", cAlternateFileName="P5HGB-~1.DOC")) returned 0x2e8498 [0224.705] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x546d93b0, ftCreationTime.dwHighDateTime=0x1d4cad1, ftLastAccessTime.dwLowDateTime=0x9cc69340, ftLastAccessTime.dwHighDateTime=0x1d4cd34, ftLastWriteTime.dwLowDateTime=0x9cc69340, ftLastWriteTime.dwHighDateTime=0x1d4cd34, nFileSizeHigh=0x0, nFileSizeLow=0x646f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="P5HgB-k6NjG.docx", cAlternateFileName="P5HGB-~1.DOC")) returned 0 [0224.705] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0224.705] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\P5HgB-k6NjG.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\p5hgb-k6njg.docx")) returned 1 [0224.707] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o4uP\\P5HgB-k6NjG.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o4up\\p5hgb-k6njg.docx")) returned 0xffffffff [0224.707] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x546d93b0, ftCreationTime.dwHighDateTime=0x1d4cad1, ftLastAccessTime.dwLowDateTime=0x9cc69340, ftLastAccessTime.dwHighDateTime=0x1d4cd34, ftLastWriteTime.dwLowDateTime=0x9cc69340, ftLastWriteTime.dwHighDateTime=0x1d4cd34, nFileSizeHigh=0x0, nFileSizeLow=0x646f, dwReserved0=0x4b736246, dwReserved1=0x2e527243, cFileName="P5HgB-k6NjG.docx", cAlternateFileName="P5HGB-~1.DOC")) returned 0 [0224.707] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0224.707] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9340c7c0, ftCreationTime.dwHighDateTime=0x1d4d034, ftLastAccessTime.dwLowDateTime=0x4c2a47d0, ftLastAccessTime.dwHighDateTime=0x1d4caf3, ftLastWriteTime.dwLowDateTime=0x4c2a47d0, ftLastWriteTime.dwHighDateTime=0x1d4caf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x636f642e, dwReserved1=0x736c7878, cFileName="oh9QTp", cAlternateFileName="")) returned 1 [0224.707] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9340c7c0, ftCreationTime.dwHighDateTime=0x1d4d034, ftLastAccessTime.dwLowDateTime=0x4c2a47d0, ftLastAccessTime.dwHighDateTime=0x1d4caf3, ftLastWriteTime.dwLowDateTime=0x4c2a47d0, ftLastWriteTime.dwHighDateTime=0x1d4caf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0224.707] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9340c7c0, ftCreationTime.dwHighDateTime=0x1d4d034, ftLastAccessTime.dwLowDateTime=0x4c2a47d0, ftLastAccessTime.dwHighDateTime=0x1d4caf3, ftLastWriteTime.dwLowDateTime=0x4c2a47d0, ftLastWriteTime.dwHighDateTime=0x1d4caf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="..", cAlternateFileName="")) returned 1 [0224.707] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22f416a0, ftCreationTime.dwHighDateTime=0x1d4c839, ftLastAccessTime.dwLowDateTime=0x51bb4b30, ftLastAccessTime.dwHighDateTime=0x1d4ced2, ftLastWriteTime.dwLowDateTime=0x51bb4b30, ftLastWriteTime.dwHighDateTime=0x1d4ced2, nFileSizeHigh=0x0, nFileSizeLow=0x153c9, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="3 BomAB.ods", cAlternateFileName="3BOMAB~1.ODS")) returned 1 [0224.708] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\3 BomAB.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh9qtp\\3 bomab.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0224.708] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\3 BomAB.ods.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh9qtp\\3 bomab.ods.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0224.708] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x153c9 [0224.708] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0224.709] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0224.834] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x153c9, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x153c9, lpOverlapped=0x0) returned 1 [0224.836] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x153d0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x153d0, lpOverlapped=0x0) returned 1 [0224.838] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0224.866] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0224.877] CloseHandle (hObject=0xe4) returned 1 [0224.877] CloseHandle (hObject=0xec) returned 1 [0224.878] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\3 BomAB.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh9qtp\\3 bomab.ods"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\3 BomAB.ods.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh9qtp\\3 bomab.ods.dvodltmf")) returned 0 [0224.879] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\3 BomAB.ods.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh9qtp\\3 bomab.ods.dvodltmf")) returned 0x20 [0224.879] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\3 BomAB.ods", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22f416a0, ftCreationTime.dwHighDateTime=0x1d4c839, ftLastAccessTime.dwLowDateTime=0x51bb4b30, ftLastAccessTime.dwHighDateTime=0x1d4ced2, ftLastWriteTime.dwLowDateTime=0x51bb4b30, ftLastWriteTime.dwHighDateTime=0x1d4ced2, nFileSizeHigh=0x0, nFileSizeLow=0x153c9, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="3 BomAB.ods", cAlternateFileName="3BOMAB~1.ODS")) returned 0x2e8498 [0224.879] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22f416a0, ftCreationTime.dwHighDateTime=0x1d4c839, ftLastAccessTime.dwLowDateTime=0x51bb4b30, ftLastAccessTime.dwHighDateTime=0x1d4ced2, ftLastWriteTime.dwLowDateTime=0x51bb4b30, ftLastWriteTime.dwHighDateTime=0x1d4ced2, nFileSizeHigh=0x0, nFileSizeLow=0x153c9, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="3 BomAB.ods", cAlternateFileName="3BOMAB~1.ODS")) returned 0 [0224.879] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0224.879] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\3 BomAB.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh9qtp\\3 bomab.ods")) returned 1 [0224.881] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\3 BomAB.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh9qtp\\3 bomab.ods")) returned 0xffffffff [0224.881] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x422ae510, ftCreationTime.dwHighDateTime=0x1d4cbba, ftLastAccessTime.dwLowDateTime=0xd3712a70, ftLastAccessTime.dwHighDateTime=0x1d4cd4a, ftLastWriteTime.dwLowDateTime=0xd3712a70, ftLastWriteTime.dwHighDateTime=0x1d4cd4a, nFileSizeHigh=0x0, nFileSizeLow=0x16b32, dwReserved0=0x0, dwReserved1=0x0, cFileName="6Euyj0AK2Oua_19Sy5mn.odt", cAlternateFileName="6EUYJ0~1.ODT")) returned 1 [0224.881] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\6Euyj0AK2Oua_19Sy5mn.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh9qtp\\6euyj0ak2oua_19sy5mn.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0224.881] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\6Euyj0AK2Oua_19Sy5mn.odt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh9qtp\\6euyj0ak2oua_19sy5mn.odt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0224.882] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16b32 [0224.882] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0224.882] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0224.977] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x16b32, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x16b32, lpOverlapped=0x0) returned 1 [0224.981] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x16b40, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x16b40, lpOverlapped=0x0) returned 1 [0224.983] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0225.005] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0225.016] CloseHandle (hObject=0xec) returned 1 [0225.016] CloseHandle (hObject=0xe4) returned 1 [0225.016] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\6Euyj0AK2Oua_19Sy5mn.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh9qtp\\6euyj0ak2oua_19sy5mn.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\6Euyj0AK2Oua_19Sy5mn.odt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh9qtp\\6euyj0ak2oua_19sy5mn.odt.dvodltmf")) returned 0 [0225.017] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\6Euyj0AK2Oua_19Sy5mn.odt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh9qtp\\6euyj0ak2oua_19sy5mn.odt.dvodltmf")) returned 0x20 [0225.017] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\6Euyj0AK2Oua_19Sy5mn.odt", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x422ae510, ftCreationTime.dwHighDateTime=0x1d4cbba, ftLastAccessTime.dwLowDateTime=0xd3712a70, ftLastAccessTime.dwHighDateTime=0x1d4cd4a, ftLastWriteTime.dwLowDateTime=0xd3712a70, ftLastWriteTime.dwHighDateTime=0x1d4cd4a, nFileSizeHigh=0x0, nFileSizeLow=0x16b32, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="6Euyj0AK2Oua_19Sy5mn.odt", cAlternateFileName="6EUYJ0~1.ODT")) returned 0x2e8498 [0225.017] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x422ae510, ftCreationTime.dwHighDateTime=0x1d4cbba, ftLastAccessTime.dwLowDateTime=0xd3712a70, ftLastAccessTime.dwHighDateTime=0x1d4cd4a, ftLastWriteTime.dwLowDateTime=0xd3712a70, ftLastWriteTime.dwHighDateTime=0x1d4cd4a, nFileSizeHigh=0x0, nFileSizeLow=0x16b32, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="6Euyj0AK2Oua_19Sy5mn.odt", cAlternateFileName="6EUYJ0~1.ODT")) returned 0 [0225.017] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0225.017] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\6Euyj0AK2Oua_19Sy5mn.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh9qtp\\6euyj0ak2oua_19sy5mn.odt")) returned 1 [0225.019] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\6Euyj0AK2Oua_19Sy5mn.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh9qtp\\6euyj0ak2oua_19sy5mn.odt")) returned 0xffffffff [0225.019] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57a719d0, ftCreationTime.dwHighDateTime=0x1d4cd00, ftLastAccessTime.dwLowDateTime=0xe350330, ftLastAccessTime.dwHighDateTime=0x1d4cc8c, ftLastWriteTime.dwLowDateTime=0xe350330, ftLastWriteTime.dwHighDateTime=0x1d4cc8c, nFileSizeHigh=0x0, nFileSizeLow=0xf685, dwReserved0=0x0, dwReserved1=0x0, cFileName="agUo4TPBVzCT.docx", cAlternateFileName="AGUO4T~1.DOC")) returned 1 [0225.019] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\agUo4TPBVzCT.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh9qtp\\aguo4tpbvzct.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0225.020] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\agUo4TPBVzCT.docx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh9qtp\\aguo4tpbvzct.docx.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0225.020] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf685 [0225.020] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0225.020] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0225.109] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xf685, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0xf685, lpOverlapped=0x0) returned 1 [0225.111] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf690, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0xf690, lpOverlapped=0x0) returned 1 [0225.113] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0225.135] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0225.146] CloseHandle (hObject=0xe4) returned 1 [0225.146] CloseHandle (hObject=0xec) returned 1 [0225.146] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\agUo4TPBVzCT.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh9qtp\\aguo4tpbvzct.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\agUo4TPBVzCT.docx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh9qtp\\aguo4tpbvzct.docx.dvodltmf")) returned 0 [0225.147] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\agUo4TPBVzCT.docx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh9qtp\\aguo4tpbvzct.docx.dvodltmf")) returned 0x20 [0225.147] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\agUo4TPBVzCT.docx", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57a719d0, ftCreationTime.dwHighDateTime=0x1d4cd00, ftLastAccessTime.dwLowDateTime=0xe350330, ftLastAccessTime.dwHighDateTime=0x1d4cc8c, ftLastWriteTime.dwLowDateTime=0xe350330, ftLastWriteTime.dwHighDateTime=0x1d4cc8c, nFileSizeHigh=0x0, nFileSizeLow=0xf685, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="agUo4TPBVzCT.docx", cAlternateFileName="AGUO4T~1.DOC")) returned 0x2e8498 [0225.148] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57a719d0, ftCreationTime.dwHighDateTime=0x1d4cd00, ftLastAccessTime.dwLowDateTime=0xe350330, ftLastAccessTime.dwHighDateTime=0x1d4cc8c, ftLastWriteTime.dwLowDateTime=0xe350330, ftLastWriteTime.dwHighDateTime=0x1d4cc8c, nFileSizeHigh=0x0, nFileSizeLow=0xf685, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="agUo4TPBVzCT.docx", cAlternateFileName="AGUO4T~1.DOC")) returned 0 [0225.148] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0225.148] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\agUo4TPBVzCT.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh9qtp\\aguo4tpbvzct.docx")) returned 1 [0225.150] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\agUo4TPBVzCT.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh9qtp\\aguo4tpbvzct.docx")) returned 0xffffffff [0225.150] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c2b2670, ftCreationTime.dwHighDateTime=0x1d4cfba, ftLastAccessTime.dwLowDateTime=0x50b536a0, ftLastAccessTime.dwHighDateTime=0x1d4c69f, ftLastWriteTime.dwLowDateTime=0x50b536a0, ftLastWriteTime.dwHighDateTime=0x1d4c69f, nFileSizeHigh=0x0, nFileSizeLow=0x14f2d, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="oX-YtH9a.docx", cAlternateFileName="OX-YTH~1.DOC")) returned 1 [0225.150] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\oX-YtH9a.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh9qtp\\ox-yth9a.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0225.150] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\oX-YtH9a.docx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh9qtp\\ox-yth9a.docx.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0225.151] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14f2d [0225.151] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0225.151] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0225.239] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x14f2d, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x14f2d, lpOverlapped=0x0) returned 1 [0225.241] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x14f30, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x14f30, lpOverlapped=0x0) returned 1 [0225.243] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0225.266] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0225.277] CloseHandle (hObject=0xec) returned 1 [0225.278] CloseHandle (hObject=0xe4) returned 1 [0225.278] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\oX-YtH9a.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh9qtp\\ox-yth9a.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\oX-YtH9a.docx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh9qtp\\ox-yth9a.docx.dvodltmf")) returned 0 [0225.279] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\oX-YtH9a.docx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh9qtp\\ox-yth9a.docx.dvodltmf")) returned 0x20 [0225.279] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\oX-YtH9a.docx", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c2b2670, ftCreationTime.dwHighDateTime=0x1d4cfba, ftLastAccessTime.dwLowDateTime=0x50b536a0, ftLastAccessTime.dwHighDateTime=0x1d4c69f, ftLastWriteTime.dwLowDateTime=0x50b536a0, ftLastWriteTime.dwHighDateTime=0x1d4c69f, nFileSizeHigh=0x0, nFileSizeLow=0x14f2d, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="oX-YtH9a.docx", cAlternateFileName="OX-YTH~1.DOC")) returned 0x2e8498 [0225.279] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c2b2670, ftCreationTime.dwHighDateTime=0x1d4cfba, ftLastAccessTime.dwLowDateTime=0x50b536a0, ftLastAccessTime.dwHighDateTime=0x1d4c69f, ftLastWriteTime.dwLowDateTime=0x50b536a0, ftLastWriteTime.dwHighDateTime=0x1d4c69f, nFileSizeHigh=0x0, nFileSizeLow=0x14f2d, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="oX-YtH9a.docx", cAlternateFileName="OX-YTH~1.DOC")) returned 0 [0225.279] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0225.279] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\oX-YtH9a.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh9qtp\\ox-yth9a.docx")) returned 1 [0225.281] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\oX-YtH9a.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh9qtp\\ox-yth9a.docx")) returned 0xffffffff [0225.281] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdae0fe00, ftCreationTime.dwHighDateTime=0x1d4c6b7, ftLastAccessTime.dwLowDateTime=0xa7924f90, ftLastAccessTime.dwHighDateTime=0x1d4cb21, ftLastWriteTime.dwLowDateTime=0xa7924f90, ftLastWriteTime.dwHighDateTime=0x1d4cb21, nFileSizeHigh=0x0, nFileSizeLow=0x57bb, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="wPGoGpK0u9zAIveQT.docx", cAlternateFileName="WPGOGP~1.DOC")) returned 1 [0225.281] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\wPGoGpK0u9zAIveQT.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh9qtp\\wpgogpk0u9zaiveqt.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0225.281] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\wPGoGpK0u9zAIveQT.docx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh9qtp\\wpgogpk0u9zaiveqt.docx.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0225.282] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x57bb [0225.282] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0225.282] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0225.417] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x57bb, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x57bb, lpOverlapped=0x0) returned 1 [0225.418] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x57c0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x57c0, lpOverlapped=0x0) returned 1 [0225.420] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0225.442] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0225.453] CloseHandle (hObject=0xe4) returned 1 [0225.453] CloseHandle (hObject=0xec) returned 1 [0225.454] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\wPGoGpK0u9zAIveQT.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh9qtp\\wpgogpk0u9zaiveqt.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\wPGoGpK0u9zAIveQT.docx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh9qtp\\wpgogpk0u9zaiveqt.docx.dvodltmf")) returned 0 [0225.455] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\wPGoGpK0u9zAIveQT.docx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh9qtp\\wpgogpk0u9zaiveqt.docx.dvodltmf")) returned 0x20 [0225.455] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\wPGoGpK0u9zAIveQT.docx", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdae0fe00, ftCreationTime.dwHighDateTime=0x1d4c6b7, ftLastAccessTime.dwLowDateTime=0xa7924f90, ftLastAccessTime.dwHighDateTime=0x1d4cb21, ftLastWriteTime.dwLowDateTime=0xa7924f90, ftLastWriteTime.dwHighDateTime=0x1d4cb21, nFileSizeHigh=0x0, nFileSizeLow=0x57bb, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="wPGoGpK0u9zAIveQT.docx", cAlternateFileName="WPGOGP~1.DOC")) returned 0x2e8498 [0225.455] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdae0fe00, ftCreationTime.dwHighDateTime=0x1d4c6b7, ftLastAccessTime.dwLowDateTime=0xa7924f90, ftLastAccessTime.dwHighDateTime=0x1d4cb21, ftLastWriteTime.dwLowDateTime=0xa7924f90, ftLastWriteTime.dwHighDateTime=0x1d4cb21, nFileSizeHigh=0x0, nFileSizeLow=0x57bb, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="wPGoGpK0u9zAIveQT.docx", cAlternateFileName="WPGOGP~1.DOC")) returned 0 [0225.455] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0225.455] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\wPGoGpK0u9zAIveQT.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh9qtp\\wpgogpk0u9zaiveqt.docx")) returned 1 [0225.457] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oh9QTp\\wPGoGpK0u9zAIveQT.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh9qtp\\wpgogpk0u9zaiveqt.docx")) returned 0xffffffff [0225.457] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdae0fe00, ftCreationTime.dwHighDateTime=0x1d4c6b7, ftLastAccessTime.dwLowDateTime=0xa7924f90, ftLastAccessTime.dwHighDateTime=0x1d4cb21, ftLastWriteTime.dwLowDateTime=0xa7924f90, ftLastWriteTime.dwHighDateTime=0x1d4cb21, nFileSizeHigh=0x0, nFileSizeLow=0x57bb, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="wPGoGpK0u9zAIveQT.docx", cAlternateFileName="WPGOGP~1.DOC")) returned 0 [0225.457] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0225.457] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65764941, dwReserved1=0x642e5451, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0225.457] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0225.458] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0225.458] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6228cf40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 1 [0225.458] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0225.458] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0225.459] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x42400 [0225.459] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0225.459] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0225.554] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x42400, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x42400, lpOverlapped=0x0) returned 1 [0225.561] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x42410, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x42410, lpOverlapped=0x0) returned 1 [0225.567] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0225.591] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0225.602] CloseHandle (hObject=0xec) returned 1 [0225.602] CloseHandle (hObject=0xe4) returned 1 [0225.602] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst.dvodltmf")) returned 0 [0225.603] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst.dvodltmf")) returned 0x20 [0225.603] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6228cf40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 0x2e8498 [0225.603] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6228cf40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 0 [0225.603] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0225.603] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst")) returned 1 [0225.607] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst")) returned 0xffffffff [0225.607] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6228cf40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 0 [0225.607] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0225.607] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56f6d2c0, ftCreationTime.dwHighDateTime=0x1d5b646, ftLastAccessTime.dwLowDateTime=0x941a4f10, ftLastAccessTime.dwHighDateTime=0x1d5770d, ftLastWriteTime.dwLowDateTime=0x941a4f10, ftLastWriteTime.dwHighDateTime=0x1d5770d, nFileSizeHigh=0x0, nFileSizeLow=0x33b2, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="P14cuiSl.xlsx", cAlternateFileName="P14CUI~1.XLS")) returned 1 [0225.607] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\P14cuiSl.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p14cuisl.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0225.607] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\P14cuiSl.xlsx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p14cuisl.xlsx.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0225.608] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x33b2 [0225.608] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0225.608] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0225.709] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x33b2, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x33b2, lpOverlapped=0x0) returned 1 [0225.710] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x33c0, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x33c0, lpOverlapped=0x0) returned 1 [0225.712] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0225.735] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0225.747] CloseHandle (hObject=0xd8) returned 1 [0225.747] CloseHandle (hObject=0xe4) returned 1 [0225.747] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\P14cuiSl.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p14cuisl.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\P14cuiSl.xlsx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p14cuisl.xlsx.dvodltmf")) returned 0 [0225.748] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\P14cuiSl.xlsx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p14cuisl.xlsx.dvodltmf")) returned 0x20 [0225.748] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\P14cuiSl.xlsx", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56f6d2c0, ftCreationTime.dwHighDateTime=0x1d5b646, ftLastAccessTime.dwLowDateTime=0x941a4f10, ftLastAccessTime.dwHighDateTime=0x1d5770d, ftLastWriteTime.dwLowDateTime=0x941a4f10, ftLastWriteTime.dwHighDateTime=0x1d5770d, nFileSizeHigh=0x0, nFileSizeLow=0x33b2, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="P14cuiSl.xlsx", cAlternateFileName="P14CUI~1.XLS")) returned 0x2e8458 [0225.748] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56f6d2c0, ftCreationTime.dwHighDateTime=0x1d5b646, ftLastAccessTime.dwLowDateTime=0x941a4f10, ftLastAccessTime.dwHighDateTime=0x1d5770d, ftLastWriteTime.dwLowDateTime=0x941a4f10, ftLastWriteTime.dwHighDateTime=0x1d5770d, nFileSizeHigh=0x0, nFileSizeLow=0x33b2, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="P14cuiSl.xlsx", cAlternateFileName="P14CUI~1.XLS")) returned 0 [0225.748] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0225.749] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\P14cuiSl.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p14cuisl.xlsx")) returned 1 [0225.750] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\P14cuiSl.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p14cuisl.xlsx")) returned 0xffffffff [0225.750] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba41000, ftCreationTime.dwHighDateTime=0x1d5af55, ftLastAccessTime.dwLowDateTime=0x58e3afc0, ftLastAccessTime.dwHighDateTime=0x1d5334e, ftLastWriteTime.dwLowDateTime=0x58e3afc0, ftLastWriteTime.dwHighDateTime=0x1d5334e, nFileSizeHigh=0x0, nFileSizeLow=0x7b9e, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="QP97VClzdId.pptx", cAlternateFileName="QP97VC~1.PPT")) returned 1 [0225.750] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QP97VClzdId.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qp97vclzdid.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0225.750] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QP97VClzdId.pptx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qp97vclzdid.pptx.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0225.751] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7b9e [0225.751] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0225.752] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0225.841] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x7b9e, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x7b9e, lpOverlapped=0x0) returned 1 [0225.842] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x7ba0, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x7ba0, lpOverlapped=0x0) returned 1 [0225.844] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0225.866] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0225.878] CloseHandle (hObject=0xe4) returned 1 [0225.878] CloseHandle (hObject=0xd8) returned 1 [0225.878] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QP97VClzdId.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qp97vclzdid.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QP97VClzdId.pptx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qp97vclzdid.pptx.dvodltmf")) returned 0 [0225.879] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QP97VClzdId.pptx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qp97vclzdid.pptx.dvodltmf")) returned 0x20 [0225.879] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QP97VClzdId.pptx", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba41000, ftCreationTime.dwHighDateTime=0x1d5af55, ftLastAccessTime.dwLowDateTime=0x58e3afc0, ftLastAccessTime.dwHighDateTime=0x1d5334e, ftLastWriteTime.dwLowDateTime=0x58e3afc0, ftLastWriteTime.dwHighDateTime=0x1d5334e, nFileSizeHigh=0x0, nFileSizeLow=0x7b9e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="QP97VClzdId.pptx", cAlternateFileName="QP97VC~1.PPT")) returned 0x2e8458 [0225.879] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba41000, ftCreationTime.dwHighDateTime=0x1d5af55, ftLastAccessTime.dwLowDateTime=0x58e3afc0, ftLastAccessTime.dwHighDateTime=0x1d5334e, ftLastWriteTime.dwLowDateTime=0x58e3afc0, ftLastWriteTime.dwHighDateTime=0x1d5334e, nFileSizeHigh=0x0, nFileSizeLow=0x7b9e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="QP97VClzdId.pptx", cAlternateFileName="QP97VC~1.PPT")) returned 0 [0225.879] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0225.879] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QP97VClzdId.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qp97vclzdid.pptx")) returned 1 [0225.881] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QP97VClzdId.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qp97vclzdid.pptx")) returned 0xffffffff [0225.881] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb647310, ftCreationTime.dwHighDateTime=0x1d4c58a, ftLastAccessTime.dwLowDateTime=0x6a85ac20, ftLastAccessTime.dwHighDateTime=0x1d4d16e, ftLastWriteTime.dwLowDateTime=0x6a85ac20, ftLastWriteTime.dwHighDateTime=0x1d4d16e, nFileSizeHigh=0x0, nFileSizeLow=0x3b37, dwReserved0=0x0, dwReserved1=0x0, cFileName="R2fXTgH_d0P8aJ.ods", cAlternateFileName="R2FXTG~1.ODS")) returned 1 [0225.881] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\R2fXTgH_d0P8aJ.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\r2fxtgh_d0p8aj.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0225.881] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\R2fXTgH_d0P8aJ.ods.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\r2fxtgh_d0p8aj.ods.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0225.882] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b37 [0225.882] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0225.882] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0225.972] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3b37, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x3b37, lpOverlapped=0x0) returned 1 [0225.973] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x3b40, lpOverlapped=0x0) returned 1 [0225.974] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0225.997] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0226.008] CloseHandle (hObject=0xd8) returned 1 [0226.008] CloseHandle (hObject=0xe4) returned 1 [0226.008] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\R2fXTgH_d0P8aJ.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\r2fxtgh_d0p8aj.ods"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\R2fXTgH_d0P8aJ.ods.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\r2fxtgh_d0p8aj.ods.dvodltmf")) returned 0 [0226.009] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\R2fXTgH_d0P8aJ.ods.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\r2fxtgh_d0p8aj.ods.dvodltmf")) returned 0x20 [0226.009] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\R2fXTgH_d0P8aJ.ods", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb647310, ftCreationTime.dwHighDateTime=0x1d4c58a, ftLastAccessTime.dwLowDateTime=0x6a85ac20, ftLastAccessTime.dwHighDateTime=0x1d4d16e, ftLastWriteTime.dwLowDateTime=0x6a85ac20, ftLastWriteTime.dwHighDateTime=0x1d4d16e, nFileSizeHigh=0x0, nFileSizeLow=0x3b37, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="R2fXTgH_d0P8aJ.ods", cAlternateFileName="R2FXTG~1.ODS")) returned 0x2e8458 [0226.009] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb647310, ftCreationTime.dwHighDateTime=0x1d4c58a, ftLastAccessTime.dwLowDateTime=0x6a85ac20, ftLastAccessTime.dwHighDateTime=0x1d4d16e, ftLastWriteTime.dwLowDateTime=0x6a85ac20, ftLastWriteTime.dwHighDateTime=0x1d4d16e, nFileSizeHigh=0x0, nFileSizeLow=0x3b37, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="R2fXTgH_d0P8aJ.ods", cAlternateFileName="R2FXTG~1.ODS")) returned 0 [0226.009] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0226.009] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\R2fXTgH_d0P8aJ.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\r2fxtgh_d0p8aj.ods")) returned 1 [0226.011] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\R2fXTgH_d0P8aJ.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\r2fxtgh_d0p8aj.ods")) returned 0xffffffff [0226.011] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd07365a0, ftCreationTime.dwHighDateTime=0x1d5481e, ftLastAccessTime.dwLowDateTime=0x3c09e5f0, ftLastAccessTime.dwHighDateTime=0x1d5961c, ftLastWriteTime.dwLowDateTime=0x3c09e5f0, ftLastWriteTime.dwHighDateTime=0x1d5961c, nFileSizeHigh=0x0, nFileSizeLow=0x640c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RTRpDDHHvWqeVWn.pptx", cAlternateFileName="RTRPDD~1.PPT")) returned 1 [0226.011] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RTRpDDHHvWqeVWn.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rtrpddhhvwqevwn.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0226.011] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RTRpDDHHvWqeVWn.pptx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rtrpddhhvwqevwn.pptx.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0226.012] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x640c [0226.012] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0226.012] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0226.108] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x640c, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x640c, lpOverlapped=0x0) returned 1 [0226.109] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x6410, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x6410, lpOverlapped=0x0) returned 1 [0226.111] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0226.134] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0226.145] CloseHandle (hObject=0xe4) returned 1 [0226.145] CloseHandle (hObject=0xd8) returned 1 [0226.145] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RTRpDDHHvWqeVWn.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rtrpddhhvwqevwn.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RTRpDDHHvWqeVWn.pptx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rtrpddhhvwqevwn.pptx.dvodltmf")) returned 0 [0226.147] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RTRpDDHHvWqeVWn.pptx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rtrpddhhvwqevwn.pptx.dvodltmf")) returned 0x20 [0226.147] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RTRpDDHHvWqeVWn.pptx", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd07365a0, ftCreationTime.dwHighDateTime=0x1d5481e, ftLastAccessTime.dwLowDateTime=0x3c09e5f0, ftLastAccessTime.dwHighDateTime=0x1d5961c, ftLastWriteTime.dwLowDateTime=0x3c09e5f0, ftLastWriteTime.dwHighDateTime=0x1d5961c, nFileSizeHigh=0x0, nFileSizeLow=0x640c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="RTRpDDHHvWqeVWn.pptx", cAlternateFileName="RTRPDD~1.PPT")) returned 0x2e8458 [0226.148] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd07365a0, ftCreationTime.dwHighDateTime=0x1d5481e, ftLastAccessTime.dwLowDateTime=0x3c09e5f0, ftLastAccessTime.dwHighDateTime=0x1d5961c, ftLastWriteTime.dwLowDateTime=0x3c09e5f0, ftLastWriteTime.dwHighDateTime=0x1d5961c, nFileSizeHigh=0x0, nFileSizeLow=0x640c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="RTRpDDHHvWqeVWn.pptx", cAlternateFileName="RTRPDD~1.PPT")) returned 0 [0226.148] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0226.148] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RTRpDDHHvWqeVWn.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rtrpddhhvwqevwn.pptx")) returned 1 [0226.150] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RTRpDDHHvWqeVWn.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rtrpddhhvwqevwn.pptx")) returned 0xffffffff [0226.150] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14cffc80, ftCreationTime.dwHighDateTime=0x1d59b0e, ftLastAccessTime.dwLowDateTime=0x7c3bf640, ftLastAccessTime.dwHighDateTime=0x1d57b8c, ftLastWriteTime.dwLowDateTime=0x7c3bf640, ftLastWriteTime.dwHighDateTime=0x1d57b8c, nFileSizeHigh=0x0, nFileSizeLow=0xcaf5, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="SRKICHLSz3vxLCuPI.docx", cAlternateFileName="SRKICH~1.DOC")) returned 1 [0226.150] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SRKICHLSz3vxLCuPI.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\srkichlsz3vxlcupi.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0226.150] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SRKICHLSz3vxLCuPI.docx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\srkichlsz3vxlcupi.docx.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0226.151] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcaf5 [0226.151] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0226.152] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0226.240] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xcaf5, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0xcaf5, lpOverlapped=0x0) returned 1 [0226.241] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xcb00, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0xcb00, lpOverlapped=0x0) returned 1 [0226.243] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0226.266] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0226.277] CloseHandle (hObject=0xd8) returned 1 [0226.277] CloseHandle (hObject=0xe4) returned 1 [0226.277] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SRKICHLSz3vxLCuPI.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\srkichlsz3vxlcupi.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SRKICHLSz3vxLCuPI.docx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\srkichlsz3vxlcupi.docx.dvodltmf")) returned 0 [0226.278] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SRKICHLSz3vxLCuPI.docx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\srkichlsz3vxlcupi.docx.dvodltmf")) returned 0x20 [0226.278] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SRKICHLSz3vxLCuPI.docx", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14cffc80, ftCreationTime.dwHighDateTime=0x1d59b0e, ftLastAccessTime.dwLowDateTime=0x7c3bf640, ftLastAccessTime.dwHighDateTime=0x1d57b8c, ftLastWriteTime.dwLowDateTime=0x7c3bf640, ftLastWriteTime.dwHighDateTime=0x1d57b8c, nFileSizeHigh=0x0, nFileSizeLow=0xcaf5, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="SRKICHLSz3vxLCuPI.docx", cAlternateFileName="SRKICH~1.DOC")) returned 0x2e8458 [0226.278] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14cffc80, ftCreationTime.dwHighDateTime=0x1d59b0e, ftLastAccessTime.dwLowDateTime=0x7c3bf640, ftLastAccessTime.dwHighDateTime=0x1d57b8c, ftLastWriteTime.dwLowDateTime=0x7c3bf640, ftLastWriteTime.dwHighDateTime=0x1d57b8c, nFileSizeHigh=0x0, nFileSizeLow=0xcaf5, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="SRKICHLSz3vxLCuPI.docx", cAlternateFileName="SRKICH~1.DOC")) returned 0 [0226.278] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0226.278] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SRKICHLSz3vxLCuPI.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\srkichlsz3vxlcupi.docx")) returned 1 [0226.280] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SRKICHLSz3vxLCuPI.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\srkichlsz3vxlcupi.docx")) returned 0xffffffff [0226.280] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b0874d0, ftCreationTime.dwHighDateTime=0x1d4ccad, ftLastAccessTime.dwLowDateTime=0x8391d250, ftLastAccessTime.dwHighDateTime=0x1d4d02b, ftLastWriteTime.dwLowDateTime=0x8391d250, ftLastWriteTime.dwHighDateTime=0x1d4d02b, nFileSizeHigh=0x0, nFileSizeLow=0xe6e, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="usgjtq.odp", cAlternateFileName="")) returned 1 [0226.280] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\usgjtq.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\usgjtq.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0226.280] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\usgjtq.odp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\usgjtq.odp.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0226.281] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe6e [0226.281] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0226.281] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0226.380] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe6e, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0xe6e, lpOverlapped=0x0) returned 1 [0226.380] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0xe70, lpOverlapped=0x0) returned 1 [0226.382] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0226.404] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0226.416] CloseHandle (hObject=0xe4) returned 1 [0226.416] CloseHandle (hObject=0xd8) returned 1 [0226.416] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\usgjtq.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\usgjtq.odp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\usgjtq.odp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\usgjtq.odp.dvodltmf")) returned 0 [0226.417] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\usgjtq.odp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\usgjtq.odp.dvodltmf")) returned 0x20 [0226.417] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\usgjtq.odp", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b0874d0, ftCreationTime.dwHighDateTime=0x1d4ccad, ftLastAccessTime.dwLowDateTime=0x8391d250, ftLastAccessTime.dwHighDateTime=0x1d4d02b, ftLastWriteTime.dwLowDateTime=0x8391d250, ftLastWriteTime.dwHighDateTime=0x1d4d02b, nFileSizeHigh=0x0, nFileSizeLow=0xe6e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="usgjtq.odp", cAlternateFileName="")) returned 0x2e8458 [0226.417] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b0874d0, ftCreationTime.dwHighDateTime=0x1d4ccad, ftLastAccessTime.dwLowDateTime=0x8391d250, ftLastAccessTime.dwHighDateTime=0x1d4d02b, ftLastWriteTime.dwLowDateTime=0x8391d250, ftLastWriteTime.dwHighDateTime=0x1d4d02b, nFileSizeHigh=0x0, nFileSizeLow=0xe6e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="usgjtq.odp", cAlternateFileName="")) returned 0 [0226.417] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0226.417] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\usgjtq.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\usgjtq.odp")) returned 1 [0226.419] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\usgjtq.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\usgjtq.odp")) returned 0xffffffff [0226.419] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca04db90, ftCreationTime.dwHighDateTime=0x1d56f15, ftLastAccessTime.dwLowDateTime=0x3f14d310, ftLastAccessTime.dwHighDateTime=0x1d5ae25, ftLastWriteTime.dwLowDateTime=0x3f14d310, ftLastWriteTime.dwHighDateTime=0x1d5ae25, nFileSizeHigh=0x0, nFileSizeLow=0x13be5, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="W_6oxCtCN-.xlsx", cAlternateFileName="W_6OXC~1.XLS")) returned 1 [0226.419] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\W_6oxCtCN-.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\w_6oxctcn-.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0226.419] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\W_6oxCtCN-.xlsx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\w_6oxctcn-.xlsx.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0226.420] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13be5 [0226.420] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0226.420] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0226.517] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x13be5, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x13be5, lpOverlapped=0x0) returned 1 [0226.519] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x13bf0, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x13bf0, lpOverlapped=0x0) returned 1 [0226.521] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0226.545] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0226.556] CloseHandle (hObject=0xd8) returned 1 [0226.556] CloseHandle (hObject=0xe4) returned 1 [0226.556] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\W_6oxCtCN-.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\w_6oxctcn-.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\W_6oxCtCN-.xlsx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\w_6oxctcn-.xlsx.dvodltmf")) returned 0 [0226.558] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\W_6oxCtCN-.xlsx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\w_6oxctcn-.xlsx.dvodltmf")) returned 0x20 [0226.558] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\W_6oxCtCN-.xlsx", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca04db90, ftCreationTime.dwHighDateTime=0x1d56f15, ftLastAccessTime.dwLowDateTime=0x3f14d310, ftLastAccessTime.dwHighDateTime=0x1d5ae25, ftLastWriteTime.dwLowDateTime=0x3f14d310, ftLastWriteTime.dwHighDateTime=0x1d5ae25, nFileSizeHigh=0x0, nFileSizeLow=0x13be5, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="W_6oxCtCN-.xlsx", cAlternateFileName="W_6OXC~1.XLS")) returned 0x2e8458 [0226.558] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca04db90, ftCreationTime.dwHighDateTime=0x1d56f15, ftLastAccessTime.dwLowDateTime=0x3f14d310, ftLastAccessTime.dwHighDateTime=0x1d5ae25, ftLastWriteTime.dwLowDateTime=0x3f14d310, ftLastWriteTime.dwHighDateTime=0x1d5ae25, nFileSizeHigh=0x0, nFileSizeLow=0x13be5, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="W_6oxCtCN-.xlsx", cAlternateFileName="W_6OXC~1.XLS")) returned 0 [0226.558] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0226.558] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\W_6oxCtCN-.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\w_6oxctcn-.xlsx")) returned 1 [0226.560] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\W_6oxCtCN-.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\w_6oxctcn-.xlsx")) returned 0xffffffff [0226.560] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21893490, ftCreationTime.dwHighDateTime=0x1d551b8, ftLastAccessTime.dwLowDateTime=0xb041df0, ftLastAccessTime.dwHighDateTime=0x1d5834c, ftLastWriteTime.dwLowDateTime=0xb041df0, ftLastWriteTime.dwHighDateTime=0x1d5834c, nFileSizeHigh=0x0, nFileSizeLow=0x5bb, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="XGXcLAkDayu9dYpJRN.pptx", cAlternateFileName="XGXCLA~1.PPT")) returned 1 [0226.560] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XGXcLAkDayu9dYpJRN.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xgxclakdayu9dypjrn.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0226.560] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XGXcLAkDayu9dYpJRN.pptx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xgxclakdayu9dypjrn.pptx.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0226.561] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5bb [0226.561] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0226.561] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0226.663] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x5bb, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x5bb, lpOverlapped=0x0) returned 1 [0226.664] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x5c0, lpOverlapped=0x0) returned 1 [0226.665] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0226.687] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0226.698] CloseHandle (hObject=0xe4) returned 1 [0226.698] CloseHandle (hObject=0xd8) returned 1 [0226.698] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XGXcLAkDayu9dYpJRN.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xgxclakdayu9dypjrn.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XGXcLAkDayu9dYpJRN.pptx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xgxclakdayu9dypjrn.pptx.dvodltmf")) returned 0 [0226.699] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XGXcLAkDayu9dYpJRN.pptx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xgxclakdayu9dypjrn.pptx.dvodltmf")) returned 0x20 [0226.699] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XGXcLAkDayu9dYpJRN.pptx", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21893490, ftCreationTime.dwHighDateTime=0x1d551b8, ftLastAccessTime.dwLowDateTime=0xb041df0, ftLastAccessTime.dwHighDateTime=0x1d5834c, ftLastWriteTime.dwLowDateTime=0xb041df0, ftLastWriteTime.dwHighDateTime=0x1d5834c, nFileSizeHigh=0x0, nFileSizeLow=0x5bb, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="XGXcLAkDayu9dYpJRN.pptx", cAlternateFileName="XGXCLA~1.PPT")) returned 0x2e8458 [0226.700] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21893490, ftCreationTime.dwHighDateTime=0x1d551b8, ftLastAccessTime.dwLowDateTime=0xb041df0, ftLastAccessTime.dwHighDateTime=0x1d5834c, ftLastWriteTime.dwLowDateTime=0xb041df0, ftLastWriteTime.dwHighDateTime=0x1d5834c, nFileSizeHigh=0x0, nFileSizeLow=0x5bb, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="XGXcLAkDayu9dYpJRN.pptx", cAlternateFileName="XGXCLA~1.PPT")) returned 0 [0226.700] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0226.700] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XGXcLAkDayu9dYpJRN.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xgxclakdayu9dypjrn.pptx")) returned 1 [0226.701] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XGXcLAkDayu9dYpJRN.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xgxclakdayu9dypjrn.pptx")) returned 0xffffffff [0226.701] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba13b7c0, ftCreationTime.dwHighDateTime=0x1d59160, ftLastAccessTime.dwLowDateTime=0x6f316d70, ftLastAccessTime.dwHighDateTime=0x1d56fbd, ftLastWriteTime.dwLowDateTime=0x6f316d70, ftLastWriteTime.dwHighDateTime=0x1d56fbd, nFileSizeHigh=0x0, nFileSizeLow=0xa3b3, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="y693.docx", cAlternateFileName="Y693~1.DOC")) returned 1 [0226.701] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\y693.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\y693.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0226.701] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\y693.docx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\y693.docx.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0226.702] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa3b3 [0226.702] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0226.702] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0226.809] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa3b3, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0xa3b3, lpOverlapped=0x0) returned 1 [0226.810] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa3c0, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0xa3c0, lpOverlapped=0x0) returned 1 [0226.812] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0226.834] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0226.845] CloseHandle (hObject=0xd8) returned 1 [0226.845] CloseHandle (hObject=0xe4) returned 1 [0226.846] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\y693.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\y693.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\y693.docx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\y693.docx.dvodltmf")) returned 0 [0226.846] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\y693.docx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\y693.docx.dvodltmf")) returned 0x20 [0226.847] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\y693.docx", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba13b7c0, ftCreationTime.dwHighDateTime=0x1d59160, ftLastAccessTime.dwLowDateTime=0x6f316d70, ftLastAccessTime.dwHighDateTime=0x1d56fbd, ftLastWriteTime.dwLowDateTime=0x6f316d70, ftLastWriteTime.dwHighDateTime=0x1d56fbd, nFileSizeHigh=0x0, nFileSizeLow=0xa3b3, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="y693.docx", cAlternateFileName="Y693~1.DOC")) returned 0x2e8458 [0226.847] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba13b7c0, ftCreationTime.dwHighDateTime=0x1d59160, ftLastAccessTime.dwLowDateTime=0x6f316d70, ftLastAccessTime.dwHighDateTime=0x1d56fbd, ftLastWriteTime.dwLowDateTime=0x6f316d70, ftLastWriteTime.dwHighDateTime=0x1d56fbd, nFileSizeHigh=0x0, nFileSizeLow=0xa3b3, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="y693.docx", cAlternateFileName="Y693~1.DOC")) returned 0 [0226.847] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0226.847] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\y693.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\y693.docx")) returned 1 [0226.848] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\y693.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\y693.docx")) returned 0xffffffff [0226.849] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7372c670, ftCreationTime.dwHighDateTime=0x1d5b3b2, ftLastAccessTime.dwLowDateTime=0xcdc5bdb0, ftLastAccessTime.dwHighDateTime=0x1d536fa, ftLastWriteTime.dwLowDateTime=0xcdc5bdb0, ftLastWriteTime.dwHighDateTime=0x1d536fa, nFileSizeHigh=0x0, nFileSizeLow=0x1279a, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="Yrpi3Do S4R5x.xlsx", cAlternateFileName="YRPI3D~1.XLS")) returned 1 [0226.849] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Yrpi3Do S4R5x.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yrpi3do s4r5x.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0226.849] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Yrpi3Do S4R5x.xlsx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yrpi3do s4r5x.xlsx.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0226.849] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1279a [0226.850] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0226.850] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0226.939] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1279a, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x1279a, lpOverlapped=0x0) returned 1 [0226.940] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x127a0, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x127a0, lpOverlapped=0x0) returned 1 [0226.942] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0226.965] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0226.976] CloseHandle (hObject=0xe4) returned 1 [0226.976] CloseHandle (hObject=0xd8) returned 1 [0226.976] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Yrpi3Do S4R5x.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yrpi3do s4r5x.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Yrpi3Do S4R5x.xlsx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yrpi3do s4r5x.xlsx.dvodltmf")) returned 0 [0226.977] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Yrpi3Do S4R5x.xlsx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yrpi3do s4r5x.xlsx.dvodltmf")) returned 0x20 [0226.977] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Yrpi3Do S4R5x.xlsx", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7372c670, ftCreationTime.dwHighDateTime=0x1d5b3b2, ftLastAccessTime.dwLowDateTime=0xcdc5bdb0, ftLastAccessTime.dwHighDateTime=0x1d536fa, ftLastWriteTime.dwLowDateTime=0xcdc5bdb0, ftLastWriteTime.dwHighDateTime=0x1d536fa, nFileSizeHigh=0x0, nFileSizeLow=0x1279a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Yrpi3Do S4R5x.xlsx", cAlternateFileName="YRPI3D~1.XLS")) returned 0x2e8458 [0226.978] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7372c670, ftCreationTime.dwHighDateTime=0x1d5b3b2, ftLastAccessTime.dwLowDateTime=0xcdc5bdb0, ftLastAccessTime.dwHighDateTime=0x1d536fa, ftLastWriteTime.dwLowDateTime=0xcdc5bdb0, ftLastWriteTime.dwHighDateTime=0x1d536fa, nFileSizeHigh=0x0, nFileSizeLow=0x1279a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Yrpi3Do S4R5x.xlsx", cAlternateFileName="YRPI3D~1.XLS")) returned 0 [0226.978] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0226.978] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Yrpi3Do S4R5x.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yrpi3do s4r5x.xlsx")) returned 1 [0226.979] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Yrpi3Do S4R5x.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yrpi3do s4r5x.xlsx")) returned 0xffffffff [0226.979] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93629330, ftCreationTime.dwHighDateTime=0x1d5a380, ftLastAccessTime.dwLowDateTime=0xa3815440, ftLastAccessTime.dwHighDateTime=0x1d5a3f3, ftLastWriteTime.dwLowDateTime=0xa3815440, ftLastWriteTime.dwHighDateTime=0x1d5a3f3, nFileSizeHigh=0x0, nFileSizeLow=0xe37c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZMlAsg.xlsx", cAlternateFileName="ZMLASG~1.XLS")) returned 1 [0226.980] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZMlAsg.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zmlasg.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0226.980] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZMlAsg.xlsx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zmlasg.xlsx.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0226.981] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe37c [0226.981] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0226.981] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0227.070] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe37c, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0xe37c, lpOverlapped=0x0) returned 1 [0227.071] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe380, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0xe380, lpOverlapped=0x0) returned 1 [0227.073] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0227.096] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0227.107] CloseHandle (hObject=0xd8) returned 1 [0227.107] CloseHandle (hObject=0xe4) returned 1 [0227.107] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZMlAsg.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zmlasg.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZMlAsg.xlsx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zmlasg.xlsx.dvodltmf")) returned 0 [0227.108] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZMlAsg.xlsx.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zmlasg.xlsx.dvodltmf")) returned 0x20 [0227.108] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZMlAsg.xlsx", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93629330, ftCreationTime.dwHighDateTime=0x1d5a380, ftLastAccessTime.dwLowDateTime=0xa3815440, ftLastAccessTime.dwHighDateTime=0x1d5a3f3, ftLastWriteTime.dwLowDateTime=0xa3815440, ftLastWriteTime.dwHighDateTime=0x1d5a3f3, nFileSizeHigh=0x0, nFileSizeLow=0xe37c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="ZMlAsg.xlsx", cAlternateFileName="ZMLASG~1.XLS")) returned 0x2e8458 [0227.108] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93629330, ftCreationTime.dwHighDateTime=0x1d5a380, ftLastAccessTime.dwLowDateTime=0xa3815440, ftLastAccessTime.dwHighDateTime=0x1d5a3f3, ftLastWriteTime.dwLowDateTime=0xa3815440, ftLastWriteTime.dwHighDateTime=0x1d5a3f3, nFileSizeHigh=0x0, nFileSizeLow=0xe37c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="ZMlAsg.xlsx", cAlternateFileName="ZMLASG~1.XLS")) returned 0 [0227.108] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0227.109] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZMlAsg.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zmlasg.xlsx")) returned 1 [0227.110] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZMlAsg.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zmlasg.xlsx")) returned 0xffffffff [0227.110] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb82a20, ftCreationTime.dwHighDateTime=0x1d4ce3e, ftLastAccessTime.dwLowDateTime=0x3eeb8240, ftLastAccessTime.dwHighDateTime=0x1d4ce0f, ftLastWriteTime.dwLowDateTime=0x3eeb8240, ftLastWriteTime.dwHighDateTime=0x1d4ce0f, nFileSizeHigh=0x0, nFileSizeLow=0xb7e4, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="_dHmiU.odt", cAlternateFileName="")) returned 1 [0227.111] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_dHmiU.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_dhmiu.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0227.111] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_dHmiU.odt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_dhmiu.odt.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0227.111] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb7e4 [0227.112] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0227.112] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0227.201] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb7e4, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0xb7e4, lpOverlapped=0x0) returned 1 [0227.202] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb7f0, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0xb7f0, lpOverlapped=0x0) returned 1 [0227.204] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0227.226] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0227.237] CloseHandle (hObject=0xe4) returned 1 [0227.237] CloseHandle (hObject=0xd8) returned 1 [0227.237] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_dHmiU.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_dhmiu.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_dHmiU.odt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_dhmiu.odt.dvodltmf")) returned 0 [0227.238] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_dHmiU.odt.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_dhmiu.odt.dvodltmf")) returned 0x20 [0227.238] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_dHmiU.odt", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb82a20, ftCreationTime.dwHighDateTime=0x1d4ce3e, ftLastAccessTime.dwLowDateTime=0x3eeb8240, ftLastAccessTime.dwHighDateTime=0x1d4ce0f, ftLastWriteTime.dwLowDateTime=0x3eeb8240, ftLastWriteTime.dwHighDateTime=0x1d4ce0f, nFileSizeHigh=0x0, nFileSizeLow=0xb7e4, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="_dHmiU.odt", cAlternateFileName="")) returned 0x2e8458 [0227.239] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb82a20, ftCreationTime.dwHighDateTime=0x1d4ce3e, ftLastAccessTime.dwLowDateTime=0x3eeb8240, ftLastAccessTime.dwHighDateTime=0x1d4ce0f, ftLastWriteTime.dwLowDateTime=0x3eeb8240, ftLastWriteTime.dwHighDateTime=0x1d4ce0f, nFileSizeHigh=0x0, nFileSizeLow=0xb7e4, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="_dHmiU.odt", cAlternateFileName="")) returned 0 [0227.239] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0227.239] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_dHmiU.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_dhmiu.odt")) returned 1 [0227.241] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_dHmiU.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_dhmiu.odt")) returned 0xffffffff [0227.241] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb82a20, ftCreationTime.dwHighDateTime=0x1d4ce3e, ftLastAccessTime.dwLowDateTime=0x3eeb8240, ftLastAccessTime.dwHighDateTime=0x1d4ce0f, ftLastWriteTime.dwLowDateTime=0x3eeb8240, ftLastWriteTime.dwHighDateTime=0x1d4ce0f, nFileSizeHigh=0x0, nFileSizeLow=0xb7e4, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="_dHmiU.odt", cAlternateFileName="")) returned 0 [0227.241] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0227.241] FindNextFileA (in: hFindFile=0x2dab90, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x782e7835, dwReserved1=0x2e78736c, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0227.241] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0227.241] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="..", cAlternateFileName="")) returned 1 [0227.241] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0227.242] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0227.242] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0227.242] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11a [0227.242] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0227.243] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0227.330] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x11a, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x11a, lpOverlapped=0x0) returned 1 [0227.331] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x120, lpOverlapped=0x0) returned 1 [0227.332] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0227.354] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0227.371] CloseHandle (hObject=0xd8) returned 1 [0227.372] CloseHandle (hObject=0xe4) returned 1 [0227.372] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\desktop.ini.dvodltmf")) returned 0 [0227.373] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\desktop.ini.dvodltmf")) returned 0x20 [0227.373] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8458 [0227.373] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0227.373] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0227.373] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\desktop.ini")) returned 1 [0227.374] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\desktop.ini")) returned 0xffffffff [0227.374] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0227.374] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0227.374] FindNextFileA (in: hFindFile=0x2dab90, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x782e7835, dwReserved1=0x2e78736c, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0227.374] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0227.374] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="..", cAlternateFileName="")) returned 1 [0227.374] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0227.374] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0227.375] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0227.375] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x192 [0227.375] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0227.376] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0227.468] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x192, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x192, lpOverlapped=0x0) returned 1 [0227.469] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x1a0, lpOverlapped=0x0) returned 1 [0227.470] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0227.492] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0227.503] CloseHandle (hObject=0xe4) returned 1 [0227.503] CloseHandle (hObject=0xd8) returned 1 [0227.503] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\desktop.ini.dvodltmf")) returned 0 [0227.504] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\desktop.ini.dvodltmf")) returned 0x20 [0227.505] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8458 [0227.505] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0227.505] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0227.505] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\desktop.ini")) returned 1 [0227.506] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\desktop.ini")) returned 0xffffffff [0227.506] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="Links", cAlternateFileName="")) returned 1 [0227.506] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x66, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0227.506] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x66, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.506] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x66, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0227.506] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0227.507] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0227.509] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x50 [0227.509] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0227.509] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0227.597] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x50, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x50, lpOverlapped=0x0) returned 1 [0227.598] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x60, lpOverlapped=0x0) returned 1 [0227.598] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0227.621] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0227.634] CloseHandle (hObject=0xe4) returned 1 [0227.634] CloseHandle (hObject=0xec) returned 1 [0227.634] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\desktop.ini.dvodltmf")) returned 0 [0227.635] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\desktop.ini.dvodltmf")) returned 0x20 [0227.635] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8498 [0227.636] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0227.636] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0227.636] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\desktop.ini")) returned 1 [0227.636] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\desktop.ini")) returned 0xffffffff [0227.637] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd1930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Suggested Sites.url", cAlternateFileName="SUGGES~1.URL")) returned 1 [0227.637] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0227.637] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0227.637] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xec [0227.638] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0227.638] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0227.737] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xec, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0xec, lpOverlapped=0x0) returned 1 [0227.738] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0xf0, lpOverlapped=0x0) returned 1 [0227.739] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0227.762] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0227.773] CloseHandle (hObject=0xec) returned 1 [0227.773] CloseHandle (hObject=0xe4) returned 1 [0227.774] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url.dvodltmf")) returned 0 [0227.775] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url.dvodltmf")) returned 0x20 [0227.775] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd1930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Suggested Sites.url", cAlternateFileName="SUGGES~1.URL")) returned 0x2e8498 [0227.775] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd1930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Suggested Sites.url", cAlternateFileName="SUGGES~1.URL")) returned 0 [0227.775] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0227.775] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url")) returned 1 [0227.776] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url")) returned 0xffffffff [0227.776] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 1 [0227.776] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0227.776] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0227.777] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe2 [0227.777] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0227.777] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0227.866] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0xe2, lpOverlapped=0x0) returned 1 [0227.867] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0xf0, lpOverlapped=0x0) returned 1 [0227.868] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0227.890] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0227.903] CloseHandle (hObject=0xe4) returned 1 [0227.903] CloseHandle (hObject=0xec) returned 1 [0227.903] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url.dvodltmf")) returned 0 [0227.904] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url.dvodltmf")) returned 0x20 [0227.904] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 0x2e8498 [0227.905] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 0 [0227.905] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0227.905] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url")) returned 1 [0227.906] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url")) returned 0xffffffff [0227.906] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 0 [0227.906] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0227.906] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c6c61, dwReserved1=0x752e7972, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0227.906] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0227.907] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="..", cAlternateFileName="")) returned 1 [0227.908] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 1 [0227.908] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0227.908] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0227.909] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0227.909] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0227.909] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0227.996] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x85, lpOverlapped=0x0) returned 1 [0227.997] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x90, lpOverlapped=0x0) returned 1 [0227.998] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0228.021] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0228.032] CloseHandle (hObject=0xec) returned 1 [0228.032] CloseHandle (hObject=0xe4) returned 1 [0228.032] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url.dvodltmf")) returned 0 [0228.033] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url.dvodltmf")) returned 0x20 [0228.033] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 0x2e8498 [0228.033] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 0 [0228.034] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0228.034] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url")) returned 1 [0228.034] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url")) returned 0xffffffff [0228.034] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 1 [0228.035] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0228.035] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0228.036] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0228.036] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0228.036] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0228.125] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x85, lpOverlapped=0x0) returned 1 [0228.125] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x90, lpOverlapped=0x0) returned 1 [0228.126] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0228.149] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0228.160] CloseHandle (hObject=0xe4) returned 1 [0228.161] CloseHandle (hObject=0xec) returned 1 [0228.161] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url.dvodltmf")) returned 0 [0228.162] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url.dvodltmf")) returned 0x20 [0228.162] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 0x2e8498 [0228.162] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 0 [0228.162] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0228.162] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url")) returned 1 [0228.163] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url")) returned 0xffffffff [0228.163] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 1 [0228.163] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0228.163] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0228.164] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0228.164] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0228.164] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0228.254] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x85, lpOverlapped=0x0) returned 1 [0228.255] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x90, lpOverlapped=0x0) returned 1 [0228.256] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0228.279] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0228.289] CloseHandle (hObject=0xec) returned 1 [0228.290] CloseHandle (hObject=0xe4) returned 1 [0228.290] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url.dvodltmf")) returned 0 [0228.291] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url.dvodltmf")) returned 0x20 [0228.291] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 0x2e8498 [0228.291] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 0 [0228.291] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0228.291] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url")) returned 1 [0228.292] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url")) returned 0xffffffff [0228.292] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 1 [0228.292] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0228.292] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0228.293] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0228.293] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0228.293] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0228.386] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x85, lpOverlapped=0x0) returned 1 [0228.388] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x90, lpOverlapped=0x0) returned 1 [0228.389] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0228.411] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0228.422] CloseHandle (hObject=0xe4) returned 1 [0228.422] CloseHandle (hObject=0xec) returned 1 [0228.422] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url.dvodltmf")) returned 0 [0228.423] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url.dvodltmf")) returned 0x20 [0228.423] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 0x2e8498 [0228.424] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 0 [0228.424] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0228.424] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url")) returned 1 [0228.425] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url")) returned 0xffffffff [0228.425] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 1 [0228.425] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0228.426] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0228.427] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x86 [0228.427] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0228.427] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0228.517] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x86, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x86, lpOverlapped=0x0) returned 1 [0228.518] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x90, lpOverlapped=0x0) returned 1 [0228.519] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0228.541] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0228.553] CloseHandle (hObject=0xec) returned 1 [0228.553] CloseHandle (hObject=0xe4) returned 1 [0228.553] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url.dvodltmf")) returned 0 [0228.554] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url.dvodltmf")) returned 0x20 [0228.554] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 0x2e8498 [0228.554] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 0 [0228.554] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0228.554] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url")) returned 1 [0228.555] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url")) returned 0xffffffff [0228.555] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 0 [0228.555] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0228.555] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65726f74, dwReserved1=0x6c72752e, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0228.555] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0228.557] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="..", cAlternateFileName="")) returned 1 [0228.557] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 1 [0228.557] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0228.557] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0228.561] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0228.561] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0228.562] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0228.653] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x85, lpOverlapped=0x0) returned 1 [0228.654] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x90, lpOverlapped=0x0) returned 1 [0228.655] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0228.686] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0228.697] CloseHandle (hObject=0xe4) returned 1 [0228.697] CloseHandle (hObject=0xec) returned 1 [0228.698] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url.dvodltmf")) returned 0 [0228.699] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url.dvodltmf")) returned 0x20 [0228.699] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 0x2e8498 [0228.699] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 0 [0228.699] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0228.699] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url")) returned 1 [0228.700] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url")) returned 0xffffffff [0228.700] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 1 [0228.700] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0228.701] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0228.702] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0228.702] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0228.702] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0228.805] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x85, lpOverlapped=0x0) returned 1 [0228.806] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x90, lpOverlapped=0x0) returned 1 [0228.807] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0228.829] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0228.840] CloseHandle (hObject=0xec) returned 1 [0228.840] CloseHandle (hObject=0xe4) returned 1 [0228.840] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url.dvodltmf")) returned 0 [0228.841] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url.dvodltmf")) returned 0x20 [0228.841] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 0x2e8498 [0228.842] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 0 [0228.842] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0228.842] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url")) returned 1 [0228.843] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url")) returned 0xffffffff [0228.843] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 1 [0228.843] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0228.846] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0228.847] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0228.847] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0228.847] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0228.938] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x85, lpOverlapped=0x0) returned 1 [0228.939] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x90, lpOverlapped=0x0) returned 1 [0228.940] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0228.963] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0228.974] CloseHandle (hObject=0xe4) returned 1 [0228.974] CloseHandle (hObject=0xec) returned 1 [0228.974] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url.dvodltmf")) returned 0 [0228.975] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url.dvodltmf")) returned 0x20 [0228.975] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 0x2e8498 [0228.975] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 0 [0228.975] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0228.975] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url")) returned 1 [0228.976] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url")) returned 0xffffffff [0228.976] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 1 [0228.976] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0228.977] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0228.978] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0228.978] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0228.978] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0229.067] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x85, lpOverlapped=0x0) returned 1 [0229.068] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x90, lpOverlapped=0x0) returned 1 [0229.069] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0229.091] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0229.102] CloseHandle (hObject=0xec) returned 1 [0229.102] CloseHandle (hObject=0xe4) returned 1 [0229.103] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url.dvodltmf")) returned 0 [0229.104] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url.dvodltmf")) returned 0x20 [0229.104] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 0x2e8498 [0229.104] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 0 [0229.104] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0229.104] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url")) returned 1 [0229.105] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url")) returned 0xffffffff [0229.105] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="MSN.url", cAlternateFileName="")) returned 1 [0229.105] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0229.105] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0229.106] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0229.106] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0229.106] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0229.191] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x85, lpOverlapped=0x0) returned 1 [0229.192] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x90, lpOverlapped=0x0) returned 1 [0229.193] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0229.215] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0229.226] CloseHandle (hObject=0xe4) returned 1 [0229.226] CloseHandle (hObject=0xec) returned 1 [0229.226] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url.dvodltmf")) returned 0 [0229.226] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url.dvodltmf")) returned 0x20 [0229.226] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="MSN.url", cAlternateFileName="")) returned 0x2e8498 [0229.226] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="MSN.url", cAlternateFileName="")) returned 0 [0229.227] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0229.227] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url")) returned 1 [0229.227] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url")) returned 0xffffffff [0229.227] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 1 [0229.227] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0229.228] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0229.229] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0229.229] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0229.229] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0229.315] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x85, lpOverlapped=0x0) returned 1 [0229.316] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x90, lpOverlapped=0x0) returned 1 [0229.317] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0229.340] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0229.350] CloseHandle (hObject=0xec) returned 1 [0229.350] CloseHandle (hObject=0xe4) returned 1 [0229.350] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url.dvodltmf")) returned 0 [0229.351] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url.dvodltmf")) returned 0x20 [0229.351] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 0x2e8498 [0229.352] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 0 [0229.352] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0229.352] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url")) returned 1 [0229.352] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url")) returned 0xffffffff [0229.353] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 0 [0229.353] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0229.353] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c7275, dwReserved1=0x752e746e, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0229.353] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0229.354] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="..", cAlternateFileName="")) returned 1 [0229.354] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 1 [0229.354] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0229.355] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0229.356] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0229.356] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0229.356] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0229.492] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x85, lpOverlapped=0x0) returned 1 [0229.493] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x90, lpOverlapped=0x0) returned 1 [0229.494] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0229.516] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0229.526] CloseHandle (hObject=0xe4) returned 1 [0229.526] CloseHandle (hObject=0xec) returned 1 [0229.527] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url.dvodltmf")) returned 0 [0229.528] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url.dvodltmf")) returned 0x20 [0229.528] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 0x2e8498 [0229.528] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 0 [0229.528] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0229.528] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url")) returned 1 [0229.529] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url")) returned 0xffffffff [0229.529] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 1 [0229.529] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0229.530] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0229.530] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0229.531] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0229.531] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0229.620] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x85, lpOverlapped=0x0) returned 1 [0229.621] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x90, lpOverlapped=0x0) returned 1 [0229.621] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0229.645] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0229.656] CloseHandle (hObject=0xec) returned 1 [0229.656] CloseHandle (hObject=0xe4) returned 1 [0229.656] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url.dvodltmf")) returned 0 [0229.657] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url.dvodltmf")) returned 0x20 [0229.657] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 0x2e8498 [0229.657] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 0 [0229.657] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0229.658] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url")) returned 1 [0229.658] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url")) returned 0xffffffff [0229.658] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 1 [0229.658] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0229.659] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0229.659] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0229.659] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0229.660] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0229.757] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x85, lpOverlapped=0x0) returned 1 [0229.758] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x90, lpOverlapped=0x0) returned 1 [0229.759] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0229.782] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0229.793] CloseHandle (hObject=0xe4) returned 1 [0229.793] CloseHandle (hObject=0xec) returned 1 [0229.793] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url.dvodltmf")) returned 0 [0229.794] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url.dvodltmf")) returned 0x20 [0229.794] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 0x2e8498 [0229.794] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 0 [0229.794] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0229.794] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url")) returned 1 [0229.795] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url")) returned 0xffffffff [0229.795] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 1 [0229.795] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0229.797] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0229.798] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0229.798] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0229.798] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0229.885] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x85, lpOverlapped=0x0) returned 1 [0229.886] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x90, lpOverlapped=0x0) returned 1 [0229.887] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0229.909] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0229.920] CloseHandle (hObject=0xec) returned 1 [0229.920] CloseHandle (hObject=0xe4) returned 1 [0229.920] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url.dvodltmf")) returned 0 [0229.921] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url.dvodltmf")) returned 0x20 [0229.921] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 0x2e8498 [0229.921] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 0 [0229.921] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0229.921] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url")) returned 1 [0229.922] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url")) returned 0xffffffff [0229.922] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 0 [0229.923] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0229.923] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c7275, dwReserved1=0x752e746e, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0229.923] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0229.923] FindNextFileA (in: hFindFile=0x2dab90, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69736265, dwReserved1=0x2e736574, cFileName="Links", cAlternateFileName="")) returned 1 [0229.923] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70532065, dwReserved1=0x73656361, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0229.923] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70532065, dwReserved1=0x73656361, cFileName="..", cAlternateFileName="")) returned 1 [0229.923] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x70532065, dwReserved1=0x73656361, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0229.923] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0229.923] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0229.924] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x244 [0229.924] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0229.924] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0230.012] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x244, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x244, lpOverlapped=0x0) returned 1 [0230.013] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x250, lpOverlapped=0x0) returned 1 [0230.013] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0230.036] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0230.046] CloseHandle (hObject=0xd8) returned 1 [0230.046] CloseHandle (hObject=0xe4) returned 1 [0230.047] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.ini.dvodltmf")) returned 0 [0230.048] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.ini.dvodltmf")) returned 0x20 [0230.048] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8458 [0230.048] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0230.048] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0230.048] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.ini")) returned 1 [0230.049] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.ini")) returned 0xffffffff [0230.049] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0230.049] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0230.050] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0230.051] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1e6 [0230.051] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0230.051] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0230.138] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1e6, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x1e6, lpOverlapped=0x0) returned 1 [0230.139] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x1f0, lpOverlapped=0x0) returned 1 [0230.140] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0230.162] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0230.173] CloseHandle (hObject=0xe4) returned 1 [0230.173] CloseHandle (hObject=0xd8) returned 1 [0230.173] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk.dvodltmf")) returned 0 [0230.174] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk.dvodltmf")) returned 0x20 [0230.174] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Desktop.lnk", cAlternateFileName="")) returned 0x2e8458 [0230.174] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Desktop.lnk", cAlternateFileName="")) returned 0 [0230.174] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0230.174] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk")) returned 1 [0230.175] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk")) returned 0xffffffff [0230.175] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0230.175] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0230.190] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0230.190] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a1 [0230.190] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0230.191] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0230.277] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3a1, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x3a1, lpOverlapped=0x0) returned 1 [0230.278] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x3b0, lpOverlapped=0x0) returned 1 [0230.279] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0230.301] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0230.312] CloseHandle (hObject=0xd8) returned 1 [0230.313] CloseHandle (hObject=0xe4) returned 1 [0230.323] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk.dvodltmf")) returned 0 [0230.324] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk.dvodltmf")) returned 0x20 [0230.324] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 0x2e8458 [0230.325] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 0 [0230.325] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0230.325] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk")) returned 1 [0230.326] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk")) returned 0xffffffff [0230.326] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 1 [0230.326] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0230.327] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0230.327] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16b [0230.327] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0230.328] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0230.455] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x16b, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x16b, lpOverlapped=0x0) returned 1 [0230.462] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x170, lpOverlapped=0x0) returned 1 [0230.462] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0230.485] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0230.496] CloseHandle (hObject=0xe4) returned 1 [0230.496] CloseHandle (hObject=0xd8) returned 1 [0230.496] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk.dvodltmf")) returned 0 [0230.497] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk.dvodltmf")) returned 0x20 [0230.497] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0x2e8458 [0230.497] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0 [0230.497] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0230.497] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk")) returned 1 [0230.498] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk")) returned 0xffffffff [0230.498] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0 [0230.498] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0230.498] FindNextFileA (in: hFindFile=0x2dab90, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e73656b, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0230.498] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="RecentPlaces.lnk", cAlternateFileName="\x90«-")) returned 0xffffffff [0230.498] FindNextFileA (in: hFindFile=0x2dab90, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7279dea0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7279dea0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e73656b, cFileName="Music", cAlternateFileName="")) returned 1 [0230.498] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7279dea0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7279dea0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0230.498] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7279dea0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7279dea0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="..", cAlternateFileName="")) returned 1 [0230.498] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x159c270, ftCreationTime.dwHighDateTime=0x1d4c9aa, ftLastAccessTime.dwLowDateTime=0xdb258b30, ftLastAccessTime.dwHighDateTime=0x1d4d367, ftLastWriteTime.dwLowDateTime=0xdb258b30, ftLastWriteTime.dwHighDateTime=0x1d4d367, nFileSizeHigh=0x0, nFileSizeLow=0xf5b8, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="0UQmAd3N4f.wav", cAlternateFileName="0UQMAD~1.WAV")) returned 1 [0230.498] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\0UQmAd3N4f.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\0uqmad3n4f.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0230.499] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\0UQmAd3N4f.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\0uqmad3n4f.wav.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0230.499] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf5b8 [0230.499] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0230.507] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0230.612] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xf5b8, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0xf5b8, lpOverlapped=0x0) returned 1 [0230.613] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf5c0, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0xf5c0, lpOverlapped=0x0) returned 1 [0230.615] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0230.639] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0230.650] CloseHandle (hObject=0xd8) returned 1 [0230.650] CloseHandle (hObject=0xe4) returned 1 [0230.650] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\0UQmAd3N4f.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\0uqmad3n4f.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\0UQmAd3N4f.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\0uqmad3n4f.wav.dvodltmf")) returned 0 [0230.651] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\0UQmAd3N4f.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\0uqmad3n4f.wav.dvodltmf")) returned 0x20 [0230.651] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\0UQmAd3N4f.wav", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x159c270, ftCreationTime.dwHighDateTime=0x1d4c9aa, ftLastAccessTime.dwLowDateTime=0xdb258b30, ftLastAccessTime.dwHighDateTime=0x1d4d367, ftLastWriteTime.dwLowDateTime=0xdb258b30, ftLastWriteTime.dwHighDateTime=0x1d4d367, nFileSizeHigh=0x0, nFileSizeLow=0xf5b8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="0UQmAd3N4f.wav", cAlternateFileName="0UQMAD~1.WAV")) returned 0x2e8458 [0230.651] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x159c270, ftCreationTime.dwHighDateTime=0x1d4c9aa, ftLastAccessTime.dwLowDateTime=0xdb258b30, ftLastAccessTime.dwHighDateTime=0x1d4d367, ftLastWriteTime.dwLowDateTime=0xdb258b30, ftLastWriteTime.dwHighDateTime=0x1d4d367, nFileSizeHigh=0x0, nFileSizeLow=0xf5b8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="0UQmAd3N4f.wav", cAlternateFileName="0UQMAD~1.WAV")) returned 0 [0230.651] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0230.651] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\0UQmAd3N4f.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\0uqmad3n4f.wav")) returned 1 [0230.653] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\0UQmAd3N4f.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\0uqmad3n4f.wav")) returned 0xffffffff [0230.653] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c229400, ftCreationTime.dwHighDateTime=0x1d4ca3a, ftLastAccessTime.dwLowDateTime=0xc89b68e0, ftLastAccessTime.dwHighDateTime=0x1d4cde5, ftLastWriteTime.dwLowDateTime=0xc89b68e0, ftLastWriteTime.dwHighDateTime=0x1d4cde5, nFileSizeHigh=0x0, nFileSizeLow=0x1124b, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="77QQQNjonindeCmT.mp3", cAlternateFileName="77QQQN~1.MP3")) returned 1 [0230.653] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\77QQQNjonindeCmT.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\77qqqnjonindecmt.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0230.653] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\77QQQNjonindeCmT.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\77qqqnjonindecmt.mp3.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0230.653] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1124b [0230.653] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0230.654] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0230.753] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1124b, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x1124b, lpOverlapped=0x0) returned 1 [0230.755] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x11250, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x11250, lpOverlapped=0x0) returned 1 [0230.757] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0230.784] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0230.795] CloseHandle (hObject=0xe4) returned 1 [0230.795] CloseHandle (hObject=0xd8) returned 1 [0230.795] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\77QQQNjonindeCmT.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\77qqqnjonindecmt.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\77QQQNjonindeCmT.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\77qqqnjonindecmt.mp3.dvodltmf")) returned 0 [0230.809] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\77QQQNjonindeCmT.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\77qqqnjonindecmt.mp3.dvodltmf")) returned 0x20 [0230.809] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\77QQQNjonindeCmT.mp3", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c229400, ftCreationTime.dwHighDateTime=0x1d4ca3a, ftLastAccessTime.dwLowDateTime=0xc89b68e0, ftLastAccessTime.dwHighDateTime=0x1d4cde5, ftLastWriteTime.dwLowDateTime=0xc89b68e0, ftLastWriteTime.dwHighDateTime=0x1d4cde5, nFileSizeHigh=0x0, nFileSizeLow=0x1124b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="77QQQNjonindeCmT.mp3", cAlternateFileName="77QQQN~1.MP3")) returned 0x2e8458 [0230.809] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c229400, ftCreationTime.dwHighDateTime=0x1d4ca3a, ftLastAccessTime.dwLowDateTime=0xc89b68e0, ftLastAccessTime.dwHighDateTime=0x1d4cde5, ftLastWriteTime.dwLowDateTime=0xc89b68e0, ftLastWriteTime.dwHighDateTime=0x1d4cde5, nFileSizeHigh=0x0, nFileSizeLow=0x1124b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="77QQQNjonindeCmT.mp3", cAlternateFileName="77QQQN~1.MP3")) returned 0 [0230.809] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0230.810] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\77QQQNjonindeCmT.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\77qqqnjonindecmt.mp3")) returned 1 [0230.810] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\77QQQNjonindeCmT.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\77qqqnjonindecmt.mp3")) returned 0xffffffff [0230.810] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7bc21960, ftCreationTime.dwHighDateTime=0x1d4c584, ftLastAccessTime.dwLowDateTime=0xfcee73a0, ftLastAccessTime.dwHighDateTime=0x1d4ca5a, ftLastWriteTime.dwLowDateTime=0xfcee73a0, ftLastWriteTime.dwHighDateTime=0x1d4ca5a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bdV6se_Y33", cAlternateFileName="BDV6SE~1")) returned 1 [0230.810] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7bc21960, ftCreationTime.dwHighDateTime=0x1d4c584, ftLastAccessTime.dwLowDateTime=0xfcee73a0, ftLastAccessTime.dwHighDateTime=0x1d4ca5a, ftLastWriteTime.dwLowDateTime=0xfcee73a0, ftLastWriteTime.dwHighDateTime=0x1d4ca5a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0230.810] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7bc21960, ftCreationTime.dwHighDateTime=0x1d4c584, ftLastAccessTime.dwLowDateTime=0xfcee73a0, ftLastAccessTime.dwHighDateTime=0x1d4ca5a, ftLastWriteTime.dwLowDateTime=0xfcee73a0, ftLastWriteTime.dwHighDateTime=0x1d4ca5a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.810] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea282b0, ftCreationTime.dwHighDateTime=0x1d4d524, ftLastAccessTime.dwLowDateTime=0xb0d51140, ftLastAccessTime.dwHighDateTime=0x1d4d49b, ftLastWriteTime.dwLowDateTime=0xb0d51140, ftLastWriteTime.dwHighDateTime=0x1d4d49b, nFileSizeHigh=0x0, nFileSizeLow=0x4027, dwReserved0=0x70, dwReserved1=0x0, cFileName="-fj7Jl8T464FWgEdV-.mp3", cAlternateFileName="-FJ7JL~1.MP3")) returned 1 [0230.810] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\-fj7Jl8T464FWgEdV-.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\-fj7jl8t464fwgedv-.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0230.810] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\-fj7Jl8T464FWgEdV-.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\-fj7jl8t464fwgedv-.mp3.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0230.811] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4027 [0230.811] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0230.811] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0230.899] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4027, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x4027, lpOverlapped=0x0) returned 1 [0230.900] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4030, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x4030, lpOverlapped=0x0) returned 1 [0230.901] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0230.924] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0230.935] CloseHandle (hObject=0xe4) returned 1 [0230.935] CloseHandle (hObject=0xec) returned 1 [0230.935] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\-fj7Jl8T464FWgEdV-.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\-fj7jl8t464fwgedv-.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\-fj7Jl8T464FWgEdV-.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\-fj7jl8t464fwgedv-.mp3.dvodltmf")) returned 0 [0230.936] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\-fj7Jl8T464FWgEdV-.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\-fj7jl8t464fwgedv-.mp3.dvodltmf")) returned 0x20 [0230.936] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\-fj7Jl8T464FWgEdV-.mp3", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea282b0, ftCreationTime.dwHighDateTime=0x1d4d524, ftLastAccessTime.dwLowDateTime=0xb0d51140, ftLastAccessTime.dwHighDateTime=0x1d4d49b, ftLastWriteTime.dwLowDateTime=0xb0d51140, ftLastWriteTime.dwHighDateTime=0x1d4d49b, nFileSizeHigh=0x0, nFileSizeLow=0x4027, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="-fj7Jl8T464FWgEdV-.mp3", cAlternateFileName="-FJ7JL~1.MP3")) returned 0x2e8498 [0230.937] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea282b0, ftCreationTime.dwHighDateTime=0x1d4d524, ftLastAccessTime.dwLowDateTime=0xb0d51140, ftLastAccessTime.dwHighDateTime=0x1d4d49b, ftLastWriteTime.dwLowDateTime=0xb0d51140, ftLastWriteTime.dwHighDateTime=0x1d4d49b, nFileSizeHigh=0x0, nFileSizeLow=0x4027, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="-fj7Jl8T464FWgEdV-.mp3", cAlternateFileName="-FJ7JL~1.MP3")) returned 0 [0230.937] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0230.937] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\-fj7Jl8T464FWgEdV-.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\-fj7jl8t464fwgedv-.mp3")) returned 1 [0230.938] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\-fj7Jl8T464FWgEdV-.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\-fj7jl8t464fwgedv-.mp3")) returned 0xffffffff [0230.938] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb904fa40, ftCreationTime.dwHighDateTime=0x1d4cee9, ftLastAccessTime.dwLowDateTime=0x79149d0, ftLastAccessTime.dwHighDateTime=0x1d4ca7a, ftLastWriteTime.dwLowDateTime=0x79149d0, ftLastWriteTime.dwHighDateTime=0x1d4ca7a, nFileSizeHigh=0x0, nFileSizeLow=0xfbf5, dwReserved0=0x0, dwReserved1=0x0, cFileName="3wOdrenoXct8hF5FMsgb.m4a", cAlternateFileName="3WODRE~1.M4A")) returned 1 [0230.938] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\3wOdrenoXct8hF5FMsgb.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\3wodrenoxct8hf5fmsgb.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0230.938] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\3wOdrenoXct8hF5FMsgb.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\3wodrenoxct8hf5fmsgb.m4a.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0230.938] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfbf5 [0230.939] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0230.939] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0231.039] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xfbf5, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0xfbf5, lpOverlapped=0x0) returned 1 [0231.040] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xfc00, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0xfc00, lpOverlapped=0x0) returned 1 [0231.042] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0231.065] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0231.076] CloseHandle (hObject=0xec) returned 1 [0231.076] CloseHandle (hObject=0xe4) returned 1 [0231.076] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\3wOdrenoXct8hF5FMsgb.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\3wodrenoxct8hf5fmsgb.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\3wOdrenoXct8hF5FMsgb.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\3wodrenoxct8hf5fmsgb.m4a.dvodltmf")) returned 0 [0231.077] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\3wOdrenoXct8hF5FMsgb.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\3wodrenoxct8hf5fmsgb.m4a.dvodltmf")) returned 0x20 [0231.077] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\3wOdrenoXct8hF5FMsgb.m4a", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb904fa40, ftCreationTime.dwHighDateTime=0x1d4cee9, ftLastAccessTime.dwLowDateTime=0x79149d0, ftLastAccessTime.dwHighDateTime=0x1d4ca7a, ftLastWriteTime.dwLowDateTime=0x79149d0, ftLastWriteTime.dwHighDateTime=0x1d4ca7a, nFileSizeHigh=0x0, nFileSizeLow=0xfbf5, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="3wOdrenoXct8hF5FMsgb.m4a", cAlternateFileName="3WODRE~1.M4A")) returned 0x2e8498 [0231.078] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb904fa40, ftCreationTime.dwHighDateTime=0x1d4cee9, ftLastAccessTime.dwLowDateTime=0x79149d0, ftLastAccessTime.dwHighDateTime=0x1d4ca7a, ftLastWriteTime.dwLowDateTime=0x79149d0, ftLastWriteTime.dwHighDateTime=0x1d4ca7a, nFileSizeHigh=0x0, nFileSizeLow=0xfbf5, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="3wOdrenoXct8hF5FMsgb.m4a", cAlternateFileName="3WODRE~1.M4A")) returned 0 [0231.078] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0231.078] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\3wOdrenoXct8hF5FMsgb.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\3wodrenoxct8hf5fmsgb.m4a")) returned 1 [0231.079] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\3wOdrenoXct8hF5FMsgb.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\3wodrenoxct8hf5fmsgb.m4a")) returned 0xffffffff [0231.079] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f36d080, ftCreationTime.dwHighDateTime=0x1d4cd2e, ftLastAccessTime.dwLowDateTime=0xbac46360, ftLastAccessTime.dwHighDateTime=0x1d4d2a0, ftLastWriteTime.dwLowDateTime=0xbac46360, ftLastWriteTime.dwHighDateTime=0x1d4d2a0, nFileSizeHigh=0x0, nFileSizeLow=0x7961, dwReserved0=0x0, dwReserved1=0x0, cFileName="CNHdD4W -XPD.m4a", cAlternateFileName="CNHDD4~1.M4A")) returned 1 [0231.079] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\CNHdD4W -XPD.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\cnhdd4w -xpd.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0231.079] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\CNHdD4W -XPD.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\cnhdd4w -xpd.m4a.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0231.080] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7961 [0231.080] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0231.080] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0231.169] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x7961, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x7961, lpOverlapped=0x0) returned 1 [0231.170] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x7970, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x7970, lpOverlapped=0x0) returned 1 [0231.172] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0231.195] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0231.206] CloseHandle (hObject=0xe4) returned 1 [0231.206] CloseHandle (hObject=0xec) returned 1 [0231.206] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\CNHdD4W -XPD.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\cnhdd4w -xpd.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\CNHdD4W -XPD.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\cnhdd4w -xpd.m4a.dvodltmf")) returned 0 [0231.207] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\CNHdD4W -XPD.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\cnhdd4w -xpd.m4a.dvodltmf")) returned 0x20 [0231.207] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\CNHdD4W -XPD.m4a", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f36d080, ftCreationTime.dwHighDateTime=0x1d4cd2e, ftLastAccessTime.dwLowDateTime=0xbac46360, ftLastAccessTime.dwHighDateTime=0x1d4d2a0, ftLastWriteTime.dwLowDateTime=0xbac46360, ftLastWriteTime.dwHighDateTime=0x1d4d2a0, nFileSizeHigh=0x0, nFileSizeLow=0x7961, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="CNHdD4W -XPD.m4a", cAlternateFileName="CNHDD4~1.M4A")) returned 0x2e8498 [0231.207] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f36d080, ftCreationTime.dwHighDateTime=0x1d4cd2e, ftLastAccessTime.dwLowDateTime=0xbac46360, ftLastAccessTime.dwHighDateTime=0x1d4d2a0, ftLastWriteTime.dwLowDateTime=0xbac46360, ftLastWriteTime.dwHighDateTime=0x1d4d2a0, nFileSizeHigh=0x0, nFileSizeLow=0x7961, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="CNHdD4W -XPD.m4a", cAlternateFileName="CNHDD4~1.M4A")) returned 0 [0231.207] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0231.208] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\CNHdD4W -XPD.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\cnhdd4w -xpd.m4a")) returned 1 [0231.209] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\CNHdD4W -XPD.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\cnhdd4w -xpd.m4a")) returned 0xffffffff [0231.209] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e407150, ftCreationTime.dwHighDateTime=0x1d4cade, ftLastAccessTime.dwLowDateTime=0x3a454680, ftLastAccessTime.dwHighDateTime=0x1d4c56e, ftLastWriteTime.dwLowDateTime=0x3a454680, ftLastWriteTime.dwHighDateTime=0x1d4c56e, nFileSizeHigh=0x0, nFileSizeLow=0x13189, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="mlckjdme-rb9NZUDr1tu.m4a", cAlternateFileName="MLCKJD~1.M4A")) returned 1 [0231.209] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\mlckjdme-rb9NZUDr1tu.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\mlckjdme-rb9nzudr1tu.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0231.209] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\mlckjdme-rb9NZUDr1tu.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\mlckjdme-rb9nzudr1tu.m4a.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0231.210] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13189 [0231.210] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0231.210] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0231.299] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x13189, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x13189, lpOverlapped=0x0) returned 1 [0231.300] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x13190, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x13190, lpOverlapped=0x0) returned 1 [0231.303] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0231.325] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0231.337] CloseHandle (hObject=0xec) returned 1 [0231.337] CloseHandle (hObject=0xe4) returned 1 [0231.337] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\mlckjdme-rb9NZUDr1tu.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\mlckjdme-rb9nzudr1tu.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\mlckjdme-rb9NZUDr1tu.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\mlckjdme-rb9nzudr1tu.m4a.dvodltmf")) returned 0 [0231.338] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\mlckjdme-rb9NZUDr1tu.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\mlckjdme-rb9nzudr1tu.m4a.dvodltmf")) returned 0x20 [0231.338] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\mlckjdme-rb9NZUDr1tu.m4a", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e407150, ftCreationTime.dwHighDateTime=0x1d4cade, ftLastAccessTime.dwLowDateTime=0x3a454680, ftLastAccessTime.dwHighDateTime=0x1d4c56e, ftLastWriteTime.dwLowDateTime=0x3a454680, ftLastWriteTime.dwHighDateTime=0x1d4c56e, nFileSizeHigh=0x0, nFileSizeLow=0x13189, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="mlckjdme-rb9NZUDr1tu.m4a", cAlternateFileName="MLCKJD~1.M4A")) returned 0x2e8498 [0231.338] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e407150, ftCreationTime.dwHighDateTime=0x1d4cade, ftLastAccessTime.dwLowDateTime=0x3a454680, ftLastAccessTime.dwHighDateTime=0x1d4c56e, ftLastWriteTime.dwLowDateTime=0x3a454680, ftLastWriteTime.dwHighDateTime=0x1d4c56e, nFileSizeHigh=0x0, nFileSizeLow=0x13189, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="mlckjdme-rb9NZUDr1tu.m4a", cAlternateFileName="MLCKJD~1.M4A")) returned 0 [0231.338] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0231.339] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\mlckjdme-rb9NZUDr1tu.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\mlckjdme-rb9nzudr1tu.m4a")) returned 1 [0231.340] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\mlckjdme-rb9NZUDr1tu.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\mlckjdme-rb9nzudr1tu.m4a")) returned 0xffffffff [0231.340] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88636d20, ftCreationTime.dwHighDateTime=0x1d4c5ef, ftLastAccessTime.dwLowDateTime=0x6c3b62c0, ftLastAccessTime.dwHighDateTime=0x1d4c6f7, ftLastWriteTime.dwLowDateTime=0x6c3b62c0, ftLastWriteTime.dwHighDateTime=0x1d4c6f7, nFileSizeHigh=0x0, nFileSizeLow=0x448f, dwReserved0=0x0, dwReserved1=0x0, cFileName="W5F4.wav", cAlternateFileName="")) returned 1 [0231.340] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\W5F4.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\w5f4.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0231.340] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\W5F4.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\w5f4.wav.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0231.341] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x448f [0231.341] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0231.341] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0231.426] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x448f, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x448f, lpOverlapped=0x0) returned 1 [0231.427] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4490, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x4490, lpOverlapped=0x0) returned 1 [0231.428] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0231.450] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0231.461] CloseHandle (hObject=0xe4) returned 1 [0231.461] CloseHandle (hObject=0xec) returned 1 [0231.461] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\W5F4.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\w5f4.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\W5F4.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\w5f4.wav.dvodltmf")) returned 0 [0231.462] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\W5F4.wav.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\w5f4.wav.dvodltmf")) returned 0x20 [0231.462] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\W5F4.wav", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88636d20, ftCreationTime.dwHighDateTime=0x1d4c5ef, ftLastAccessTime.dwLowDateTime=0x6c3b62c0, ftLastAccessTime.dwHighDateTime=0x1d4c6f7, ftLastWriteTime.dwLowDateTime=0x6c3b62c0, ftLastWriteTime.dwHighDateTime=0x1d4c6f7, nFileSizeHigh=0x0, nFileSizeLow=0x448f, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="W5F4.wav", cAlternateFileName="")) returned 0x2e8498 [0231.463] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88636d20, ftCreationTime.dwHighDateTime=0x1d4c5ef, ftLastAccessTime.dwLowDateTime=0x6c3b62c0, ftLastAccessTime.dwHighDateTime=0x1d4c6f7, ftLastWriteTime.dwLowDateTime=0x6c3b62c0, ftLastWriteTime.dwHighDateTime=0x1d4c6f7, nFileSizeHigh=0x0, nFileSizeLow=0x448f, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="W5F4.wav", cAlternateFileName="")) returned 0 [0231.463] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0231.463] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\W5F4.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\w5f4.wav")) returned 1 [0231.464] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\W5F4.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\w5f4.wav")) returned 0xffffffff [0231.464] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5c4ea70, ftCreationTime.dwHighDateTime=0x1d4cc9f, ftLastAccessTime.dwLowDateTime=0xcbe20380, ftLastAccessTime.dwHighDateTime=0x1d4d176, ftLastWriteTime.dwLowDateTime=0xcbe20380, ftLastWriteTime.dwHighDateTime=0x1d4d176, nFileSizeHigh=0x0, nFileSizeLow=0x7e82, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="w5Nl8sbN1oF.m4a", cAlternateFileName="W5NL8S~1.M4A")) returned 1 [0231.464] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\w5Nl8sbN1oF.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\w5nl8sbn1of.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0231.464] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\w5Nl8sbN1oF.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\w5nl8sbn1of.m4a.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0231.465] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7e82 [0231.465] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0231.465] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0231.567] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x7e82, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x7e82, lpOverlapped=0x0) returned 1 [0231.568] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x7e90, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x7e90, lpOverlapped=0x0) returned 1 [0231.570] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0231.594] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0231.605] CloseHandle (hObject=0xec) returned 1 [0231.605] CloseHandle (hObject=0xe4) returned 1 [0231.605] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\w5Nl8sbN1oF.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\w5nl8sbn1of.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\w5Nl8sbN1oF.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\w5nl8sbn1of.m4a.dvodltmf")) returned 0 [0231.606] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\w5Nl8sbN1oF.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\w5nl8sbn1of.m4a.dvodltmf")) returned 0x20 [0231.606] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\w5Nl8sbN1oF.m4a", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5c4ea70, ftCreationTime.dwHighDateTime=0x1d4cc9f, ftLastAccessTime.dwLowDateTime=0xcbe20380, ftLastAccessTime.dwHighDateTime=0x1d4d176, ftLastWriteTime.dwLowDateTime=0xcbe20380, ftLastWriteTime.dwHighDateTime=0x1d4d176, nFileSizeHigh=0x0, nFileSizeLow=0x7e82, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="w5Nl8sbN1oF.m4a", cAlternateFileName="W5NL8S~1.M4A")) returned 0x2e8498 [0231.607] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5c4ea70, ftCreationTime.dwHighDateTime=0x1d4cc9f, ftLastAccessTime.dwLowDateTime=0xcbe20380, ftLastAccessTime.dwHighDateTime=0x1d4d176, ftLastWriteTime.dwLowDateTime=0xcbe20380, ftLastWriteTime.dwHighDateTime=0x1d4d176, nFileSizeHigh=0x0, nFileSizeLow=0x7e82, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="w5Nl8sbN1oF.m4a", cAlternateFileName="W5NL8S~1.M4A")) returned 0 [0231.607] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0231.607] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\w5Nl8sbN1oF.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\w5nl8sbn1of.m4a")) returned 1 [0231.608] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\w5Nl8sbN1oF.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\w5nl8sbn1of.m4a")) returned 0xffffffff [0231.608] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf714a6d0, ftCreationTime.dwHighDateTime=0x1d4d576, ftLastAccessTime.dwLowDateTime=0xb5ccac70, ftLastAccessTime.dwHighDateTime=0x1d4d177, ftLastWriteTime.dwLowDateTime=0xb5ccac70, ftLastWriteTime.dwHighDateTime=0x1d4d177, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="XqCuxh", cAlternateFileName="")) returned 1 [0231.608] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf714a6d0, ftCreationTime.dwHighDateTime=0x1d4d576, ftLastAccessTime.dwLowDateTime=0xb5ccac70, ftLastAccessTime.dwHighDateTime=0x1d4d177, ftLastWriteTime.dwLowDateTime=0xb5ccac70, ftLastWriteTime.dwHighDateTime=0x1d4d177, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0231.608] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf714a6d0, ftCreationTime.dwHighDateTime=0x1d4d576, ftLastAccessTime.dwLowDateTime=0xb5ccac70, ftLastAccessTime.dwHighDateTime=0x1d4d177, ftLastWriteTime.dwLowDateTime=0xb5ccac70, ftLastWriteTime.dwHighDateTime=0x1d4d177, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.609] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17451550, ftCreationTime.dwHighDateTime=0x1d4d196, ftLastAccessTime.dwLowDateTime=0xc5061910, ftLastAccessTime.dwHighDateTime=0x1d4c6d2, ftLastWriteTime.dwLowDateTime=0xc5061910, ftLastWriteTime.dwHighDateTime=0x1d4c6d2, nFileSizeHigh=0x0, nFileSizeLow=0xc223, dwReserved0=0x7c, dwReserved1=0x0, cFileName="2lVpyyNUoq_Ot.m4a", cAlternateFileName="2LVPYY~1.M4A")) returned 1 [0231.609] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\2lVpyyNUoq_Ot.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\xqcuxh\\2lvpyynuoq_ot.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0231.609] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\2lVpyyNUoq_Ot.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\xqcuxh\\2lvpyynuoq_ot.m4a.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0231.609] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc223 [0231.610] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0231.610] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0231.699] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xc223, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0xc223, lpOverlapped=0x0) returned 1 [0231.700] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc230, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0xc230, lpOverlapped=0x0) returned 1 [0231.702] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0231.733] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0231.744] CloseHandle (hObject=0xec) returned 1 [0231.744] CloseHandle (hObject=0xe8) returned 1 [0231.744] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\2lVpyyNUoq_Ot.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\xqcuxh\\2lvpyynuoq_ot.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\2lVpyyNUoq_Ot.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\xqcuxh\\2lvpyynuoq_ot.m4a.dvodltmf")) returned 0 [0231.745] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\2lVpyyNUoq_Ot.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\xqcuxh\\2lvpyynuoq_ot.m4a.dvodltmf")) returned 0x20 [0231.745] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\2lVpyyNUoq_Ot.m4a", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17451550, ftCreationTime.dwHighDateTime=0x1d4d196, ftLastAccessTime.dwLowDateTime=0xc5061910, ftLastAccessTime.dwHighDateTime=0x1d4c6d2, ftLastWriteTime.dwLowDateTime=0xc5061910, ftLastWriteTime.dwHighDateTime=0x1d4c6d2, nFileSizeHigh=0x0, nFileSizeLow=0xc223, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="2lVpyyNUoq_Ot.m4a", cAlternateFileName="2LVPYY~1.M4A")) returned 0x2e84d8 [0231.746] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17451550, ftCreationTime.dwHighDateTime=0x1d4d196, ftLastAccessTime.dwLowDateTime=0xc5061910, ftLastAccessTime.dwHighDateTime=0x1d4c6d2, ftLastWriteTime.dwLowDateTime=0xc5061910, ftLastWriteTime.dwHighDateTime=0x1d4c6d2, nFileSizeHigh=0x0, nFileSizeLow=0xc223, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="2lVpyyNUoq_Ot.m4a", cAlternateFileName="2LVPYY~1.M4A")) returned 0 [0231.746] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0231.746] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\2lVpyyNUoq_Ot.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\xqcuxh\\2lvpyynuoq_ot.m4a")) returned 1 [0231.747] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\2lVpyyNUoq_Ot.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\xqcuxh\\2lvpyynuoq_ot.m4a")) returned 0xffffffff [0231.747] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94de7fe0, ftCreationTime.dwHighDateTime=0x1d4cc1b, ftLastAccessTime.dwLowDateTime=0x94ec77e0, ftLastAccessTime.dwHighDateTime=0x1d4d395, ftLastWriteTime.dwLowDateTime=0x94ec77e0, ftLastWriteTime.dwHighDateTime=0x1d4d395, nFileSizeHigh=0x0, nFileSizeLow=0xa9eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="N8d61tG3wDjSYq3Z9J8.mp3", cAlternateFileName="N8D61T~1.MP3")) returned 1 [0231.747] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\N8d61tG3wDjSYq3Z9J8.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\xqcuxh\\n8d61tg3wdjsyq3z9j8.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0231.747] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\N8d61tG3wDjSYq3Z9J8.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\xqcuxh\\n8d61tg3wdjsyq3z9j8.mp3.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0231.749] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa9eb [0231.749] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0231.749] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0231.837] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa9eb, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0xa9eb, lpOverlapped=0x0) returned 1 [0231.838] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa9f0, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0xa9f0, lpOverlapped=0x0) returned 1 [0231.840] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0231.863] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0231.874] CloseHandle (hObject=0xe8) returned 1 [0231.874] CloseHandle (hObject=0xec) returned 1 [0231.874] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\N8d61tG3wDjSYq3Z9J8.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\xqcuxh\\n8d61tg3wdjsyq3z9j8.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\N8d61tG3wDjSYq3Z9J8.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\xqcuxh\\n8d61tg3wdjsyq3z9j8.mp3.dvodltmf")) returned 0 [0231.875] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\N8d61tG3wDjSYq3Z9J8.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\xqcuxh\\n8d61tg3wdjsyq3z9j8.mp3.dvodltmf")) returned 0x20 [0231.875] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\N8d61tG3wDjSYq3Z9J8.mp3", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94de7fe0, ftCreationTime.dwHighDateTime=0x1d4cc1b, ftLastAccessTime.dwLowDateTime=0x94ec77e0, ftLastAccessTime.dwHighDateTime=0x1d4d395, ftLastWriteTime.dwLowDateTime=0x94ec77e0, ftLastWriteTime.dwHighDateTime=0x1d4d395, nFileSizeHigh=0x0, nFileSizeLow=0xa9eb, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="N8d61tG3wDjSYq3Z9J8.mp3", cAlternateFileName="N8D61T~1.MP3")) returned 0x2e84d8 [0231.876] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94de7fe0, ftCreationTime.dwHighDateTime=0x1d4cc1b, ftLastAccessTime.dwLowDateTime=0x94ec77e0, ftLastAccessTime.dwHighDateTime=0x1d4d395, ftLastWriteTime.dwLowDateTime=0x94ec77e0, ftLastWriteTime.dwHighDateTime=0x1d4d395, nFileSizeHigh=0x0, nFileSizeLow=0xa9eb, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="N8d61tG3wDjSYq3Z9J8.mp3", cAlternateFileName="N8D61T~1.MP3")) returned 0 [0231.876] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0231.876] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\N8d61tG3wDjSYq3Z9J8.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\xqcuxh\\n8d61tg3wdjsyq3z9j8.mp3")) returned 1 [0231.877] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\N8d61tG3wDjSYq3Z9J8.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\xqcuxh\\n8d61tg3wdjsyq3z9j8.mp3")) returned 0xffffffff [0231.877] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1422d300, ftCreationTime.dwHighDateTime=0x1d4cfaf, ftLastAccessTime.dwLowDateTime=0xc28ae8b0, ftLastAccessTime.dwHighDateTime=0x1d4cb2c, ftLastWriteTime.dwLowDateTime=0xc28ae8b0, ftLastWriteTime.dwHighDateTime=0x1d4cb2c, nFileSizeHigh=0x0, nFileSizeLow=0xc6d8, dwReserved0=0x2dbbd0, dwReserved1=0x18f054, cFileName="nb2s4Do.m4a", cAlternateFileName="")) returned 1 [0231.877] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\nb2s4Do.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\xqcuxh\\nb2s4do.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0231.877] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\nb2s4Do.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\xqcuxh\\nb2s4do.m4a.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0231.878] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc6d8 [0231.878] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0231.878] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0231.967] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xc6d8, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0xc6d8, lpOverlapped=0x0) returned 1 [0231.968] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc6e0, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0xc6e0, lpOverlapped=0x0) returned 1 [0231.970] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0231.993] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.004] CloseHandle (hObject=0xec) returned 1 [0232.004] CloseHandle (hObject=0xe8) returned 1 [0232.004] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\nb2s4Do.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\xqcuxh\\nb2s4do.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\nb2s4Do.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\xqcuxh\\nb2s4do.m4a.dvodltmf")) returned 0 [0232.005] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\nb2s4Do.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\xqcuxh\\nb2s4do.m4a.dvodltmf")) returned 0x20 [0232.005] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\nb2s4Do.m4a", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1422d300, ftCreationTime.dwHighDateTime=0x1d4cfaf, ftLastAccessTime.dwLowDateTime=0xc28ae8b0, ftLastAccessTime.dwHighDateTime=0x1d4cb2c, ftLastWriteTime.dwLowDateTime=0xc28ae8b0, ftLastWriteTime.dwHighDateTime=0x1d4cb2c, nFileSizeHigh=0x0, nFileSizeLow=0xc6d8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="nb2s4Do.m4a", cAlternateFileName="")) returned 0x2e84d8 [0232.005] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1422d300, ftCreationTime.dwHighDateTime=0x1d4cfaf, ftLastAccessTime.dwLowDateTime=0xc28ae8b0, ftLastAccessTime.dwHighDateTime=0x1d4cb2c, ftLastWriteTime.dwLowDateTime=0xc28ae8b0, ftLastWriteTime.dwHighDateTime=0x1d4cb2c, nFileSizeHigh=0x0, nFileSizeLow=0xc6d8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="nb2s4Do.m4a", cAlternateFileName="")) returned 0 [0232.005] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0232.005] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\nb2s4Do.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\xqcuxh\\nb2s4do.m4a")) returned 1 [0232.006] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\nb2s4Do.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\xqcuxh\\nb2s4do.m4a")) returned 0xffffffff [0232.006] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x331d7a90, ftCreationTime.dwHighDateTime=0x1d4d427, ftLastAccessTime.dwLowDateTime=0xb36bcfe0, ftLastAccessTime.dwHighDateTime=0x1d4c580, ftLastWriteTime.dwLowDateTime=0xb36bcfe0, ftLastWriteTime.dwHighDateTime=0x1d4c580, nFileSizeHigh=0x0, nFileSizeLow=0x1da4, dwReserved0=0x2dbbd0, dwReserved1=0x18f054, cFileName="R4kKqhxMZhwCr.mp3", cAlternateFileName="R4KKQH~1.MP3")) returned 1 [0232.007] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\R4kKqhxMZhwCr.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\xqcuxh\\r4kkqhxmzhwcr.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0232.007] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\R4kKqhxMZhwCr.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\xqcuxh\\r4kkqhxmzhwcr.mp3.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0232.007] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1da4 [0232.007] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0232.008] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0232.096] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1da4, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x1da4, lpOverlapped=0x0) returned 1 [0232.097] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1db0, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x1db0, lpOverlapped=0x0) returned 1 [0232.098] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0232.126] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.137] CloseHandle (hObject=0xe8) returned 1 [0232.137] CloseHandle (hObject=0xec) returned 1 [0232.137] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\R4kKqhxMZhwCr.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\xqcuxh\\r4kkqhxmzhwcr.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\R4kKqhxMZhwCr.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\xqcuxh\\r4kkqhxmzhwcr.mp3.dvodltmf")) returned 0 [0232.138] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\R4kKqhxMZhwCr.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\xqcuxh\\r4kkqhxmzhwcr.mp3.dvodltmf")) returned 0x20 [0232.138] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\R4kKqhxMZhwCr.mp3", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x331d7a90, ftCreationTime.dwHighDateTime=0x1d4d427, ftLastAccessTime.dwLowDateTime=0xb36bcfe0, ftLastAccessTime.dwHighDateTime=0x1d4c580, ftLastWriteTime.dwLowDateTime=0xb36bcfe0, ftLastWriteTime.dwHighDateTime=0x1d4c580, nFileSizeHigh=0x0, nFileSizeLow=0x1da4, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="R4kKqhxMZhwCr.mp3", cAlternateFileName="R4KKQH~1.MP3")) returned 0x2e84d8 [0232.138] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x331d7a90, ftCreationTime.dwHighDateTime=0x1d4d427, ftLastAccessTime.dwLowDateTime=0xb36bcfe0, ftLastAccessTime.dwHighDateTime=0x1d4c580, ftLastWriteTime.dwLowDateTime=0xb36bcfe0, ftLastWriteTime.dwHighDateTime=0x1d4c580, nFileSizeHigh=0x0, nFileSizeLow=0x1da4, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="R4kKqhxMZhwCr.mp3", cAlternateFileName="R4KKQH~1.MP3")) returned 0 [0232.138] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0232.138] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\R4kKqhxMZhwCr.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\xqcuxh\\r4kkqhxmzhwcr.mp3")) returned 1 [0232.139] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\R4kKqhxMZhwCr.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\xqcuxh\\r4kkqhxmzhwcr.mp3")) returned 0xffffffff [0232.140] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56de0e00, ftCreationTime.dwHighDateTime=0x1d4c7dd, ftLastAccessTime.dwLowDateTime=0xa1f31ca0, ftLastAccessTime.dwHighDateTime=0x1d4d53e, ftLastWriteTime.dwLowDateTime=0xa1f31ca0, ftLastWriteTime.dwHighDateTime=0x1d4d53e, nFileSizeHigh=0x0, nFileSizeLow=0x85d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpApsVe.m4a", cAlternateFileName="")) returned 1 [0232.140] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\SpApsVe.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\xqcuxh\\spapsve.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0232.140] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\SpApsVe.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\xqcuxh\\spapsve.m4a.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0232.140] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85d5 [0232.140] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0232.141] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0232.228] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x85d5, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x85d5, lpOverlapped=0x0) returned 1 [0232.229] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x85e0, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x85e0, lpOverlapped=0x0) returned 1 [0232.231] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0232.253] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.264] CloseHandle (hObject=0xec) returned 1 [0232.264] CloseHandle (hObject=0xe8) returned 1 [0232.264] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\SpApsVe.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\xqcuxh\\spapsve.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\SpApsVe.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\xqcuxh\\spapsve.m4a.dvodltmf")) returned 0 [0232.265] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\SpApsVe.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\xqcuxh\\spapsve.m4a.dvodltmf")) returned 0x20 [0232.265] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\SpApsVe.m4a", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56de0e00, ftCreationTime.dwHighDateTime=0x1d4c7dd, ftLastAccessTime.dwLowDateTime=0xa1f31ca0, ftLastAccessTime.dwHighDateTime=0x1d4d53e, ftLastWriteTime.dwLowDateTime=0xa1f31ca0, ftLastWriteTime.dwHighDateTime=0x1d4d53e, nFileSizeHigh=0x0, nFileSizeLow=0x85d5, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="SpApsVe.m4a", cAlternateFileName="")) returned 0x2e84d8 [0232.265] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56de0e00, ftCreationTime.dwHighDateTime=0x1d4c7dd, ftLastAccessTime.dwLowDateTime=0xa1f31ca0, ftLastAccessTime.dwHighDateTime=0x1d4d53e, ftLastWriteTime.dwLowDateTime=0xa1f31ca0, ftLastWriteTime.dwHighDateTime=0x1d4d53e, nFileSizeHigh=0x0, nFileSizeLow=0x85d5, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="SpApsVe.m4a", cAlternateFileName="")) returned 0 [0232.265] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0232.265] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\SpApsVe.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\xqcuxh\\spapsve.m4a")) returned 1 [0232.266] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bdV6se_Y33\\XqCuxh\\SpApsVe.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bdv6se_y33\\xqcuxh\\spapsve.m4a")) returned 0xffffffff [0232.266] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56de0e00, ftCreationTime.dwHighDateTime=0x1d4c7dd, ftLastAccessTime.dwLowDateTime=0xa1f31ca0, ftLastAccessTime.dwHighDateTime=0x1d4d53e, ftLastWriteTime.dwLowDateTime=0xa1f31ca0, ftLastWriteTime.dwHighDateTime=0x1d4d53e, nFileSizeHigh=0x0, nFileSizeLow=0x85d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpApsVe.m4a", cAlternateFileName="")) returned 0 [0232.266] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0232.266] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf714a6d0, ftCreationTime.dwHighDateTime=0x1d4d576, ftLastAccessTime.dwLowDateTime=0xb5ccac70, ftLastAccessTime.dwHighDateTime=0x1d4d177, ftLastWriteTime.dwLowDateTime=0xb5ccac70, ftLastWriteTime.dwHighDateTime=0x1d4d177, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="XqCuxh", cAlternateFileName="")) returned 0 [0232.266] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0232.266] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefee91b0, ftCreationTime.dwHighDateTime=0x1d4c769, ftLastAccessTime.dwLowDateTime=0xd1abb310, ftLastAccessTime.dwHighDateTime=0x1d4cfc3, ftLastWriteTime.dwLowDateTime=0xd1abb310, ftLastWriteTime.dwHighDateTime=0x1d4cfc3, nFileSizeHigh=0x0, nFileSizeLow=0x1bfd, dwReserved0=0x61346d2e, dwReserved1=0x74317244, cFileName="dDs raC C.mp3", cAlternateFileName="DDSRAC~1.MP3")) returned 1 [0232.267] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dDs raC C.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\dds rac c.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0232.267] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dDs raC C.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\dds rac c.mp3.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0232.267] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1bfd [0232.267] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0232.268] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0232.355] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1bfd, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x1bfd, lpOverlapped=0x0) returned 1 [0232.361] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x1c00, lpOverlapped=0x0) returned 1 [0232.362] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0232.385] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.396] CloseHandle (hObject=0xd8) returned 1 [0232.396] CloseHandle (hObject=0xe4) returned 1 [0232.397] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dDs raC C.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\dds rac c.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dDs raC C.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\dds rac c.mp3.dvodltmf")) returned 0 [0232.398] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dDs raC C.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\dds rac c.mp3.dvodltmf")) returned 0x20 [0232.398] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dDs raC C.mp3", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefee91b0, ftCreationTime.dwHighDateTime=0x1d4c769, ftLastAccessTime.dwLowDateTime=0xd1abb310, ftLastAccessTime.dwHighDateTime=0x1d4cfc3, ftLastWriteTime.dwLowDateTime=0xd1abb310, ftLastWriteTime.dwHighDateTime=0x1d4cfc3, nFileSizeHigh=0x0, nFileSizeLow=0x1bfd, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="dDs raC C.mp3", cAlternateFileName="DDSRAC~1.MP3")) returned 0x2e8458 [0232.398] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefee91b0, ftCreationTime.dwHighDateTime=0x1d4c769, ftLastAccessTime.dwLowDateTime=0xd1abb310, ftLastAccessTime.dwHighDateTime=0x1d4cfc3, ftLastWriteTime.dwLowDateTime=0xd1abb310, ftLastWriteTime.dwHighDateTime=0x1d4cfc3, nFileSizeHigh=0x0, nFileSizeLow=0x1bfd, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="dDs raC C.mp3", cAlternateFileName="DDSRAC~1.MP3")) returned 0 [0232.398] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0232.398] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dDs raC C.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\dds rac c.mp3")) returned 1 [0232.399] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dDs raC C.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\dds rac c.mp3")) returned 0xffffffff [0232.399] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0232.399] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0232.399] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0232.400] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f8 [0232.400] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0232.400] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0232.494] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1f8, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x1f8, lpOverlapped=0x0) returned 1 [0232.495] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x200, lpOverlapped=0x0) returned 1 [0232.496] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0232.518] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.529] CloseHandle (hObject=0xe4) returned 1 [0232.530] CloseHandle (hObject=0xd8) returned 1 [0232.530] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\desktop.ini.dvodltmf")) returned 0 [0232.531] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\desktop.ini.dvodltmf")) returned 0x20 [0232.531] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8458 [0232.531] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0232.531] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0232.531] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\desktop.ini")) returned 1 [0232.532] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\desktop.ini")) returned 0xffffffff [0232.532] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4812f6a0, ftCreationTime.dwHighDateTime=0x1d4d19d, ftLastAccessTime.dwLowDateTime=0x7e033920, ftLastAccessTime.dwHighDateTime=0x1d4c7dc, ftLastWriteTime.dwLowDateTime=0x7e033920, ftLastWriteTime.dwHighDateTime=0x1d4c7dc, nFileSizeHigh=0x0, nFileSizeLow=0x17cbc, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="GdVdR52X1k_N-bFKPEN.mp3", cAlternateFileName="GDVDR5~1.MP3")) returned 1 [0232.532] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GdVdR52X1k_N-bFKPEN.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gdvdr52x1k_n-bfkpen.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0232.532] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GdVdR52X1k_N-bFKPEN.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gdvdr52x1k_n-bfkpen.mp3.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0232.533] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17cbc [0232.533] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0232.533] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0232.621] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x17cbc, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x17cbc, lpOverlapped=0x0) returned 1 [0232.623] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x17cc0, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x17cc0, lpOverlapped=0x0) returned 1 [0232.627] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0232.649] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.660] CloseHandle (hObject=0xd8) returned 1 [0232.660] CloseHandle (hObject=0xe4) returned 1 [0232.661] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GdVdR52X1k_N-bFKPEN.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gdvdr52x1k_n-bfkpen.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GdVdR52X1k_N-bFKPEN.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gdvdr52x1k_n-bfkpen.mp3.dvodltmf")) returned 0 [0232.662] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GdVdR52X1k_N-bFKPEN.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gdvdr52x1k_n-bfkpen.mp3.dvodltmf")) returned 0x20 [0232.662] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GdVdR52X1k_N-bFKPEN.mp3", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4812f6a0, ftCreationTime.dwHighDateTime=0x1d4d19d, ftLastAccessTime.dwLowDateTime=0x7e033920, ftLastAccessTime.dwHighDateTime=0x1d4c7dc, ftLastWriteTime.dwLowDateTime=0x7e033920, ftLastWriteTime.dwHighDateTime=0x1d4c7dc, nFileSizeHigh=0x0, nFileSizeLow=0x17cbc, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="GdVdR52X1k_N-bFKPEN.mp3", cAlternateFileName="GDVDR5~1.MP3")) returned 0x2e8458 [0232.662] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4812f6a0, ftCreationTime.dwHighDateTime=0x1d4d19d, ftLastAccessTime.dwLowDateTime=0x7e033920, ftLastAccessTime.dwHighDateTime=0x1d4c7dc, ftLastWriteTime.dwLowDateTime=0x7e033920, ftLastWriteTime.dwHighDateTime=0x1d4c7dc, nFileSizeHigh=0x0, nFileSizeLow=0x17cbc, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="GdVdR52X1k_N-bFKPEN.mp3", cAlternateFileName="GDVDR5~1.MP3")) returned 0 [0232.662] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0232.662] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GdVdR52X1k_N-bFKPEN.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gdvdr52x1k_n-bfkpen.mp3")) returned 1 [0232.663] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GdVdR52X1k_N-bFKPEN.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gdvdr52x1k_n-bfkpen.mp3")) returned 0xffffffff [0232.663] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaaf7bd80, ftCreationTime.dwHighDateTime=0x1d4d27b, ftLastAccessTime.dwLowDateTime=0xea4c4160, ftLastAccessTime.dwHighDateTime=0x1d4d14d, ftLastWriteTime.dwLowDateTime=0xea4c4160, ftLastWriteTime.dwHighDateTime=0x1d4d14d, nFileSizeHigh=0x0, nFileSizeLow=0x10461, dwReserved0=0x0, dwReserved1=0x0, cFileName="J9PoN.m4a", cAlternateFileName="")) returned 1 [0232.664] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J9PoN.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j9pon.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0232.664] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J9PoN.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j9pon.m4a.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0232.664] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10461 [0232.664] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0232.665] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0232.759] ReadFile (in: hFile=0xe4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x10461, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x10461, lpOverlapped=0x0) returned 1 [0232.760] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10470, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x10470, lpOverlapped=0x0) returned 1 [0232.763] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0232.785] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.816] CloseHandle (hObject=0xe4) returned 1 [0232.816] CloseHandle (hObject=0xd8) returned 1 [0232.816] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J9PoN.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j9pon.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J9PoN.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j9pon.m4a.dvodltmf")) returned 0 [0232.817] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J9PoN.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j9pon.m4a.dvodltmf")) returned 0x20 [0232.818] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J9PoN.m4a", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaaf7bd80, ftCreationTime.dwHighDateTime=0x1d4d27b, ftLastAccessTime.dwLowDateTime=0xea4c4160, ftLastAccessTime.dwHighDateTime=0x1d4d14d, ftLastWriteTime.dwLowDateTime=0xea4c4160, ftLastWriteTime.dwHighDateTime=0x1d4d14d, nFileSizeHigh=0x0, nFileSizeLow=0x10461, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="J9PoN.m4a", cAlternateFileName="")) returned 0x2e8458 [0232.818] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaaf7bd80, ftCreationTime.dwHighDateTime=0x1d4d27b, ftLastAccessTime.dwLowDateTime=0xea4c4160, ftLastAccessTime.dwHighDateTime=0x1d4d14d, ftLastWriteTime.dwLowDateTime=0xea4c4160, ftLastWriteTime.dwHighDateTime=0x1d4d14d, nFileSizeHigh=0x0, nFileSizeLow=0x10461, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="J9PoN.m4a", cAlternateFileName="")) returned 0 [0232.818] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0232.818] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J9PoN.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j9pon.m4a")) returned 1 [0232.819] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J9PoN.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j9pon.m4a")) returned 0xffffffff [0232.819] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51d23210, ftCreationTime.dwHighDateTime=0x1d4c891, ftLastAccessTime.dwLowDateTime=0x2f51dfc0, ftLastAccessTime.dwHighDateTime=0x1d4cc28, ftLastWriteTime.dwLowDateTime=0x2f51dfc0, ftLastWriteTime.dwHighDateTime=0x1d4cc28, nFileSizeHigh=0x0, nFileSizeLow=0x9075, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="o79gD3rXA0Zp2WP.mp3", cAlternateFileName="O79GD3~1.MP3")) returned 1 [0232.819] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\o79gD3rXA0Zp2WP.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o79gd3rxa0zp2wp.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0232.819] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\o79gD3rXA0Zp2WP.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o79gd3rxa0zp2wp.mp3.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0232.820] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9075 [0232.820] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0232.820] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0232.916] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x9075, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x9075, lpOverlapped=0x0) returned 1 [0232.917] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x9080, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x9080, lpOverlapped=0x0) returned 1 [0232.918] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0232.941] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.953] CloseHandle (hObject=0xd8) returned 1 [0232.953] CloseHandle (hObject=0xe4) returned 1 [0232.953] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\o79gD3rXA0Zp2WP.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o79gd3rxa0zp2wp.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\o79gD3rXA0Zp2WP.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o79gd3rxa0zp2wp.mp3.dvodltmf")) returned 0 [0232.955] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\o79gD3rXA0Zp2WP.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o79gd3rxa0zp2wp.mp3.dvodltmf")) returned 0x20 [0232.955] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\o79gD3rXA0Zp2WP.mp3", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51d23210, ftCreationTime.dwHighDateTime=0x1d4c891, ftLastAccessTime.dwLowDateTime=0x2f51dfc0, ftLastAccessTime.dwHighDateTime=0x1d4cc28, ftLastWriteTime.dwLowDateTime=0x2f51dfc0, ftLastWriteTime.dwHighDateTime=0x1d4cc28, nFileSizeHigh=0x0, nFileSizeLow=0x9075, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="o79gD3rXA0Zp2WP.mp3", cAlternateFileName="O79GD3~1.MP3")) returned 0x2e8458 [0232.955] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51d23210, ftCreationTime.dwHighDateTime=0x1d4c891, ftLastAccessTime.dwLowDateTime=0x2f51dfc0, ftLastAccessTime.dwHighDateTime=0x1d4cc28, ftLastWriteTime.dwLowDateTime=0x2f51dfc0, ftLastWriteTime.dwHighDateTime=0x1d4cc28, nFileSizeHigh=0x0, nFileSizeLow=0x9075, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="o79gD3rXA0Zp2WP.mp3", cAlternateFileName="O79GD3~1.MP3")) returned 0 [0232.955] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0232.955] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\o79gD3rXA0Zp2WP.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o79gd3rxa0zp2wp.mp3")) returned 1 [0232.956] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\o79gD3rXA0Zp2WP.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o79gd3rxa0zp2wp.mp3")) returned 0xffffffff [0232.956] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dd793e0, ftCreationTime.dwHighDateTime=0x1d4cef0, ftLastAccessTime.dwLowDateTime=0x109f660, ftLastAccessTime.dwHighDateTime=0x1d4ce2c, ftLastWriteTime.dwLowDateTime=0x109f660, ftLastWriteTime.dwHighDateTime=0x1d4ce2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="oR7aQet32uvMvWnf", cAlternateFileName="OR7AQE~1")) returned 1 [0232.956] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dd793e0, ftCreationTime.dwHighDateTime=0x1d4cef0, ftLastAccessTime.dwLowDateTime=0x109f660, ftLastAccessTime.dwHighDateTime=0x1d4ce2c, ftLastWriteTime.dwLowDateTime=0x109f660, ftLastWriteTime.dwHighDateTime=0x1d4ce2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0232.956] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dd793e0, ftCreationTime.dwHighDateTime=0x1d4cef0, ftLastAccessTime.dwLowDateTime=0x109f660, ftLastAccessTime.dwHighDateTime=0x1d4ce2c, ftLastWriteTime.dwLowDateTime=0x109f660, ftLastWriteTime.dwHighDateTime=0x1d4ce2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.956] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x471a11d0, ftCreationTime.dwHighDateTime=0x1d4d539, ftLastAccessTime.dwLowDateTime=0xc68f7bc0, ftLastAccessTime.dwHighDateTime=0x1d4d0e4, ftLastWriteTime.dwLowDateTime=0xc68f7bc0, ftLastWriteTime.dwHighDateTime=0x1d4d0e4, nFileSizeHigh=0x0, nFileSizeLow=0x17b16, dwReserved0=0x6e, dwReserved1=0x0, cFileName="HX0sQtwAIPAK2AXv.m4a", cAlternateFileName="HX0SQT~1.M4A")) returned 1 [0232.956] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\HX0sQtwAIPAK2AXv.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\hx0sqtwaipak2axv.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0232.957] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\HX0sQtwAIPAK2AXv.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\hx0sqtwaipak2axv.m4a.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0232.957] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17b16 [0232.957] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0232.958] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0233.049] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x17b16, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x17b16, lpOverlapped=0x0) returned 1 [0233.050] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x17b20, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x17b20, lpOverlapped=0x0) returned 1 [0233.053] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0233.077] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.088] CloseHandle (hObject=0xd8) returned 1 [0233.088] CloseHandle (hObject=0xe8) returned 1 [0233.088] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\HX0sQtwAIPAK2AXv.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\hx0sqtwaipak2axv.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\HX0sQtwAIPAK2AXv.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\hx0sqtwaipak2axv.m4a.dvodltmf")) returned 0 [0233.089] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\HX0sQtwAIPAK2AXv.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\hx0sqtwaipak2axv.m4a.dvodltmf")) returned 0x20 [0233.089] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\HX0sQtwAIPAK2AXv.m4a", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x471a11d0, ftCreationTime.dwHighDateTime=0x1d4d539, ftLastAccessTime.dwLowDateTime=0xc68f7bc0, ftLastAccessTime.dwHighDateTime=0x1d4d0e4, ftLastWriteTime.dwLowDateTime=0xc68f7bc0, ftLastWriteTime.dwHighDateTime=0x1d4d0e4, nFileSizeHigh=0x0, nFileSizeLow=0x17b16, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="HX0sQtwAIPAK2AXv.m4a", cAlternateFileName="HX0SQT~1.M4A")) returned 0x2e8498 [0233.089] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x471a11d0, ftCreationTime.dwHighDateTime=0x1d4d539, ftLastAccessTime.dwLowDateTime=0xc68f7bc0, ftLastAccessTime.dwHighDateTime=0x1d4d0e4, ftLastWriteTime.dwLowDateTime=0xc68f7bc0, ftLastWriteTime.dwHighDateTime=0x1d4d0e4, nFileSizeHigh=0x0, nFileSizeLow=0x17b16, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="HX0sQtwAIPAK2AXv.m4a", cAlternateFileName="HX0SQT~1.M4A")) returned 0 [0233.089] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0233.089] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\HX0sQtwAIPAK2AXv.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\hx0sqtwaipak2axv.m4a")) returned 1 [0233.091] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\HX0sQtwAIPAK2AXv.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\hx0sqtwaipak2axv.m4a")) returned 0xffffffff [0233.091] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700ebfc0, ftCreationTime.dwHighDateTime=0x1d4d1a9, ftLastAccessTime.dwLowDateTime=0xd10aa480, ftLastAccessTime.dwHighDateTime=0x1d4ce78, ftLastWriteTime.dwLowDateTime=0xd10aa480, ftLastWriteTime.dwHighDateTime=0x1d4ce78, nFileSizeHigh=0x0, nFileSizeLow=0xf36b, dwReserved0=0x0, dwReserved1=0x0, cFileName="IT0_wiYFWP_MgOA.mp3", cAlternateFileName="IT0_WI~1.MP3")) returned 1 [0233.091] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\IT0_wiYFWP_MgOA.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\it0_wiyfwp_mgoa.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0233.091] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\IT0_wiYFWP_MgOA.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\it0_wiyfwp_mgoa.mp3.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0233.092] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf36b [0233.092] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0233.092] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0233.181] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xf36b, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0xf36b, lpOverlapped=0x0) returned 1 [0233.183] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf370, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0xf370, lpOverlapped=0x0) returned 1 [0233.185] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0233.207] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.219] CloseHandle (hObject=0xe8) returned 1 [0233.219] CloseHandle (hObject=0xd8) returned 1 [0233.219] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\IT0_wiYFWP_MgOA.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\it0_wiyfwp_mgoa.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\IT0_wiYFWP_MgOA.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\it0_wiyfwp_mgoa.mp3.dvodltmf")) returned 0 [0233.220] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\IT0_wiYFWP_MgOA.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\it0_wiyfwp_mgoa.mp3.dvodltmf")) returned 0x20 [0233.220] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\IT0_wiYFWP_MgOA.mp3", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700ebfc0, ftCreationTime.dwHighDateTime=0x1d4d1a9, ftLastAccessTime.dwLowDateTime=0xd10aa480, ftLastAccessTime.dwHighDateTime=0x1d4ce78, ftLastWriteTime.dwLowDateTime=0xd10aa480, ftLastWriteTime.dwHighDateTime=0x1d4ce78, nFileSizeHigh=0x0, nFileSizeLow=0xf36b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="IT0_wiYFWP_MgOA.mp3", cAlternateFileName="IT0_WI~1.MP3")) returned 0x2e8498 [0233.220] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700ebfc0, ftCreationTime.dwHighDateTime=0x1d4d1a9, ftLastAccessTime.dwLowDateTime=0xd10aa480, ftLastAccessTime.dwHighDateTime=0x1d4ce78, ftLastWriteTime.dwLowDateTime=0xd10aa480, ftLastWriteTime.dwHighDateTime=0x1d4ce78, nFileSizeHigh=0x0, nFileSizeLow=0xf36b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="IT0_wiYFWP_MgOA.mp3", cAlternateFileName="IT0_WI~1.MP3")) returned 0 [0233.220] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0233.221] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\IT0_wiYFWP_MgOA.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\it0_wiyfwp_mgoa.mp3")) returned 1 [0233.222] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\IT0_wiYFWP_MgOA.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\it0_wiyfwp_mgoa.mp3")) returned 0xffffffff [0233.222] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3df8be0, ftCreationTime.dwHighDateTime=0x1d4cc2d, ftLastAccessTime.dwLowDateTime=0x8df63350, ftLastAccessTime.dwHighDateTime=0x1d4cc41, ftLastWriteTime.dwLowDateTime=0x8df63350, ftLastWriteTime.dwHighDateTime=0x1d4cc41, nFileSizeHigh=0x0, nFileSizeLow=0x54dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="JIHsSR_r13c69v5MSm.mp3", cAlternateFileName="JIHSSR~1.MP3")) returned 1 [0233.222] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\JIHsSR_r13c69v5MSm.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\jihssr_r13c69v5msm.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0233.222] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\JIHsSR_r13c69v5MSm.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\jihssr_r13c69v5msm.mp3.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0233.223] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x54dc [0233.223] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0233.223] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0233.313] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x54dc, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x54dc, lpOverlapped=0x0) returned 1 [0233.315] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x54e0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x54e0, lpOverlapped=0x0) returned 1 [0233.316] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0233.338] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.350] CloseHandle (hObject=0xd8) returned 1 [0233.350] CloseHandle (hObject=0xe8) returned 1 [0233.350] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\JIHsSR_r13c69v5MSm.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\jihssr_r13c69v5msm.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\JIHsSR_r13c69v5MSm.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\jihssr_r13c69v5msm.mp3.dvodltmf")) returned 0 [0233.351] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\JIHsSR_r13c69v5MSm.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\jihssr_r13c69v5msm.mp3.dvodltmf")) returned 0x20 [0233.351] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\JIHsSR_r13c69v5MSm.mp3", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3df8be0, ftCreationTime.dwHighDateTime=0x1d4cc2d, ftLastAccessTime.dwLowDateTime=0x8df63350, ftLastAccessTime.dwHighDateTime=0x1d4cc41, ftLastWriteTime.dwLowDateTime=0x8df63350, ftLastWriteTime.dwHighDateTime=0x1d4cc41, nFileSizeHigh=0x0, nFileSizeLow=0x54dc, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="JIHsSR_r13c69v5MSm.mp3", cAlternateFileName="JIHSSR~1.MP3")) returned 0x2e8498 [0233.351] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3df8be0, ftCreationTime.dwHighDateTime=0x1d4cc2d, ftLastAccessTime.dwLowDateTime=0x8df63350, ftLastAccessTime.dwHighDateTime=0x1d4cc41, ftLastWriteTime.dwLowDateTime=0x8df63350, ftLastWriteTime.dwHighDateTime=0x1d4cc41, nFileSizeHigh=0x0, nFileSizeLow=0x54dc, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="JIHsSR_r13c69v5MSm.mp3", cAlternateFileName="JIHSSR~1.MP3")) returned 0 [0233.351] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0233.351] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\JIHsSR_r13c69v5MSm.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\jihssr_r13c69v5msm.mp3")) returned 1 [0233.352] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\JIHsSR_r13c69v5MSm.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\jihssr_r13c69v5msm.mp3")) returned 0xffffffff [0233.353] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8d6bf510, ftCreationTime.dwHighDateTime=0x1d4ca1a, ftLastAccessTime.dwLowDateTime=0x738d0300, ftLastAccessTime.dwHighDateTime=0x1d4d307, ftLastWriteTime.dwLowDateTime=0x738d0300, ftLastWriteTime.dwHighDateTime=0x1d4d307, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="M319dgKI6zB-lB", cAlternateFileName="M319DG~1")) returned 1 [0233.353] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8d6bf510, ftCreationTime.dwHighDateTime=0x1d4ca1a, ftLastAccessTime.dwLowDateTime=0x738d0300, ftLastAccessTime.dwHighDateTime=0x1d4d307, ftLastWriteTime.dwLowDateTime=0x738d0300, ftLastWriteTime.dwHighDateTime=0x1d4d307, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x96, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0233.353] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8d6bf510, ftCreationTime.dwHighDateTime=0x1d4ca1a, ftLastAccessTime.dwLowDateTime=0x738d0300, ftLastAccessTime.dwHighDateTime=0x1d4d307, ftLastWriteTime.dwLowDateTime=0x738d0300, ftLastWriteTime.dwHighDateTime=0x1d4d307, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x96, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.353] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cb2ab80, ftCreationTime.dwHighDateTime=0x1d4d263, ftLastAccessTime.dwLowDateTime=0xbd358f70, ftLastAccessTime.dwHighDateTime=0x1d4d4da, ftLastWriteTime.dwLowDateTime=0xbd358f70, ftLastWriteTime.dwHighDateTime=0x1d4d4da, nFileSizeHigh=0x0, nFileSizeLow=0x1821e, dwReserved0=0x96, dwReserved1=0x0, cFileName="9fPl723lkJuuv.mp3", cAlternateFileName="9FPL72~1.MP3")) returned 1 [0233.353] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\9fPl723lkJuuv.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\m319dgki6zb-lb\\9fpl723lkjuuv.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0233.353] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\9fPl723lkJuuv.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\m319dgki6zb-lb\\9fpl723lkjuuv.mp3.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0233.354] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1821e [0233.354] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0233.354] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0233.451] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1821e, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x1821e, lpOverlapped=0x0) returned 1 [0233.453] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x18220, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x18220, lpOverlapped=0x0) returned 1 [0233.455] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0233.478] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.489] CloseHandle (hObject=0xd8) returned 1 [0233.490] CloseHandle (hObject=0xec) returned 1 [0233.490] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\9fPl723lkJuuv.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\m319dgki6zb-lb\\9fpl723lkjuuv.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\9fPl723lkJuuv.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\m319dgki6zb-lb\\9fpl723lkjuuv.mp3.dvodltmf")) returned 0 [0233.491] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\9fPl723lkJuuv.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\m319dgki6zb-lb\\9fpl723lkjuuv.mp3.dvodltmf")) returned 0x20 [0233.491] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\9fPl723lkJuuv.mp3", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cb2ab80, ftCreationTime.dwHighDateTime=0x1d4d263, ftLastAccessTime.dwLowDateTime=0xbd358f70, ftLastAccessTime.dwHighDateTime=0x1d4d4da, ftLastWriteTime.dwLowDateTime=0xbd358f70, ftLastWriteTime.dwHighDateTime=0x1d4d4da, nFileSizeHigh=0x0, nFileSizeLow=0x1821e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="9fPl723lkJuuv.mp3", cAlternateFileName="9FPL72~1.MP3")) returned 0x2e84d8 [0233.491] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cb2ab80, ftCreationTime.dwHighDateTime=0x1d4d263, ftLastAccessTime.dwLowDateTime=0xbd358f70, ftLastAccessTime.dwHighDateTime=0x1d4d4da, ftLastWriteTime.dwLowDateTime=0xbd358f70, ftLastWriteTime.dwHighDateTime=0x1d4d4da, nFileSizeHigh=0x0, nFileSizeLow=0x1821e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="9fPl723lkJuuv.mp3", cAlternateFileName="9FPL72~1.MP3")) returned 0 [0233.491] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0233.491] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\9fPl723lkJuuv.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\m319dgki6zb-lb\\9fpl723lkjuuv.mp3")) returned 1 [0233.493] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\9fPl723lkJuuv.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\m319dgki6zb-lb\\9fpl723lkjuuv.mp3")) returned 0xffffffff [0233.493] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaccd8420, ftCreationTime.dwHighDateTime=0x1d4d319, ftLastAccessTime.dwLowDateTime=0xfe3f6990, ftLastAccessTime.dwHighDateTime=0x1d4cf7c, ftLastWriteTime.dwLowDateTime=0xfe3f6990, ftLastWriteTime.dwHighDateTime=0x1d4cf7c, nFileSizeHigh=0x0, nFileSizeLow=0x150dd, dwReserved0=0x2dbbd0, dwReserved1=0x18f054, cFileName="F_CpK5CZuuu.mp3", cAlternateFileName="F_CPK5~1.MP3")) returned 1 [0233.493] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\F_CpK5CZuuu.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\m319dgki6zb-lb\\f_cpk5czuuu.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0233.493] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\F_CpK5CZuuu.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\m319dgki6zb-lb\\f_cpk5czuuu.mp3.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0233.493] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x150dd [0233.493] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0233.494] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0233.583] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x150dd, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x150dd, lpOverlapped=0x0) returned 1 [0233.585] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x150e0, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x150e0, lpOverlapped=0x0) returned 1 [0233.587] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0233.610] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.621] CloseHandle (hObject=0xec) returned 1 [0233.621] CloseHandle (hObject=0xd8) returned 1 [0233.621] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\F_CpK5CZuuu.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\m319dgki6zb-lb\\f_cpk5czuuu.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\F_CpK5CZuuu.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\m319dgki6zb-lb\\f_cpk5czuuu.mp3.dvodltmf")) returned 0 [0233.622] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\F_CpK5CZuuu.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\m319dgki6zb-lb\\f_cpk5czuuu.mp3.dvodltmf")) returned 0x20 [0233.622] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\F_CpK5CZuuu.mp3", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaccd8420, ftCreationTime.dwHighDateTime=0x1d4d319, ftLastAccessTime.dwLowDateTime=0xfe3f6990, ftLastAccessTime.dwHighDateTime=0x1d4cf7c, ftLastWriteTime.dwLowDateTime=0xfe3f6990, ftLastWriteTime.dwHighDateTime=0x1d4cf7c, nFileSizeHigh=0x0, nFileSizeLow=0x150dd, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="F_CpK5CZuuu.mp3", cAlternateFileName="F_CPK5~1.MP3")) returned 0x2e84d8 [0233.622] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaccd8420, ftCreationTime.dwHighDateTime=0x1d4d319, ftLastAccessTime.dwLowDateTime=0xfe3f6990, ftLastAccessTime.dwHighDateTime=0x1d4cf7c, ftLastWriteTime.dwLowDateTime=0xfe3f6990, ftLastWriteTime.dwHighDateTime=0x1d4cf7c, nFileSizeHigh=0x0, nFileSizeLow=0x150dd, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="F_CpK5CZuuu.mp3", cAlternateFileName="F_CPK5~1.MP3")) returned 0 [0233.622] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0233.622] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\F_CpK5CZuuu.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\m319dgki6zb-lb\\f_cpk5czuuu.mp3")) returned 1 [0233.624] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\F_CpK5CZuuu.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\m319dgki6zb-lb\\f_cpk5czuuu.mp3")) returned 0xffffffff [0233.624] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43eb17a0, ftCreationTime.dwHighDateTime=0x1d4d4fa, ftLastAccessTime.dwLowDateTime=0xbb6c9430, ftLastAccessTime.dwHighDateTime=0x1d4ce14, ftLastWriteTime.dwLowDateTime=0xbb6c9430, ftLastWriteTime.dwHighDateTime=0x1d4ce14, nFileSizeHigh=0x0, nFileSizeLow=0x15c34, dwReserved0=0x2dbbd0, dwReserved1=0x18f054, cFileName="ix50Lko0.m4a", cAlternateFileName="")) returned 1 [0233.624] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\ix50Lko0.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\m319dgki6zb-lb\\ix50lko0.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0233.624] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\ix50Lko0.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\m319dgki6zb-lb\\ix50lko0.m4a.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0233.626] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15c34 [0233.626] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0233.626] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0233.715] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x15c34, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x15c34, lpOverlapped=0x0) returned 1 [0233.717] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x15c40, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x15c40, lpOverlapped=0x0) returned 1 [0233.719] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0233.742] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.765] CloseHandle (hObject=0xd8) returned 1 [0233.765] CloseHandle (hObject=0xec) returned 1 [0233.765] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\ix50Lko0.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\m319dgki6zb-lb\\ix50lko0.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\ix50Lko0.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\m319dgki6zb-lb\\ix50lko0.m4a.dvodltmf")) returned 0 [0233.766] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\ix50Lko0.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\m319dgki6zb-lb\\ix50lko0.m4a.dvodltmf")) returned 0x20 [0233.766] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\ix50Lko0.m4a", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43eb17a0, ftCreationTime.dwHighDateTime=0x1d4d4fa, ftLastAccessTime.dwLowDateTime=0xbb6c9430, ftLastAccessTime.dwHighDateTime=0x1d4ce14, ftLastWriteTime.dwLowDateTime=0xbb6c9430, ftLastWriteTime.dwHighDateTime=0x1d4ce14, nFileSizeHigh=0x0, nFileSizeLow=0x15c34, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ix50Lko0.m4a", cAlternateFileName="")) returned 0x2e84d8 [0233.767] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43eb17a0, ftCreationTime.dwHighDateTime=0x1d4d4fa, ftLastAccessTime.dwLowDateTime=0xbb6c9430, ftLastAccessTime.dwHighDateTime=0x1d4ce14, ftLastWriteTime.dwLowDateTime=0xbb6c9430, ftLastWriteTime.dwHighDateTime=0x1d4ce14, nFileSizeHigh=0x0, nFileSizeLow=0x15c34, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ix50Lko0.m4a", cAlternateFileName="")) returned 0 [0233.767] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0233.767] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\ix50Lko0.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\m319dgki6zb-lb\\ix50lko0.m4a")) returned 1 [0233.768] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\ix50Lko0.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\m319dgki6zb-lb\\ix50lko0.m4a")) returned 0xffffffff [0233.768] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e270dd0, ftCreationTime.dwHighDateTime=0x1d4cf7c, ftLastAccessTime.dwLowDateTime=0x570e1090, ftLastAccessTime.dwHighDateTime=0x1d4d3c3, ftLastWriteTime.dwLowDateTime=0x570e1090, ftLastWriteTime.dwHighDateTime=0x1d4d3c3, nFileSizeHigh=0x0, nFileSizeLow=0xd4d5, dwReserved0=0x2dbbd0, dwReserved1=0x18f054, cFileName="jbTRmVmW.m4a", cAlternateFileName="")) returned 1 [0233.768] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\jbTRmVmW.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\m319dgki6zb-lb\\jbtrmvmw.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0233.768] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\jbTRmVmW.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\m319dgki6zb-lb\\jbtrmvmw.m4a.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0233.772] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd4d5 [0233.772] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0233.773] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0233.862] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd4d5, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0xd4d5, lpOverlapped=0x0) returned 1 [0233.864] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd4e0, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0xd4e0, lpOverlapped=0x0) returned 1 [0233.865] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0233.888] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.899] CloseHandle (hObject=0xec) returned 1 [0233.899] CloseHandle (hObject=0xd8) returned 1 [0233.899] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\jbTRmVmW.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\m319dgki6zb-lb\\jbtrmvmw.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\jbTRmVmW.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\m319dgki6zb-lb\\jbtrmvmw.m4a.dvodltmf")) returned 0 [0233.900] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\jbTRmVmW.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\m319dgki6zb-lb\\jbtrmvmw.m4a.dvodltmf")) returned 0x20 [0233.900] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\jbTRmVmW.m4a", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e270dd0, ftCreationTime.dwHighDateTime=0x1d4cf7c, ftLastAccessTime.dwLowDateTime=0x570e1090, ftLastAccessTime.dwHighDateTime=0x1d4d3c3, ftLastWriteTime.dwLowDateTime=0x570e1090, ftLastWriteTime.dwHighDateTime=0x1d4d3c3, nFileSizeHigh=0x0, nFileSizeLow=0xd4d5, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="jbTRmVmW.m4a", cAlternateFileName="")) returned 0x2e84d8 [0233.900] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e270dd0, ftCreationTime.dwHighDateTime=0x1d4cf7c, ftLastAccessTime.dwLowDateTime=0x570e1090, ftLastAccessTime.dwHighDateTime=0x1d4d3c3, ftLastWriteTime.dwLowDateTime=0x570e1090, ftLastWriteTime.dwHighDateTime=0x1d4d3c3, nFileSizeHigh=0x0, nFileSizeLow=0xd4d5, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="jbTRmVmW.m4a", cAlternateFileName="")) returned 0 [0233.901] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0233.901] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\jbTRmVmW.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\m319dgki6zb-lb\\jbtrmvmw.m4a")) returned 1 [0233.902] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\jbTRmVmW.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\m319dgki6zb-lb\\jbtrmvmw.m4a")) returned 0xffffffff [0233.902] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61817e70, ftCreationTime.dwHighDateTime=0x1d4cf65, ftLastAccessTime.dwLowDateTime=0x15ee37e0, ftLastAccessTime.dwHighDateTime=0x1d4d196, ftLastWriteTime.dwLowDateTime=0x15ee37e0, ftLastWriteTime.dwHighDateTime=0x1d4d196, nFileSizeHigh=0x0, nFileSizeLow=0xa19e, dwReserved0=0x2dbbd0, dwReserved1=0x18f054, cFileName="lkrwlCt4.mp3", cAlternateFileName="")) returned 1 [0233.902] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\lkrwlCt4.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\m319dgki6zb-lb\\lkrwlct4.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0233.902] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\lkrwlCt4.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\m319dgki6zb-lb\\lkrwlct4.mp3.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0233.903] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa19e [0233.903] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0233.903] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0233.992] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa19e, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0xa19e, lpOverlapped=0x0) returned 1 [0233.993] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa1a0, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0xa1a0, lpOverlapped=0x0) returned 1 [0233.995] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0234.021] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0234.032] CloseHandle (hObject=0xd8) returned 1 [0234.032] CloseHandle (hObject=0xec) returned 1 [0234.032] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\lkrwlCt4.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\m319dgki6zb-lb\\lkrwlct4.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\lkrwlCt4.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\m319dgki6zb-lb\\lkrwlct4.mp3.dvodltmf")) returned 0 [0234.033] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\lkrwlCt4.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\m319dgki6zb-lb\\lkrwlct4.mp3.dvodltmf")) returned 0x20 [0234.033] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\lkrwlCt4.mp3", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61817e70, ftCreationTime.dwHighDateTime=0x1d4cf65, ftLastAccessTime.dwLowDateTime=0x15ee37e0, ftLastAccessTime.dwHighDateTime=0x1d4d196, ftLastWriteTime.dwLowDateTime=0x15ee37e0, ftLastWriteTime.dwHighDateTime=0x1d4d196, nFileSizeHigh=0x0, nFileSizeLow=0xa19e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="lkrwlCt4.mp3", cAlternateFileName="")) returned 0x2e84d8 [0234.033] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61817e70, ftCreationTime.dwHighDateTime=0x1d4cf65, ftLastAccessTime.dwLowDateTime=0x15ee37e0, ftLastAccessTime.dwHighDateTime=0x1d4d196, ftLastWriteTime.dwLowDateTime=0x15ee37e0, ftLastWriteTime.dwHighDateTime=0x1d4d196, nFileSizeHigh=0x0, nFileSizeLow=0xa19e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="lkrwlCt4.mp3", cAlternateFileName="")) returned 0 [0234.033] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0234.033] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\lkrwlCt4.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\m319dgki6zb-lb\\lkrwlct4.mp3")) returned 1 [0234.034] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\M319dgKI6zB-lB\\lkrwlCt4.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\m319dgki6zb-lb\\lkrwlct4.mp3")) returned 0xffffffff [0234.034] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61817e70, ftCreationTime.dwHighDateTime=0x1d4cf65, ftLastAccessTime.dwLowDateTime=0x15ee37e0, ftLastAccessTime.dwHighDateTime=0x1d4d196, ftLastWriteTime.dwLowDateTime=0x15ee37e0, ftLastWriteTime.dwHighDateTime=0x1d4d196, nFileSizeHigh=0x0, nFileSizeLow=0xa19e, dwReserved0=0x2dbbd0, dwReserved1=0x18f054, cFileName="lkrwlCt4.mp3", cAlternateFileName="")) returned 0 [0234.034] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0234.035] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8ffce0, ftCreationTime.dwHighDateTime=0x1d4cf8d, ftLastAccessTime.dwLowDateTime=0x5afe8700, ftLastAccessTime.dwHighDateTime=0x1d4cf15, ftLastWriteTime.dwLowDateTime=0x5afe8700, ftLastWriteTime.dwHighDateTime=0x1d4cf15, nFileSizeHigh=0x0, nFileSizeLow=0x62f1, dwReserved0=0x33706d33, dwReserved1=0x3370, cFileName="po6es0jRh K-.m4a", cAlternateFileName="PO6ES0~1.M4A")) returned 1 [0234.035] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\po6es0jRh K-.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\po6es0jrh k-.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0234.035] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\po6es0jRh K-.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\po6es0jrh k-.m4a.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0234.035] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x62f1 [0234.035] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0234.036] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0234.122] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x62f1, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x62f1, lpOverlapped=0x0) returned 1 [0234.123] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x6300, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x6300, lpOverlapped=0x0) returned 1 [0234.125] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0234.147] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0234.158] CloseHandle (hObject=0xe8) returned 1 [0234.158] CloseHandle (hObject=0xec) returned 1 [0234.158] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\po6es0jRh K-.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\po6es0jrh k-.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\po6es0jRh K-.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\po6es0jrh k-.m4a.dvodltmf")) returned 0 [0234.159] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\po6es0jRh K-.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\po6es0jrh k-.m4a.dvodltmf")) returned 0x20 [0234.159] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\po6es0jRh K-.m4a", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8ffce0, ftCreationTime.dwHighDateTime=0x1d4cf8d, ftLastAccessTime.dwLowDateTime=0x5afe8700, ftLastAccessTime.dwHighDateTime=0x1d4cf15, ftLastWriteTime.dwLowDateTime=0x5afe8700, ftLastWriteTime.dwHighDateTime=0x1d4cf15, nFileSizeHigh=0x0, nFileSizeLow=0x62f1, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="po6es0jRh K-.m4a", cAlternateFileName="PO6ES0~1.M4A")) returned 0x2e8498 [0234.159] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8ffce0, ftCreationTime.dwHighDateTime=0x1d4cf8d, ftLastAccessTime.dwLowDateTime=0x5afe8700, ftLastAccessTime.dwHighDateTime=0x1d4cf15, ftLastWriteTime.dwLowDateTime=0x5afe8700, ftLastWriteTime.dwHighDateTime=0x1d4cf15, nFileSizeHigh=0x0, nFileSizeLow=0x62f1, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="po6es0jRh K-.m4a", cAlternateFileName="PO6ES0~1.M4A")) returned 0 [0234.159] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0234.159] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\po6es0jRh K-.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\po6es0jrh k-.m4a")) returned 1 [0234.160] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\po6es0jRh K-.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\po6es0jrh k-.m4a")) returned 0xffffffff [0234.160] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe010b300, ftCreationTime.dwHighDateTime=0x1d4cdc1, ftLastAccessTime.dwLowDateTime=0xdb486930, ftLastAccessTime.dwHighDateTime=0x1d4d0b9, ftLastWriteTime.dwLowDateTime=0xdb486930, ftLastWriteTime.dwHighDateTime=0x1d4d0b9, nFileSizeHigh=0x0, nFileSizeLow=0x440, dwReserved0=0x0, dwReserved1=0x0, cFileName="U568ICNMZt.m4a", cAlternateFileName="U568IC~1.M4A")) returned 1 [0234.160] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\U568ICNMZt.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\u568icnmzt.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0234.160] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\U568ICNMZt.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\u568icnmzt.m4a.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0234.161] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x440 [0234.161] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0234.161] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0234.248] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x440, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x440, lpOverlapped=0x0) returned 1 [0234.249] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x450, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x450, lpOverlapped=0x0) returned 1 [0234.250] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0234.273] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0234.284] CloseHandle (hObject=0xec) returned 1 [0234.284] CloseHandle (hObject=0xe8) returned 1 [0234.284] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\U568ICNMZt.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\u568icnmzt.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\U568ICNMZt.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\u568icnmzt.m4a.dvodltmf")) returned 0 [0234.285] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\U568ICNMZt.m4a.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\u568icnmzt.m4a.dvodltmf")) returned 0x20 [0234.285] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\U568ICNMZt.m4a", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe010b300, ftCreationTime.dwHighDateTime=0x1d4cdc1, ftLastAccessTime.dwLowDateTime=0xdb486930, ftLastAccessTime.dwHighDateTime=0x1d4d0b9, ftLastWriteTime.dwLowDateTime=0xdb486930, ftLastWriteTime.dwHighDateTime=0x1d4d0b9, nFileSizeHigh=0x0, nFileSizeLow=0x440, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="U568ICNMZt.m4a", cAlternateFileName="U568IC~1.M4A")) returned 0x2e8498 [0234.285] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe010b300, ftCreationTime.dwHighDateTime=0x1d4cdc1, ftLastAccessTime.dwLowDateTime=0xdb486930, ftLastAccessTime.dwHighDateTime=0x1d4d0b9, ftLastWriteTime.dwLowDateTime=0xdb486930, ftLastWriteTime.dwHighDateTime=0x1d4d0b9, nFileSizeHigh=0x0, nFileSizeLow=0x440, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="U568ICNMZt.m4a", cAlternateFileName="U568IC~1.M4A")) returned 0 [0234.285] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0234.286] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\U568ICNMZt.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\u568icnmzt.m4a")) returned 1 [0234.286] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\U568ICNMZt.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\u568icnmzt.m4a")) returned 0xffffffff [0234.286] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe00ad630, ftCreationTime.dwHighDateTime=0x1d4d3cd, ftLastAccessTime.dwLowDateTime=0xfd44e890, ftLastAccessTime.dwHighDateTime=0x1d4cc3d, ftLastWriteTime.dwLowDateTime=0xfd44e890, ftLastWriteTime.dwHighDateTime=0x1d4cc3d, nFileSizeHigh=0x0, nFileSizeLow=0x1ea9, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="xHuL5.mp3", cAlternateFileName="")) returned 1 [0234.287] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\xHuL5.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\xhul5.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0234.287] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\xHuL5.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\xhul5.mp3.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0234.287] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ea9 [0234.287] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0234.288] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0234.436] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1ea9, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x1ea9, lpOverlapped=0x0) returned 1 [0234.437] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1eb0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x1eb0, lpOverlapped=0x0) returned 1 [0234.438] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0234.461] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0234.472] CloseHandle (hObject=0xe8) returned 1 [0234.472] CloseHandle (hObject=0xec) returned 1 [0234.472] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\xHuL5.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\xhul5.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\xHuL5.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\xhul5.mp3.dvodltmf")) returned 0 [0234.473] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\xHuL5.mp3.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\xhul5.mp3.dvodltmf")) returned 0x20 [0234.473] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\xHuL5.mp3", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe00ad630, ftCreationTime.dwHighDateTime=0x1d4d3cd, ftLastAccessTime.dwLowDateTime=0xfd44e890, ftLastAccessTime.dwHighDateTime=0x1d4cc3d, ftLastWriteTime.dwLowDateTime=0xfd44e890, ftLastWriteTime.dwHighDateTime=0x1d4cc3d, nFileSizeHigh=0x0, nFileSizeLow=0x1ea9, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="xHuL5.mp3", cAlternateFileName="")) returned 0x2e8498 [0234.473] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe00ad630, ftCreationTime.dwHighDateTime=0x1d4d3cd, ftLastAccessTime.dwLowDateTime=0xfd44e890, ftLastAccessTime.dwHighDateTime=0x1d4cc3d, ftLastWriteTime.dwLowDateTime=0xfd44e890, ftLastWriteTime.dwHighDateTime=0x1d4cc3d, nFileSizeHigh=0x0, nFileSizeLow=0x1ea9, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="xHuL5.mp3", cAlternateFileName="")) returned 0 [0234.473] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0234.474] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\xHuL5.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\xhul5.mp3")) returned 1 [0234.474] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oR7aQet32uvMvWnf\\xHuL5.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\or7aqet32uvmvwnf\\xhul5.mp3")) returned 0xffffffff [0234.474] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe00ad630, ftCreationTime.dwHighDateTime=0x1d4d3cd, ftLastAccessTime.dwLowDateTime=0xfd44e890, ftLastAccessTime.dwHighDateTime=0x1d4cc3d, ftLastWriteTime.dwLowDateTime=0xfd44e890, ftLastWriteTime.dwHighDateTime=0x1d4cc3d, nFileSizeHigh=0x0, nFileSizeLow=0x1ea9, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="xHuL5.mp3", cAlternateFileName="")) returned 0 [0234.474] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0234.475] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dd793e0, ftCreationTime.dwHighDateTime=0x1d4cef0, ftLastAccessTime.dwLowDateTime=0x109f660, ftLastAccessTime.dwHighDateTime=0x1d4ce2c, ftLastWriteTime.dwLowDateTime=0x109f660, ftLastWriteTime.dwHighDateTime=0x1d4ce2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="oR7aQet32uvMvWnf", cAlternateFileName="OR7AQE~1")) returned 0 [0234.475] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0234.475] FindNextFileA (in: hFindFile=0x2dab90, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x33706d66, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0234.475] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dd793e0, ftCreationTime.dwHighDateTime=0x1d4cef0, ftLastAccessTime.dwLowDateTime=0x109f660, ftLastAccessTime.dwHighDateTime=0x1d4ce2c, ftLastWriteTime.dwLowDateTime=0x109f660, ftLastWriteTime.dwHighDateTime=0x1d4ce2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="oR7aQet32uvMvWnf", cAlternateFileName="\x90«-")) returned 0xffffffff [0234.475] FindNextFileA (in: hFindFile=0x2dab90, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x33706d66, cFileName="NetHood", cAlternateFileName="")) returned 1 [0234.475] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dd793e0, ftCreationTime.dwHighDateTime=0x1d4cef0, ftLastAccessTime.dwLowDateTime=0x109f660, ftLastAccessTime.dwHighDateTime=0x1d4ce2c, ftLastWriteTime.dwLowDateTime=0x109f660, ftLastWriteTime.dwHighDateTime=0x1d4ce2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="oR7aQet32uvMvWnf", cAlternateFileName="\x90«-")) returned 0xffffffff [0234.475] FindNextFileA (in: hFindFile=0x2dab90, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c30f920, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2c30f920, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0xa0000003, dwReserved1=0x33706d66, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0234.475] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.475] CloseHandle (hObject=0xffffffff) returned 0 [0234.475] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat.dvodltmf")) returned 0 [0234.475] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat.dvodltmf")) returned 0xffffffff [0234.475] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT", lpFindFileData=0x18f67c | out: lpFindFileData=0x18f67c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c30f920, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2c30f920, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 0x2e8418 [0234.476] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f67c | out: lpFindFileData=0x18f67c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c30f920, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2c30f920, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 0 [0234.476] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0234.476] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat")) returned 0 [0234.476] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat")) returned 0x2026 [0234.476] FindNextFileA (in: hFindFile=0x2dab90, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c16ca00, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x2dbbd0, dwReserved1=0x18f78c, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0234.476] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.476] CloseHandle (hObject=0xffffffff) returned 0 [0234.476] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat.log1"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat.log1.dvodltmf")) returned 0 [0234.476] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat.log1.dvodltmf")) returned 0xffffffff [0234.476] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", lpFindFileData=0x18f67c | out: lpFindFileData=0x18f67c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c16ca00, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 0x2e8418 [0234.476] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f67c | out: lpFindFileData=0x18f67c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c16ca00, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 0 [0234.476] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0234.476] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat.log1")) returned 0 [0234.476] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat.log1")) returned 0x26 [0234.476] FindNextFileA (in: hFindFile=0x2dab90, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28f60c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f78c, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0234.477] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.477] CloseHandle (hObject=0xffffffff) returned 0 [0234.477] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat.log2"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat.log2.dvodltmf")) returned 0 [0234.477] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat.log2.dvodltmf")) returned 0xffffffff [0234.477] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", lpFindFileData=0x18f67c | out: lpFindFileData=0x18f67c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28f60c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 0x2e8418 [0234.477] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f67c | out: lpFindFileData=0x18f67c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28f60c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 0 [0234.477] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0234.477] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat.log2")) returned 0 [0234.477] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat.log2")) returned 0x26 [0234.477] FindNextFileA (in: hFindFile=0x2dab90, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x2dbbd0, dwReserved1=0x18f78c, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0234.477] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.477] CloseHandle (hObject=0xffffffff) returned 0 [0234.477] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf.dvodltmf")) returned 0 [0234.477] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf.dvodltmf")) returned 0xffffffff [0234.477] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpFindFileData=0x18f67c | out: lpFindFileData=0x18f67c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 0x2e8418 [0234.478] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f67c | out: lpFindFileData=0x18f67c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 0 [0234.478] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0234.478] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf")) returned 0 [0234.478] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf")) returned 0x26 [0234.478] FindNextFileA (in: hFindFile=0x2dab90, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x2dbbd0, dwReserved1=0x18f78c, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0234.478] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.478] CloseHandle (hObject=0xffffffff) returned 0 [0234.478] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms.dvodltmf")) returned 0 [0234.479] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms.dvodltmf")) returned 0xffffffff [0234.479] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpFindFileData=0x18f67c | out: lpFindFileData=0x18f67c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 0x2e8418 [0234.479] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f67c | out: lpFindFileData=0x18f67c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 0 [0234.479] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0234.479] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms")) returned 0 [0234.479] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms")) returned 0x26 [0234.479] FindNextFileA (in: hFindFile=0x2dab90, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x2dbbd0, dwReserved1=0x18f78c, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0234.479] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.479] CloseHandle (hObject=0xffffffff) returned 0 [0234.479] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms.dvodltmf")) returned 0 [0234.479] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms.dvodltmf")) returned 0xffffffff [0234.479] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpFindFileData=0x18f67c | out: lpFindFileData=0x18f67c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 0x2e8418 [0234.479] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f67c | out: lpFindFileData=0x18f67c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 0 [0234.479] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0234.480] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms")) returned 0 [0234.480] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms")) returned 0x26 [0234.480] FindNextFileA (in: hFindFile=0x2dab90, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cd94e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x2dbbd0, dwReserved1=0x18f78c, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0234.480] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd0 [0234.480] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0234.481] GetFileSize (in: hFile=0xd0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14 [0234.481] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0234.481] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0234.570] ReadFile (in: hFile=0xd0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x14, lpNumberOfBytesRead=0x18f780, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f780*=0x14, lpOverlapped=0x0) returned 1 [0234.574] WriteFile (in: hFile=0xe4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18f780, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f780*=0x20, lpOverlapped=0x0) returned 1 [0234.575] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0234.597] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0234.608] CloseHandle (hObject=0xd0) returned 1 [0234.608] CloseHandle (hObject=0xe4) returned 1 [0234.608] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.ini.dvodltmf")) returned 0 [0234.609] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.ini.dvodltmf")) returned 0x20 [0234.609] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini", lpFindFileData=0x18f67c | out: lpFindFileData=0x18f67c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cd94e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ntuser.ini", cAlternateFileName="")) returned 0x2e8418 [0234.609] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f67c | out: lpFindFileData=0x18f67c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cd94e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ntuser.ini", cAlternateFileName="")) returned 0 [0234.609] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0234.609] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.ini")) returned 1 [0234.610] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.ini")) returned 0xffffffff [0234.610] FindNextFileA (in: hFindFile=0x2dab90, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7291ac60, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7291ac60, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f78c, cFileName="Pictures", cAlternateFileName="")) returned 1 [0234.610] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7291ac60, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7291ac60, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0234.610] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7291ac60, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x7291ac60, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0234.610] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xced71c0, ftCreationTime.dwHighDateTime=0x1d4ccbd, ftLastAccessTime.dwLowDateTime=0x6cec4200, ftLastAccessTime.dwHighDateTime=0x1d4c690, ftLastWriteTime.dwLowDateTime=0x6cec4200, ftLastWriteTime.dwHighDateTime=0x1d4c690, nFileSizeHigh=0x0, nFileSizeLow=0x1552, dwReserved0=0x50, dwReserved1=0x0, cFileName="-kxITE2Z6YJ2-3US2zZ.png", cAlternateFileName="-KXITE~1.PNG")) returned 1 [0234.610] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-kxITE2Z6YJ2-3US2zZ.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-kxite2z6yj2-3us2zz.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd0 [0234.610] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-kxITE2Z6YJ2-3US2zZ.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-kxite2z6yj2-3us2zz.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0234.611] GetFileSize (in: hFile=0xd0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1552 [0234.611] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0234.611] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0234.699] ReadFile (in: hFile=0xd0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1552, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x1552, lpOverlapped=0x0) returned 1 [0234.699] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1560, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x1560, lpOverlapped=0x0) returned 1 [0234.700] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0234.723] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0234.734] CloseHandle (hObject=0xd0) returned 1 [0234.734] CloseHandle (hObject=0xec) returned 1 [0234.734] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-kxITE2Z6YJ2-3US2zZ.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-kxite2z6yj2-3us2zz.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-kxITE2Z6YJ2-3US2zZ.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-kxite2z6yj2-3us2zz.png.dvodltmf")) returned 0 [0234.735] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-kxITE2Z6YJ2-3US2zZ.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-kxite2z6yj2-3us2zz.png.dvodltmf")) returned 0x20 [0234.735] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-kxITE2Z6YJ2-3US2zZ.png", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xced71c0, ftCreationTime.dwHighDateTime=0x1d4ccbd, ftLastAccessTime.dwLowDateTime=0x6cec4200, ftLastAccessTime.dwHighDateTime=0x1d4c690, ftLastWriteTime.dwLowDateTime=0x6cec4200, ftLastWriteTime.dwHighDateTime=0x1d4c690, nFileSizeHigh=0x0, nFileSizeLow=0x1552, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="-kxITE2Z6YJ2-3US2zZ.png", cAlternateFileName="-KXITE~1.PNG")) returned 0x2e8458 [0234.736] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xced71c0, ftCreationTime.dwHighDateTime=0x1d4ccbd, ftLastAccessTime.dwLowDateTime=0x6cec4200, ftLastAccessTime.dwHighDateTime=0x1d4c690, ftLastWriteTime.dwLowDateTime=0x6cec4200, ftLastWriteTime.dwHighDateTime=0x1d4c690, nFileSizeHigh=0x0, nFileSizeLow=0x1552, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="-kxITE2Z6YJ2-3US2zZ.png", cAlternateFileName="-KXITE~1.PNG")) returned 0 [0234.736] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0234.736] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-kxITE2Z6YJ2-3US2zZ.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-kxite2z6yj2-3us2zz.png")) returned 1 [0234.737] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-kxITE2Z6YJ2-3US2zZ.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-kxite2z6yj2-3us2zz.png")) returned 0xffffffff [0234.737] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42281410, ftCreationTime.dwHighDateTime=0x1d4c616, ftLastAccessTime.dwLowDateTime=0xbbaa9eb0, ftLastAccessTime.dwHighDateTime=0x1d4c6ad, ftLastWriteTime.dwLowDateTime=0xbbaa9eb0, ftLastWriteTime.dwHighDateTime=0x1d4c6ad, nFileSizeHigh=0x0, nFileSizeLow=0x37fb, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="9qF34TVKBnwfFX zYWG.png", cAlternateFileName="9QF34T~1.PNG")) returned 1 [0234.737] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\9qF34TVKBnwfFX zYWG.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\9qf34tvkbnwffx zywg.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0234.737] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\9qF34TVKBnwfFX zYWG.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\9qf34tvkbnwffx zywg.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd0 [0234.738] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x37fb [0234.738] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0234.738] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0234.851] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x37fb, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x37fb, lpOverlapped=0x0) returned 1 [0234.852] WriteFile (in: hFile=0xd0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3800, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x3800, lpOverlapped=0x0) returned 1 [0234.853] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0234.876] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0234.887] CloseHandle (hObject=0xec) returned 1 [0234.887] CloseHandle (hObject=0xd0) returned 1 [0234.887] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\9qF34TVKBnwfFX zYWG.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\9qf34tvkbnwffx zywg.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\9qF34TVKBnwfFX zYWG.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\9qf34tvkbnwffx zywg.png.dvodltmf")) returned 0 [0234.888] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\9qF34TVKBnwfFX zYWG.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\9qf34tvkbnwffx zywg.png.dvodltmf")) returned 0x20 [0234.888] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\9qF34TVKBnwfFX zYWG.png", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42281410, ftCreationTime.dwHighDateTime=0x1d4c616, ftLastAccessTime.dwLowDateTime=0xbbaa9eb0, ftLastAccessTime.dwHighDateTime=0x1d4c6ad, ftLastWriteTime.dwLowDateTime=0xbbaa9eb0, ftLastWriteTime.dwHighDateTime=0x1d4c6ad, nFileSizeHigh=0x0, nFileSizeLow=0x37fb, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="9qF34TVKBnwfFX zYWG.png", cAlternateFileName="9QF34T~1.PNG")) returned 0x2e8458 [0234.889] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42281410, ftCreationTime.dwHighDateTime=0x1d4c616, ftLastAccessTime.dwLowDateTime=0xbbaa9eb0, ftLastAccessTime.dwHighDateTime=0x1d4c6ad, ftLastWriteTime.dwLowDateTime=0xbbaa9eb0, ftLastWriteTime.dwHighDateTime=0x1d4c6ad, nFileSizeHigh=0x0, nFileSizeLow=0x37fb, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="9qF34TVKBnwfFX zYWG.png", cAlternateFileName="9QF34T~1.PNG")) returned 0 [0234.889] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0234.889] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\9qF34TVKBnwfFX zYWG.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\9qf34tvkbnwffx zywg.png")) returned 1 [0234.890] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\9qF34TVKBnwfFX zYWG.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\9qf34tvkbnwffx zywg.png")) returned 0xffffffff [0234.890] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58fb0340, ftCreationTime.dwHighDateTime=0x1d4d512, ftLastAccessTime.dwLowDateTime=0x7448fe80, ftLastAccessTime.dwHighDateTime=0x1d4d1df, ftLastWriteTime.dwLowDateTime=0x7448fe80, ftLastWriteTime.dwHighDateTime=0x1d4d1df, nFileSizeHigh=0x0, nFileSizeLow=0x5585, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="d6KzL_oJsAf LyXW.png", cAlternateFileName="D6KZL_~1.PNG")) returned 1 [0234.890] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\d6KzL_oJsAf LyXW.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\d6kzl_ojsaf lyxw.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd0 [0234.890] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\d6KzL_oJsAf LyXW.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\d6kzl_ojsaf lyxw.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0234.891] GetFileSize (in: hFile=0xd0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5585 [0234.891] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0234.891] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0234.982] ReadFile (in: hFile=0xd0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x5585, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x5585, lpOverlapped=0x0) returned 1 [0234.983] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x5590, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x5590, lpOverlapped=0x0) returned 1 [0234.984] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0235.007] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0235.017] CloseHandle (hObject=0xd0) returned 1 [0235.018] CloseHandle (hObject=0xec) returned 1 [0235.018] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\d6KzL_oJsAf LyXW.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\d6kzl_ojsaf lyxw.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\d6KzL_oJsAf LyXW.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\d6kzl_ojsaf lyxw.png.dvodltmf")) returned 0 [0235.019] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\d6KzL_oJsAf LyXW.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\d6kzl_ojsaf lyxw.png.dvodltmf")) returned 0x20 [0235.019] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\d6KzL_oJsAf LyXW.png", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58fb0340, ftCreationTime.dwHighDateTime=0x1d4d512, ftLastAccessTime.dwLowDateTime=0x7448fe80, ftLastAccessTime.dwHighDateTime=0x1d4d1df, ftLastWriteTime.dwLowDateTime=0x7448fe80, ftLastWriteTime.dwHighDateTime=0x1d4d1df, nFileSizeHigh=0x0, nFileSizeLow=0x5585, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="d6KzL_oJsAf LyXW.png", cAlternateFileName="D6KZL_~1.PNG")) returned 0x2e8458 [0235.019] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58fb0340, ftCreationTime.dwHighDateTime=0x1d4d512, ftLastAccessTime.dwLowDateTime=0x7448fe80, ftLastAccessTime.dwHighDateTime=0x1d4d1df, ftLastWriteTime.dwLowDateTime=0x7448fe80, ftLastWriteTime.dwHighDateTime=0x1d4d1df, nFileSizeHigh=0x0, nFileSizeLow=0x5585, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="d6KzL_oJsAf LyXW.png", cAlternateFileName="D6KZL_~1.PNG")) returned 0 [0235.019] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0235.019] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\d6KzL_oJsAf LyXW.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\d6kzl_ojsaf lyxw.png")) returned 1 [0235.021] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\d6KzL_oJsAf LyXW.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\d6kzl_ojsaf lyxw.png")) returned 0xffffffff [0235.021] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0235.021] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0235.021] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd0 [0235.022] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f8 [0235.022] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0235.022] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0235.110] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1f8, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x1f8, lpOverlapped=0x0) returned 1 [0235.111] WriteFile (in: hFile=0xd0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x200, lpOverlapped=0x0) returned 1 [0235.112] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0235.134] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0235.145] CloseHandle (hObject=0xec) returned 1 [0235.145] CloseHandle (hObject=0xd0) returned 1 [0235.145] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\desktop.ini.dvodltmf")) returned 0 [0235.146] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\desktop.ini.dvodltmf")) returned 0x20 [0235.146] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8458 [0235.146] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0235.146] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0235.147] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\desktop.ini")) returned 1 [0235.147] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\desktop.ini")) returned 0xffffffff [0235.147] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60a41f60, ftCreationTime.dwHighDateTime=0x1d4ceb8, ftLastAccessTime.dwLowDateTime=0xfe75fa30, ftLastAccessTime.dwHighDateTime=0x1d4caab, ftLastWriteTime.dwLowDateTime=0xfe75fa30, ftLastWriteTime.dwHighDateTime=0x1d4caab, nFileSizeHigh=0x0, nFileSizeLow=0x175ab, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="EQnXcjCTHj 6N5acZk35.jpg", cAlternateFileName="EQNXCJ~1.JPG")) returned 1 [0235.148] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EQnXcjCTHj 6N5acZk35.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\eqnxcjcthj 6n5aczk35.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd0 [0235.148] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EQnXcjCTHj 6N5acZk35.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\eqnxcjcthj 6n5aczk35.jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0235.148] GetFileSize (in: hFile=0xd0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x175ab [0235.148] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0235.149] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0235.236] ReadFile (in: hFile=0xd0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x175ab, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x175ab, lpOverlapped=0x0) returned 1 [0235.238] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x175b0, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x175b0, lpOverlapped=0x0) returned 1 [0235.240] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0235.263] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0235.274] CloseHandle (hObject=0xd0) returned 1 [0235.274] CloseHandle (hObject=0xec) returned 1 [0235.274] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EQnXcjCTHj 6N5acZk35.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\eqnxcjcthj 6n5aczk35.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EQnXcjCTHj 6N5acZk35.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\eqnxcjcthj 6n5aczk35.jpg.dvodltmf")) returned 0 [0235.275] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EQnXcjCTHj 6N5acZk35.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\eqnxcjcthj 6n5aczk35.jpg.dvodltmf")) returned 0x20 [0235.275] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EQnXcjCTHj 6N5acZk35.jpg", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60a41f60, ftCreationTime.dwHighDateTime=0x1d4ceb8, ftLastAccessTime.dwLowDateTime=0xfe75fa30, ftLastAccessTime.dwHighDateTime=0x1d4caab, ftLastWriteTime.dwLowDateTime=0xfe75fa30, ftLastWriteTime.dwHighDateTime=0x1d4caab, nFileSizeHigh=0x0, nFileSizeLow=0x175ab, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="EQnXcjCTHj 6N5acZk35.jpg", cAlternateFileName="EQNXCJ~1.JPG")) returned 0x2e8458 [0235.275] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60a41f60, ftCreationTime.dwHighDateTime=0x1d4ceb8, ftLastAccessTime.dwLowDateTime=0xfe75fa30, ftLastAccessTime.dwHighDateTime=0x1d4caab, ftLastWriteTime.dwLowDateTime=0xfe75fa30, ftLastWriteTime.dwHighDateTime=0x1d4caab, nFileSizeHigh=0x0, nFileSizeLow=0x175ab, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="EQnXcjCTHj 6N5acZk35.jpg", cAlternateFileName="EQNXCJ~1.JPG")) returned 0 [0235.275] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0235.275] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EQnXcjCTHj 6N5acZk35.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\eqnxcjcthj 6n5aczk35.jpg")) returned 1 [0235.277] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EQnXcjCTHj 6N5acZk35.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\eqnxcjcthj 6n5aczk35.jpg")) returned 0xffffffff [0235.277] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a4e5a10, ftCreationTime.dwHighDateTime=0x1d4c625, ftLastAccessTime.dwLowDateTime=0x714c0830, ftLastAccessTime.dwHighDateTime=0x1d4c618, ftLastWriteTime.dwLowDateTime=0x714c0830, ftLastWriteTime.dwHighDateTime=0x1d4c618, nFileSizeHigh=0x0, nFileSizeLow=0x14206, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="pww5JHL18GeJ_4.bmp", cAlternateFileName="PWW5JH~1.BMP")) returned 1 [0235.277] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\pww5JHL18GeJ_4.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\pww5jhl18gej_4.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0235.277] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\pww5JHL18GeJ_4.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\pww5jhl18gej_4.bmp.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd0 [0235.278] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14206 [0235.278] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0235.278] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0235.366] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x14206, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x14206, lpOverlapped=0x0) returned 1 [0235.430] WriteFile (in: hFile=0xd0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x14210, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x14210, lpOverlapped=0x0) returned 1 [0235.433] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0235.455] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0235.466] CloseHandle (hObject=0xec) returned 1 [0235.466] CloseHandle (hObject=0xd0) returned 1 [0235.466] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\pww5JHL18GeJ_4.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\pww5jhl18gej_4.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\pww5JHL18GeJ_4.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\pww5jhl18gej_4.bmp.dvodltmf")) returned 0 [0235.467] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\pww5JHL18GeJ_4.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\pww5jhl18gej_4.bmp.dvodltmf")) returned 0x20 [0235.467] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\pww5JHL18GeJ_4.bmp", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a4e5a10, ftCreationTime.dwHighDateTime=0x1d4c625, ftLastAccessTime.dwLowDateTime=0x714c0830, ftLastAccessTime.dwHighDateTime=0x1d4c618, ftLastWriteTime.dwLowDateTime=0x714c0830, ftLastWriteTime.dwHighDateTime=0x1d4c618, nFileSizeHigh=0x0, nFileSizeLow=0x14206, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="pww5JHL18GeJ_4.bmp", cAlternateFileName="PWW5JH~1.BMP")) returned 0x2e8458 [0235.467] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a4e5a10, ftCreationTime.dwHighDateTime=0x1d4c625, ftLastAccessTime.dwLowDateTime=0x714c0830, ftLastAccessTime.dwHighDateTime=0x1d4c618, ftLastWriteTime.dwLowDateTime=0x714c0830, ftLastWriteTime.dwHighDateTime=0x1d4c618, nFileSizeHigh=0x0, nFileSizeLow=0x14206, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="pww5JHL18GeJ_4.bmp", cAlternateFileName="PWW5JH~1.BMP")) returned 0 [0235.468] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0235.468] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\pww5JHL18GeJ_4.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\pww5jhl18gej_4.bmp")) returned 1 [0235.469] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\pww5JHL18GeJ_4.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\pww5jhl18gej_4.bmp")) returned 0xffffffff [0235.469] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf94aa80, ftCreationTime.dwHighDateTime=0x1d4c6f7, ftLastAccessTime.dwLowDateTime=0x1cd26c80, ftLastAccessTime.dwHighDateTime=0x1d4d433, ftLastWriteTime.dwLowDateTime=0x1cd26c80, ftLastWriteTime.dwHighDateTime=0x1d4d433, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="t0Gj66L300JmUfmf6Kv", cAlternateFileName="T0GJ66~1")) returned 1 [0235.469] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf94aa80, ftCreationTime.dwHighDateTime=0x1d4c6f7, ftLastAccessTime.dwLowDateTime=0x1cd26c80, ftLastAccessTime.dwHighDateTime=0x1d4d433, ftLastWriteTime.dwLowDateTime=0x1cd26c80, ftLastWriteTime.dwHighDateTime=0x1d4d433, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0235.469] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf94aa80, ftCreationTime.dwHighDateTime=0x1d4c6f7, ftLastAccessTime.dwLowDateTime=0x1cd26c80, ftLastAccessTime.dwHighDateTime=0x1d4d433, ftLastWriteTime.dwLowDateTime=0x1cd26c80, ftLastWriteTime.dwHighDateTime=0x1d4d433, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0235.469] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2404c50, ftCreationTime.dwHighDateTime=0x1d4c8ae, ftLastAccessTime.dwLowDateTime=0xd57704a0, ftLastAccessTime.dwHighDateTime=0x1d4d431, ftLastWriteTime.dwLowDateTime=0xd57704a0, ftLastWriteTime.dwHighDateTime=0x1d4d431, nFileSizeHigh=0x0, nFileSizeLow=0xeca0, dwReserved0=0x72, dwReserved1=0x0, cFileName="4CgUxOoeFr_aPzyguMw.gif", cAlternateFileName="4CGUXO~1.GIF")) returned 1 [0235.469] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\4CgUxOoeFr_aPzyguMw.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\4cguxooefr_apzygumw.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0235.469] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\4CgUxOoeFr_aPzyguMw.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\4cguxooefr_apzygumw.gif.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0235.470] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xeca0 [0235.470] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0235.470] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0235.565] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xeca0, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0xeca0, lpOverlapped=0x0) returned 1 [0235.566] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xecb0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0xecb0, lpOverlapped=0x0) returned 1 [0235.568] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0235.590] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0235.601] CloseHandle (hObject=0xec) returned 1 [0235.601] CloseHandle (hObject=0xe8) returned 1 [0235.601] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\4CgUxOoeFr_aPzyguMw.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\4cguxooefr_apzygumw.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\4CgUxOoeFr_aPzyguMw.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\4cguxooefr_apzygumw.gif.dvodltmf")) returned 0 [0235.602] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\4CgUxOoeFr_aPzyguMw.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\4cguxooefr_apzygumw.gif.dvodltmf")) returned 0x20 [0235.603] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\4CgUxOoeFr_aPzyguMw.gif", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2404c50, ftCreationTime.dwHighDateTime=0x1d4c8ae, ftLastAccessTime.dwLowDateTime=0xd57704a0, ftLastAccessTime.dwHighDateTime=0x1d4d431, ftLastWriteTime.dwLowDateTime=0xd57704a0, ftLastWriteTime.dwHighDateTime=0x1d4d431, nFileSizeHigh=0x0, nFileSizeLow=0xeca0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="4CgUxOoeFr_aPzyguMw.gif", cAlternateFileName="4CGUXO~1.GIF")) returned 0x2e8498 [0235.603] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2404c50, ftCreationTime.dwHighDateTime=0x1d4c8ae, ftLastAccessTime.dwLowDateTime=0xd57704a0, ftLastAccessTime.dwHighDateTime=0x1d4d431, ftLastWriteTime.dwLowDateTime=0xd57704a0, ftLastWriteTime.dwHighDateTime=0x1d4d431, nFileSizeHigh=0x0, nFileSizeLow=0xeca0, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="4CgUxOoeFr_aPzyguMw.gif", cAlternateFileName="4CGUXO~1.GIF")) returned 0 [0235.603] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0235.603] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\4CgUxOoeFr_aPzyguMw.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\4cguxooefr_apzygumw.gif")) returned 1 [0235.605] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\4CgUxOoeFr_aPzyguMw.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\4cguxooefr_apzygumw.gif")) returned 0xffffffff [0235.605] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x845272b0, ftCreationTime.dwHighDateTime=0x1d4d0b9, ftLastAccessTime.dwLowDateTime=0xf363a580, ftLastAccessTime.dwHighDateTime=0x1d4c54b, ftLastWriteTime.dwLowDateTime=0xf363a580, ftLastWriteTime.dwHighDateTime=0x1d4c54b, nFileSizeHigh=0x0, nFileSizeLow=0x404b, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="5h5gNxYKIOY.gif", cAlternateFileName="5H5GNX~1.GIF")) returned 1 [0235.605] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\5h5gNxYKIOY.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\5h5gnxykioy.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0235.605] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\5h5gNxYKIOY.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\5h5gnxykioy.gif.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0235.605] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x404b [0235.605] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0235.606] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0235.696] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x404b, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x404b, lpOverlapped=0x0) returned 1 [0235.697] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x4050, lpOverlapped=0x0) returned 1 [0235.698] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0235.721] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0235.733] CloseHandle (hObject=0xe8) returned 1 [0235.733] CloseHandle (hObject=0xec) returned 1 [0235.733] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\5h5gNxYKIOY.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\5h5gnxykioy.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\5h5gNxYKIOY.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\5h5gnxykioy.gif.dvodltmf")) returned 0 [0235.734] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\5h5gNxYKIOY.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\5h5gnxykioy.gif.dvodltmf")) returned 0x20 [0235.734] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\5h5gNxYKIOY.gif", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x845272b0, ftCreationTime.dwHighDateTime=0x1d4d0b9, ftLastAccessTime.dwLowDateTime=0xf363a580, ftLastAccessTime.dwHighDateTime=0x1d4c54b, ftLastWriteTime.dwLowDateTime=0xf363a580, ftLastWriteTime.dwHighDateTime=0x1d4c54b, nFileSizeHigh=0x0, nFileSizeLow=0x404b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5h5gNxYKIOY.gif", cAlternateFileName="5H5GNX~1.GIF")) returned 0x2e8498 [0235.735] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x845272b0, ftCreationTime.dwHighDateTime=0x1d4d0b9, ftLastAccessTime.dwLowDateTime=0xf363a580, ftLastAccessTime.dwHighDateTime=0x1d4c54b, ftLastWriteTime.dwLowDateTime=0xf363a580, ftLastWriteTime.dwHighDateTime=0x1d4c54b, nFileSizeHigh=0x0, nFileSizeLow=0x404b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="5h5gNxYKIOY.gif", cAlternateFileName="5H5GNX~1.GIF")) returned 0 [0235.735] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0235.735] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\5h5gNxYKIOY.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\5h5gnxykioy.gif")) returned 1 [0235.736] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\5h5gNxYKIOY.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\5h5gnxykioy.gif")) returned 0xffffffff [0235.736] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5b4e9c0, ftCreationTime.dwHighDateTime=0x1d4cbcd, ftLastAccessTime.dwLowDateTime=0x8c015ae0, ftLastAccessTime.dwHighDateTime=0x1d4c951, ftLastWriteTime.dwLowDateTime=0x8c015ae0, ftLastWriteTime.dwHighDateTime=0x1d4c951, nFileSizeHigh=0x0, nFileSizeLow=0xa834, dwReserved0=0x0, dwReserved1=0x0, cFileName="KjIx1PQMdxo4H6S.gif", cAlternateFileName="KJIX1P~1.GIF")) returned 1 [0235.736] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\KjIx1PQMdxo4H6S.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\kjix1pqmdxo4h6s.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0235.737] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\KjIx1PQMdxo4H6S.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\kjix1pqmdxo4h6s.gif.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0235.737] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa834 [0235.737] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0235.737] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0235.835] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa834, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0xa834, lpOverlapped=0x0) returned 1 [0235.836] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa840, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0xa840, lpOverlapped=0x0) returned 1 [0235.838] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0235.861] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0235.872] CloseHandle (hObject=0xec) returned 1 [0235.872] CloseHandle (hObject=0xe8) returned 1 [0235.872] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\KjIx1PQMdxo4H6S.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\kjix1pqmdxo4h6s.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\KjIx1PQMdxo4H6S.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\kjix1pqmdxo4h6s.gif.dvodltmf")) returned 0 [0235.873] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\KjIx1PQMdxo4H6S.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\kjix1pqmdxo4h6s.gif.dvodltmf")) returned 0x20 [0235.873] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\KjIx1PQMdxo4H6S.gif", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5b4e9c0, ftCreationTime.dwHighDateTime=0x1d4cbcd, ftLastAccessTime.dwLowDateTime=0x8c015ae0, ftLastAccessTime.dwHighDateTime=0x1d4c951, ftLastWriteTime.dwLowDateTime=0x8c015ae0, ftLastWriteTime.dwHighDateTime=0x1d4c951, nFileSizeHigh=0x0, nFileSizeLow=0xa834, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="KjIx1PQMdxo4H6S.gif", cAlternateFileName="KJIX1P~1.GIF")) returned 0x2e8498 [0235.873] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5b4e9c0, ftCreationTime.dwHighDateTime=0x1d4cbcd, ftLastAccessTime.dwLowDateTime=0x8c015ae0, ftLastAccessTime.dwHighDateTime=0x1d4c951, ftLastWriteTime.dwLowDateTime=0x8c015ae0, ftLastWriteTime.dwHighDateTime=0x1d4c951, nFileSizeHigh=0x0, nFileSizeLow=0xa834, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="KjIx1PQMdxo4H6S.gif", cAlternateFileName="KJIX1P~1.GIF")) returned 0 [0235.873] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0235.874] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\KjIx1PQMdxo4H6S.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\kjix1pqmdxo4h6s.gif")) returned 1 [0235.875] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\KjIx1PQMdxo4H6S.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\kjix1pqmdxo4h6s.gif")) returned 0xffffffff [0235.875] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x425c03d0, ftCreationTime.dwHighDateTime=0x1d4cb91, ftLastAccessTime.dwLowDateTime=0xd7cac0d0, ftLastAccessTime.dwHighDateTime=0x1d4d18d, ftLastWriteTime.dwLowDateTime=0xd7cac0d0, ftLastWriteTime.dwHighDateTime=0x1d4d18d, nFileSizeHigh=0x0, nFileSizeLow=0x396a, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="Kxt6eA3f0PfQcc1Us.png", cAlternateFileName="KXT6EA~1.PNG")) returned 1 [0235.875] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\Kxt6eA3f0PfQcc1Us.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\kxt6ea3f0pfqcc1us.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0235.875] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\Kxt6eA3f0PfQcc1Us.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\kxt6ea3f0pfqcc1us.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0235.876] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x396a [0235.876] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0235.876] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0235.965] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x396a, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x396a, lpOverlapped=0x0) returned 1 [0235.966] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x3970, lpOverlapped=0x0) returned 1 [0235.967] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0235.990] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.001] CloseHandle (hObject=0xe8) returned 1 [0236.001] CloseHandle (hObject=0xec) returned 1 [0236.001] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\Kxt6eA3f0PfQcc1Us.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\kxt6ea3f0pfqcc1us.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\Kxt6eA3f0PfQcc1Us.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\kxt6ea3f0pfqcc1us.png.dvodltmf")) returned 0 [0236.002] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\Kxt6eA3f0PfQcc1Us.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\kxt6ea3f0pfqcc1us.png.dvodltmf")) returned 0x20 [0236.002] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\Kxt6eA3f0PfQcc1Us.png", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x425c03d0, ftCreationTime.dwHighDateTime=0x1d4cb91, ftLastAccessTime.dwLowDateTime=0xd7cac0d0, ftLastAccessTime.dwHighDateTime=0x1d4d18d, ftLastWriteTime.dwLowDateTime=0xd7cac0d0, ftLastWriteTime.dwHighDateTime=0x1d4d18d, nFileSizeHigh=0x0, nFileSizeLow=0x396a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Kxt6eA3f0PfQcc1Us.png", cAlternateFileName="KXT6EA~1.PNG")) returned 0x2e8498 [0236.003] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x425c03d0, ftCreationTime.dwHighDateTime=0x1d4cb91, ftLastAccessTime.dwLowDateTime=0xd7cac0d0, ftLastAccessTime.dwHighDateTime=0x1d4d18d, ftLastWriteTime.dwLowDateTime=0xd7cac0d0, ftLastWriteTime.dwHighDateTime=0x1d4d18d, nFileSizeHigh=0x0, nFileSizeLow=0x396a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Kxt6eA3f0PfQcc1Us.png", cAlternateFileName="KXT6EA~1.PNG")) returned 0 [0236.003] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0236.003] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\Kxt6eA3f0PfQcc1Us.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\kxt6ea3f0pfqcc1us.png")) returned 1 [0236.004] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\Kxt6eA3f0PfQcc1Us.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\kxt6ea3f0pfqcc1us.png")) returned 0xffffffff [0236.004] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64bb4ce0, ftCreationTime.dwHighDateTime=0x1d4d46c, ftLastAccessTime.dwLowDateTime=0xb7c75ce0, ftLastAccessTime.dwHighDateTime=0x1d4c9d5, ftLastWriteTime.dwLowDateTime=0xb7c75ce0, ftLastWriteTime.dwHighDateTime=0x1d4c9d5, nFileSizeHigh=0x0, nFileSizeLow=0x6a82, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="l29spcG1OFdeHz.png", cAlternateFileName="L29SPC~1.PNG")) returned 1 [0236.004] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\l29spcG1OFdeHz.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\l29spcg1ofdehz.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0236.004] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\l29spcG1OFdeHz.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\l29spcg1ofdehz.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0236.005] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6a82 [0236.005] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0236.005] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0236.095] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x6a82, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x6a82, lpOverlapped=0x0) returned 1 [0236.096] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x6a90, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x6a90, lpOverlapped=0x0) returned 1 [0236.097] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0236.121] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.132] CloseHandle (hObject=0xec) returned 1 [0236.132] CloseHandle (hObject=0xe8) returned 1 [0236.132] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\l29spcG1OFdeHz.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\l29spcg1ofdehz.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\l29spcG1OFdeHz.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\l29spcg1ofdehz.png.dvodltmf")) returned 0 [0236.133] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\l29spcG1OFdeHz.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\l29spcg1ofdehz.png.dvodltmf")) returned 0x20 [0236.133] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\l29spcG1OFdeHz.png", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64bb4ce0, ftCreationTime.dwHighDateTime=0x1d4d46c, ftLastAccessTime.dwLowDateTime=0xb7c75ce0, ftLastAccessTime.dwHighDateTime=0x1d4c9d5, ftLastWriteTime.dwLowDateTime=0xb7c75ce0, ftLastWriteTime.dwHighDateTime=0x1d4c9d5, nFileSizeHigh=0x0, nFileSizeLow=0x6a82, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="l29spcG1OFdeHz.png", cAlternateFileName="L29SPC~1.PNG")) returned 0x2e8498 [0236.134] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64bb4ce0, ftCreationTime.dwHighDateTime=0x1d4d46c, ftLastAccessTime.dwLowDateTime=0xb7c75ce0, ftLastAccessTime.dwHighDateTime=0x1d4c9d5, ftLastWriteTime.dwLowDateTime=0xb7c75ce0, ftLastWriteTime.dwHighDateTime=0x1d4c9d5, nFileSizeHigh=0x0, nFileSizeLow=0x6a82, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="l29spcG1OFdeHz.png", cAlternateFileName="L29SPC~1.PNG")) returned 0 [0236.134] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0236.134] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\l29spcG1OFdeHz.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\l29spcg1ofdehz.png")) returned 1 [0236.135] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\l29spcG1OFdeHz.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\l29spcg1ofdehz.png")) returned 0xffffffff [0236.135] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc932e010, ftCreationTime.dwHighDateTime=0x1d4d1d9, ftLastAccessTime.dwLowDateTime=0x2b3a0820, ftLastAccessTime.dwHighDateTime=0x1d4c586, ftLastWriteTime.dwLowDateTime=0x2b3a0820, ftLastWriteTime.dwHighDateTime=0x1d4c586, nFileSizeHigh=0x0, nFileSizeLow=0x180a0, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="oo-zD5V-B8.bmp", cAlternateFileName="OO-ZD5~1.BMP")) returned 1 [0236.135] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\oo-zD5V-B8.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\oo-zd5v-b8.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0236.135] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\oo-zD5V-B8.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\oo-zd5v-b8.bmp.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0236.136] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x180a0 [0236.136] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0236.136] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0236.225] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x180a0, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x180a0, lpOverlapped=0x0) returned 1 [0236.227] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x180b0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x180b0, lpOverlapped=0x0) returned 1 [0236.229] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0236.252] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.263] CloseHandle (hObject=0xe8) returned 1 [0236.263] CloseHandle (hObject=0xec) returned 1 [0236.264] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\oo-zD5V-B8.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\oo-zd5v-b8.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\oo-zD5V-B8.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\oo-zd5v-b8.bmp.dvodltmf")) returned 0 [0236.265] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\oo-zD5V-B8.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\oo-zd5v-b8.bmp.dvodltmf")) returned 0x20 [0236.265] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\oo-zD5V-B8.bmp", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc932e010, ftCreationTime.dwHighDateTime=0x1d4d1d9, ftLastAccessTime.dwLowDateTime=0x2b3a0820, ftLastAccessTime.dwHighDateTime=0x1d4c586, ftLastWriteTime.dwLowDateTime=0x2b3a0820, ftLastWriteTime.dwHighDateTime=0x1d4c586, nFileSizeHigh=0x0, nFileSizeLow=0x180a0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="oo-zD5V-B8.bmp", cAlternateFileName="OO-ZD5~1.BMP")) returned 0x2e8498 [0236.265] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc932e010, ftCreationTime.dwHighDateTime=0x1d4d1d9, ftLastAccessTime.dwLowDateTime=0x2b3a0820, ftLastAccessTime.dwHighDateTime=0x1d4c586, ftLastWriteTime.dwLowDateTime=0x2b3a0820, ftLastWriteTime.dwHighDateTime=0x1d4c586, nFileSizeHigh=0x0, nFileSizeLow=0x180a0, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="oo-zD5V-B8.bmp", cAlternateFileName="OO-ZD5~1.BMP")) returned 0 [0236.265] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0236.265] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\oo-zD5V-B8.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\oo-zd5v-b8.bmp")) returned 1 [0236.267] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\oo-zD5V-B8.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\oo-zd5v-b8.bmp")) returned 0xffffffff [0236.267] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a479880, ftCreationTime.dwHighDateTime=0x1d4cdef, ftLastAccessTime.dwLowDateTime=0xb484d630, ftLastAccessTime.dwHighDateTime=0x1d4cb00, ftLastWriteTime.dwLowDateTime=0xb484d630, ftLastWriteTime.dwHighDateTime=0x1d4cb00, nFileSizeHigh=0x0, nFileSizeLow=0x401e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RrT9 ujCR2G.gif", cAlternateFileName="RRT9UJ~1.GIF")) returned 1 [0236.267] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\RrT9 ujCR2G.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\rrt9 ujcr2g.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0236.268] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\RrT9 ujCR2G.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\rrt9 ujcr2g.gif.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0236.268] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x401e [0236.268] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0236.269] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0236.358] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x401e, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x401e, lpOverlapped=0x0) returned 1 [0236.359] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4020, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x4020, lpOverlapped=0x0) returned 1 [0236.360] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0236.386] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.397] CloseHandle (hObject=0xec) returned 1 [0236.397] CloseHandle (hObject=0xe8) returned 1 [0236.397] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\RrT9 ujCR2G.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\rrt9 ujcr2g.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\RrT9 ujCR2G.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\rrt9 ujcr2g.gif.dvodltmf")) returned 0 [0236.398] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\RrT9 ujCR2G.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\rrt9 ujcr2g.gif.dvodltmf")) returned 0x20 [0236.398] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\RrT9 ujCR2G.gif", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a479880, ftCreationTime.dwHighDateTime=0x1d4cdef, ftLastAccessTime.dwLowDateTime=0xb484d630, ftLastAccessTime.dwHighDateTime=0x1d4cb00, ftLastWriteTime.dwLowDateTime=0xb484d630, ftLastWriteTime.dwHighDateTime=0x1d4cb00, nFileSizeHigh=0x0, nFileSizeLow=0x401e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="RrT9 ujCR2G.gif", cAlternateFileName="RRT9UJ~1.GIF")) returned 0x2e8498 [0236.399] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a479880, ftCreationTime.dwHighDateTime=0x1d4cdef, ftLastAccessTime.dwLowDateTime=0xb484d630, ftLastAccessTime.dwHighDateTime=0x1d4cb00, ftLastWriteTime.dwLowDateTime=0xb484d630, ftLastWriteTime.dwHighDateTime=0x1d4cb00, nFileSizeHigh=0x0, nFileSizeLow=0x401e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="RrT9 ujCR2G.gif", cAlternateFileName="RRT9UJ~1.GIF")) returned 0 [0236.399] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0236.399] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\RrT9 ujCR2G.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\rrt9 ujcr2g.gif")) returned 1 [0236.400] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\RrT9 ujCR2G.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\rrt9 ujcr2g.gif")) returned 0xffffffff [0236.400] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f4b87b0, ftCreationTime.dwHighDateTime=0x1d4ce31, ftLastAccessTime.dwLowDateTime=0x5ac79bf0, ftLastAccessTime.dwHighDateTime=0x1d4d0eb, ftLastWriteTime.dwLowDateTime=0x5ac79bf0, ftLastWriteTime.dwHighDateTime=0x1d4d0eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SGH-QuStiq", cAlternateFileName="SGH-QU~1")) returned 1 [0236.400] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f4b87b0, ftCreationTime.dwHighDateTime=0x1d4ce31, ftLastAccessTime.dwLowDateTime=0x5ac79bf0, ftLastAccessTime.dwHighDateTime=0x1d4d0eb, ftLastWriteTime.dwLowDateTime=0x5ac79bf0, ftLastWriteTime.dwHighDateTime=0x1d4d0eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x94, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0236.400] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f4b87b0, ftCreationTime.dwHighDateTime=0x1d4ce31, ftLastAccessTime.dwLowDateTime=0x5ac79bf0, ftLastAccessTime.dwHighDateTime=0x1d4d0eb, ftLastWriteTime.dwLowDateTime=0x5ac79bf0, ftLastWriteTime.dwHighDateTime=0x1d4d0eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x94, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0236.400] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x573a0f90, ftCreationTime.dwHighDateTime=0x1d4c6ff, ftLastAccessTime.dwLowDateTime=0x27f4dbb0, ftLastAccessTime.dwHighDateTime=0x1d4c5e8, ftLastWriteTime.dwLowDateTime=0x27f4dbb0, ftLastWriteTime.dwHighDateTime=0x1d4c5e8, nFileSizeHigh=0x0, nFileSizeLow=0x4a9e, dwReserved0=0x94, dwReserved1=0x0, cFileName="7JfD0V2aQp.bmp", cAlternateFileName="7JFD0V~1.BMP")) returned 1 [0236.400] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\7JfD0V2aQp.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\sgh-qustiq\\7jfd0v2aqp.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0236.400] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\7JfD0V2aQp.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\sgh-qustiq\\7jfd0v2aqp.bmp.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0236.401] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4a9e [0236.401] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0236.402] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0236.496] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4a9e, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x4a9e, lpOverlapped=0x0) returned 1 [0236.497] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4aa0, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x4aa0, lpOverlapped=0x0) returned 1 [0236.498] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0236.521] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.532] CloseHandle (hObject=0xec) returned 1 [0236.532] CloseHandle (hObject=0xd8) returned 1 [0236.532] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\7JfD0V2aQp.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\sgh-qustiq\\7jfd0v2aqp.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\7JfD0V2aQp.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\sgh-qustiq\\7jfd0v2aqp.bmp.dvodltmf")) returned 0 [0236.533] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\7JfD0V2aQp.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\sgh-qustiq\\7jfd0v2aqp.bmp.dvodltmf")) returned 0x20 [0236.533] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\7JfD0V2aQp.bmp", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x573a0f90, ftCreationTime.dwHighDateTime=0x1d4c6ff, ftLastAccessTime.dwLowDateTime=0x27f4dbb0, ftLastAccessTime.dwHighDateTime=0x1d4c5e8, ftLastWriteTime.dwLowDateTime=0x27f4dbb0, ftLastWriteTime.dwHighDateTime=0x1d4c5e8, nFileSizeHigh=0x0, nFileSizeLow=0x4a9e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="7JfD0V2aQp.bmp", cAlternateFileName="7JFD0V~1.BMP")) returned 0x2e84d8 [0236.534] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x573a0f90, ftCreationTime.dwHighDateTime=0x1d4c6ff, ftLastAccessTime.dwLowDateTime=0x27f4dbb0, ftLastAccessTime.dwHighDateTime=0x1d4c5e8, ftLastWriteTime.dwLowDateTime=0x27f4dbb0, ftLastWriteTime.dwHighDateTime=0x1d4c5e8, nFileSizeHigh=0x0, nFileSizeLow=0x4a9e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="7JfD0V2aQp.bmp", cAlternateFileName="7JFD0V~1.BMP")) returned 0 [0236.534] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0236.534] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\7JfD0V2aQp.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\sgh-qustiq\\7jfd0v2aqp.bmp")) returned 1 [0236.535] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\7JfD0V2aQp.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\sgh-qustiq\\7jfd0v2aqp.bmp")) returned 0xffffffff [0236.535] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac250920, ftCreationTime.dwHighDateTime=0x1d4ce79, ftLastAccessTime.dwLowDateTime=0x3c7a6770, ftLastAccessTime.dwHighDateTime=0x1d4c599, ftLastWriteTime.dwLowDateTime=0x3c7a6770, ftLastWriteTime.dwHighDateTime=0x1d4c599, nFileSizeHigh=0x0, nFileSizeLow=0x712f, dwReserved0=0x2dbbd0, dwReserved1=0x18f054, cFileName="bOPAR.png", cAlternateFileName="")) returned 1 [0236.535] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\bOPAR.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\sgh-qustiq\\bopar.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0236.535] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\bOPAR.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\sgh-qustiq\\bopar.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0236.536] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x712f [0236.536] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0236.536] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0236.635] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x712f, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x712f, lpOverlapped=0x0) returned 1 [0236.636] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x7130, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x7130, lpOverlapped=0x0) returned 1 [0236.637] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0236.660] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.671] CloseHandle (hObject=0xd8) returned 1 [0236.671] CloseHandle (hObject=0xec) returned 1 [0236.671] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\bOPAR.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\sgh-qustiq\\bopar.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\bOPAR.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\sgh-qustiq\\bopar.png.dvodltmf")) returned 0 [0236.672] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\bOPAR.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\sgh-qustiq\\bopar.png.dvodltmf")) returned 0x20 [0236.672] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\bOPAR.png", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac250920, ftCreationTime.dwHighDateTime=0x1d4ce79, ftLastAccessTime.dwLowDateTime=0x3c7a6770, ftLastAccessTime.dwHighDateTime=0x1d4c599, ftLastWriteTime.dwLowDateTime=0x3c7a6770, ftLastWriteTime.dwHighDateTime=0x1d4c599, nFileSizeHigh=0x0, nFileSizeLow=0x712f, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="bOPAR.png", cAlternateFileName="")) returned 0x2e84d8 [0236.672] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac250920, ftCreationTime.dwHighDateTime=0x1d4ce79, ftLastAccessTime.dwLowDateTime=0x3c7a6770, ftLastAccessTime.dwHighDateTime=0x1d4c599, ftLastWriteTime.dwLowDateTime=0x3c7a6770, ftLastWriteTime.dwHighDateTime=0x1d4c599, nFileSizeHigh=0x0, nFileSizeLow=0x712f, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="bOPAR.png", cAlternateFileName="")) returned 0 [0236.672] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0236.673] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\bOPAR.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\sgh-qustiq\\bopar.png")) returned 1 [0236.674] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\bOPAR.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\sgh-qustiq\\bopar.png")) returned 0xffffffff [0236.674] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c2c4010, ftCreationTime.dwHighDateTime=0x1d4c686, ftLastAccessTime.dwLowDateTime=0x31f230a0, ftLastAccessTime.dwHighDateTime=0x1d4cac9, ftLastWriteTime.dwLowDateTime=0x31f230a0, ftLastWriteTime.dwHighDateTime=0x1d4cac9, nFileSizeHigh=0x0, nFileSizeLow=0x1155c, dwReserved0=0x2dbbd0, dwReserved1=0x18f054, cFileName="Jli6CxwuKTOrvs5.bmp", cAlternateFileName="JLI6CX~1.BMP")) returned 1 [0236.674] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\Jli6CxwuKTOrvs5.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\sgh-qustiq\\jli6cxwuktorvs5.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0236.674] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\Jli6CxwuKTOrvs5.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\sgh-qustiq\\jli6cxwuktorvs5.bmp.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0236.675] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1155c [0236.675] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0236.675] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0236.783] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1155c, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x1155c, lpOverlapped=0x0) returned 1 [0236.785] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x11560, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x11560, lpOverlapped=0x0) returned 1 [0236.789] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0236.813] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.824] CloseHandle (hObject=0xec) returned 1 [0236.824] CloseHandle (hObject=0xd8) returned 1 [0236.824] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\Jli6CxwuKTOrvs5.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\sgh-qustiq\\jli6cxwuktorvs5.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\Jli6CxwuKTOrvs5.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\sgh-qustiq\\jli6cxwuktorvs5.bmp.dvodltmf")) returned 0 [0236.825] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\Jli6CxwuKTOrvs5.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\sgh-qustiq\\jli6cxwuktorvs5.bmp.dvodltmf")) returned 0x20 [0236.825] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\Jli6CxwuKTOrvs5.bmp", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c2c4010, ftCreationTime.dwHighDateTime=0x1d4c686, ftLastAccessTime.dwLowDateTime=0x31f230a0, ftLastAccessTime.dwHighDateTime=0x1d4cac9, ftLastWriteTime.dwLowDateTime=0x31f230a0, ftLastWriteTime.dwHighDateTime=0x1d4cac9, nFileSizeHigh=0x0, nFileSizeLow=0x1155c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Jli6CxwuKTOrvs5.bmp", cAlternateFileName="JLI6CX~1.BMP")) returned 0x2e84d8 [0236.826] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c2c4010, ftCreationTime.dwHighDateTime=0x1d4c686, ftLastAccessTime.dwLowDateTime=0x31f230a0, ftLastAccessTime.dwHighDateTime=0x1d4cac9, ftLastWriteTime.dwLowDateTime=0x31f230a0, ftLastWriteTime.dwHighDateTime=0x1d4cac9, nFileSizeHigh=0x0, nFileSizeLow=0x1155c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Jli6CxwuKTOrvs5.bmp", cAlternateFileName="JLI6CX~1.BMP")) returned 0 [0236.826] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0236.826] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\Jli6CxwuKTOrvs5.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\sgh-qustiq\\jli6cxwuktorvs5.bmp")) returned 1 [0236.828] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\Jli6CxwuKTOrvs5.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\sgh-qustiq\\jli6cxwuktorvs5.bmp")) returned 0xffffffff [0236.828] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303528e0, ftCreationTime.dwHighDateTime=0x1d4c80c, ftLastAccessTime.dwLowDateTime=0x25c370d0, ftLastAccessTime.dwHighDateTime=0x1d4c819, ftLastWriteTime.dwLowDateTime=0x25c370d0, ftLastWriteTime.dwHighDateTime=0x1d4c819, nFileSizeHigh=0x0, nFileSizeLow=0xfadf, dwReserved0=0x2dbbd0, dwReserved1=0x18f054, cFileName="Ob5W_v1Bl4U7Y.jpg", cAlternateFileName="OB5W_V~1.JPG")) returned 1 [0236.828] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\Ob5W_v1Bl4U7Y.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\sgh-qustiq\\ob5w_v1bl4u7y.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0236.828] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\Ob5W_v1Bl4U7Y.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\sgh-qustiq\\ob5w_v1bl4u7y.jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0236.829] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfadf [0236.829] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0236.829] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0236.919] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xfadf, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0xfadf, lpOverlapped=0x0) returned 1 [0236.921] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xfae0, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0xfae0, lpOverlapped=0x0) returned 1 [0236.923] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0236.946] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.956] CloseHandle (hObject=0xd8) returned 1 [0236.957] CloseHandle (hObject=0xec) returned 1 [0236.957] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\Ob5W_v1Bl4U7Y.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\sgh-qustiq\\ob5w_v1bl4u7y.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\Ob5W_v1Bl4U7Y.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\sgh-qustiq\\ob5w_v1bl4u7y.jpg.dvodltmf")) returned 0 [0236.958] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\Ob5W_v1Bl4U7Y.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\sgh-qustiq\\ob5w_v1bl4u7y.jpg.dvodltmf")) returned 0x20 [0236.958] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\Ob5W_v1Bl4U7Y.jpg", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303528e0, ftCreationTime.dwHighDateTime=0x1d4c80c, ftLastAccessTime.dwLowDateTime=0x25c370d0, ftLastAccessTime.dwHighDateTime=0x1d4c819, ftLastWriteTime.dwLowDateTime=0x25c370d0, ftLastWriteTime.dwHighDateTime=0x1d4c819, nFileSizeHigh=0x0, nFileSizeLow=0xfadf, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Ob5W_v1Bl4U7Y.jpg", cAlternateFileName="OB5W_V~1.JPG")) returned 0x2e84d8 [0236.958] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303528e0, ftCreationTime.dwHighDateTime=0x1d4c80c, ftLastAccessTime.dwLowDateTime=0x25c370d0, ftLastAccessTime.dwHighDateTime=0x1d4c819, ftLastWriteTime.dwLowDateTime=0x25c370d0, ftLastWriteTime.dwHighDateTime=0x1d4c819, nFileSizeHigh=0x0, nFileSizeLow=0xfadf, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Ob5W_v1Bl4U7Y.jpg", cAlternateFileName="OB5W_V~1.JPG")) returned 0 [0236.958] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0236.958] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\Ob5W_v1Bl4U7Y.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\sgh-qustiq\\ob5w_v1bl4u7y.jpg")) returned 1 [0236.960] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\Ob5W_v1Bl4U7Y.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\sgh-qustiq\\ob5w_v1bl4u7y.jpg")) returned 0xffffffff [0236.960] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab2fbc50, ftCreationTime.dwHighDateTime=0x1d4c7d9, ftLastAccessTime.dwLowDateTime=0xd58a50d0, ftLastAccessTime.dwHighDateTime=0x1d4cab5, ftLastWriteTime.dwLowDateTime=0xd58a50d0, ftLastWriteTime.dwHighDateTime=0x1d4cab5, nFileSizeHigh=0x0, nFileSizeLow=0x146c, dwReserved0=0x2dbbd0, dwReserved1=0x18f054, cFileName="uM9tnb qK.bmp", cAlternateFileName="UM9TNB~1.BMP")) returned 1 [0236.960] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\uM9tnb qK.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\sgh-qustiq\\um9tnb qk.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0236.960] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\uM9tnb qK.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\sgh-qustiq\\um9tnb qk.bmp.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0236.961] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x146c [0236.961] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0236.961] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0237.050] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x146c, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x146c, lpOverlapped=0x0) returned 1 [0237.051] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1470, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x1470, lpOverlapped=0x0) returned 1 [0237.052] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0237.075] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0237.085] CloseHandle (hObject=0xec) returned 1 [0237.085] CloseHandle (hObject=0xd8) returned 1 [0237.085] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\uM9tnb qK.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\sgh-qustiq\\um9tnb qk.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\uM9tnb qK.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\sgh-qustiq\\um9tnb qk.bmp.dvodltmf")) returned 0 [0237.086] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\uM9tnb qK.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\sgh-qustiq\\um9tnb qk.bmp.dvodltmf")) returned 0x20 [0237.087] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\uM9tnb qK.bmp", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab2fbc50, ftCreationTime.dwHighDateTime=0x1d4c7d9, ftLastAccessTime.dwLowDateTime=0xd58a50d0, ftLastAccessTime.dwHighDateTime=0x1d4cab5, ftLastWriteTime.dwLowDateTime=0xd58a50d0, ftLastWriteTime.dwHighDateTime=0x1d4cab5, nFileSizeHigh=0x0, nFileSizeLow=0x146c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="uM9tnb qK.bmp", cAlternateFileName="UM9TNB~1.BMP")) returned 0x2e84d8 [0237.087] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab2fbc50, ftCreationTime.dwHighDateTime=0x1d4c7d9, ftLastAccessTime.dwLowDateTime=0xd58a50d0, ftLastAccessTime.dwHighDateTime=0x1d4cab5, ftLastWriteTime.dwLowDateTime=0xd58a50d0, ftLastWriteTime.dwHighDateTime=0x1d4cab5, nFileSizeHigh=0x0, nFileSizeLow=0x146c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="uM9tnb qK.bmp", cAlternateFileName="UM9TNB~1.BMP")) returned 0 [0237.087] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0237.087] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\uM9tnb qK.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\sgh-qustiq\\um9tnb qk.bmp")) returned 1 [0237.088] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\SGH-QuStiq\\uM9tnb qK.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\sgh-qustiq\\um9tnb qk.bmp")) returned 0xffffffff [0237.088] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab2fbc50, ftCreationTime.dwHighDateTime=0x1d4c7d9, ftLastAccessTime.dwLowDateTime=0xd58a50d0, ftLastAccessTime.dwHighDateTime=0x1d4cab5, ftLastWriteTime.dwLowDateTime=0xd58a50d0, ftLastWriteTime.dwHighDateTime=0x1d4cab5, nFileSizeHigh=0x0, nFileSizeLow=0x146c, dwReserved0=0x2dbbd0, dwReserved1=0x18f054, cFileName="uM9tnb qK.bmp", cAlternateFileName="UM9TNB~1.BMP")) returned 0 [0237.088] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0237.089] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5942e000, ftCreationTime.dwHighDateTime=0x1d4cee3, ftLastAccessTime.dwLowDateTime=0x50ff7040, ftLastAccessTime.dwHighDateTime=0x1d4cf09, ftLastWriteTime.dwLowDateTime=0x50ff7040, ftLastWriteTime.dwHighDateTime=0x1d4cf09, nFileSizeHigh=0x0, nFileSizeLow=0x15ccb, dwReserved0=0x6a2e706d, dwReserved1=0x706d6770, cFileName="x7-0yj1XO Gbh5mMeMU.gif", cAlternateFileName="X7-0YJ~1.GIF")) returned 1 [0237.089] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\x7-0yj1XO Gbh5mMeMU.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\x7-0yj1xo gbh5mmemu.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0237.089] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\x7-0yj1XO Gbh5mMeMU.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\x7-0yj1xo gbh5mmemu.gif.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0237.089] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15ccb [0237.089] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0237.090] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0237.177] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x15ccb, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x15ccb, lpOverlapped=0x0) returned 1 [0237.179] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x15cd0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x15cd0, lpOverlapped=0x0) returned 1 [0237.181] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0237.204] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0237.215] CloseHandle (hObject=0xe8) returned 1 [0237.215] CloseHandle (hObject=0xd8) returned 1 [0237.215] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\x7-0yj1XO Gbh5mMeMU.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\x7-0yj1xo gbh5mmemu.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\x7-0yj1XO Gbh5mMeMU.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\x7-0yj1xo gbh5mmemu.gif.dvodltmf")) returned 0 [0237.216] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\x7-0yj1XO Gbh5mMeMU.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\x7-0yj1xo gbh5mmemu.gif.dvodltmf")) returned 0x20 [0237.216] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\x7-0yj1XO Gbh5mMeMU.gif", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5942e000, ftCreationTime.dwHighDateTime=0x1d4cee3, ftLastAccessTime.dwLowDateTime=0x50ff7040, ftLastAccessTime.dwHighDateTime=0x1d4cf09, ftLastWriteTime.dwLowDateTime=0x50ff7040, ftLastWriteTime.dwHighDateTime=0x1d4cf09, nFileSizeHigh=0x0, nFileSizeLow=0x15ccb, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="x7-0yj1XO Gbh5mMeMU.gif", cAlternateFileName="X7-0YJ~1.GIF")) returned 0x2e8498 [0237.216] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5942e000, ftCreationTime.dwHighDateTime=0x1d4cee3, ftLastAccessTime.dwLowDateTime=0x50ff7040, ftLastAccessTime.dwHighDateTime=0x1d4cf09, ftLastWriteTime.dwLowDateTime=0x50ff7040, ftLastWriteTime.dwHighDateTime=0x1d4cf09, nFileSizeHigh=0x0, nFileSizeLow=0x15ccb, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="x7-0yj1XO Gbh5mMeMU.gif", cAlternateFileName="X7-0YJ~1.GIF")) returned 0 [0237.216] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0237.216] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\x7-0yj1XO Gbh5mMeMU.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\x7-0yj1xo gbh5mmemu.gif")) returned 1 [0237.218] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\x7-0yj1XO Gbh5mMeMU.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\x7-0yj1xo gbh5mmemu.gif")) returned 0xffffffff [0237.218] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2944a6f0, ftCreationTime.dwHighDateTime=0x1d4c7da, ftLastAccessTime.dwLowDateTime=0xca088220, ftLastAccessTime.dwHighDateTime=0x1d4c86e, ftLastWriteTime.dwLowDateTime=0xca088220, ftLastWriteTime.dwHighDateTime=0x1d4c86e, nFileSizeHigh=0x0, nFileSizeLow=0x2cbd, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="z_li2.gif", cAlternateFileName="")) returned 1 [0237.218] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\z_li2.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\z_li2.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0237.218] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\z_li2.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\z_li2.gif.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0237.219] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2cbd [0237.219] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0237.219] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0237.309] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2cbd, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x2cbd, lpOverlapped=0x0) returned 1 [0237.309] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2cc0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x2cc0, lpOverlapped=0x0) returned 1 [0237.310] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0237.333] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0237.344] CloseHandle (hObject=0xd8) returned 1 [0237.344] CloseHandle (hObject=0xe8) returned 1 [0237.344] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\z_li2.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\z_li2.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\z_li2.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\z_li2.gif.dvodltmf")) returned 0 [0237.345] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\z_li2.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\z_li2.gif.dvodltmf")) returned 0x20 [0237.346] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\z_li2.gif", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2944a6f0, ftCreationTime.dwHighDateTime=0x1d4c7da, ftLastAccessTime.dwLowDateTime=0xca088220, ftLastAccessTime.dwHighDateTime=0x1d4c86e, ftLastWriteTime.dwLowDateTime=0xca088220, ftLastWriteTime.dwHighDateTime=0x1d4c86e, nFileSizeHigh=0x0, nFileSizeLow=0x2cbd, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="z_li2.gif", cAlternateFileName="")) returned 0x2e8498 [0237.346] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2944a6f0, ftCreationTime.dwHighDateTime=0x1d4c7da, ftLastAccessTime.dwLowDateTime=0xca088220, ftLastAccessTime.dwHighDateTime=0x1d4c86e, ftLastWriteTime.dwLowDateTime=0xca088220, ftLastWriteTime.dwHighDateTime=0x1d4c86e, nFileSizeHigh=0x0, nFileSizeLow=0x2cbd, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="z_li2.gif", cAlternateFileName="")) returned 0 [0237.346] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0237.346] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\z_li2.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\z_li2.gif")) returned 1 [0237.347] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\t0Gj66L300JmUfmf6Kv\\z_li2.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\t0gj66l300jmufmf6kv\\z_li2.gif")) returned 0xffffffff [0237.347] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2944a6f0, ftCreationTime.dwHighDateTime=0x1d4c7da, ftLastAccessTime.dwLowDateTime=0xca088220, ftLastAccessTime.dwHighDateTime=0x1d4c86e, ftLastWriteTime.dwLowDateTime=0xca088220, ftLastWriteTime.dwHighDateTime=0x1d4c86e, nFileSizeHigh=0x0, nFileSizeLow=0x2cbd, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="z_li2.gif", cAlternateFileName="")) returned 0 [0237.348] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0237.348] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb46a1eb0, ftCreationTime.dwHighDateTime=0x1d4d476, ftLastAccessTime.dwLowDateTime=0x2ce927e0, ftLastAccessTime.dwHighDateTime=0x1d4d3a1, ftLastWriteTime.dwLowDateTime=0x2ce927e0, ftLastWriteTime.dwHighDateTime=0x1d4d3a1, nFileSizeHigh=0x0, nFileSizeLow=0x90b, dwReserved0=0x6d356862, dwReserved1=0x554d654d, cFileName="uAgHV6h2x- V2KmJs_-C.png", cAlternateFileName="UAGHV6~1.PNG")) returned 1 [0237.348] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uAgHV6h2x- V2KmJs_-C.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\uaghv6h2x- v2kmjs_-c.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd0 [0237.348] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uAgHV6h2x- V2KmJs_-C.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\uaghv6h2x- v2kmjs_-c.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0237.349] GetFileSize (in: hFile=0xd0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x90b [0237.349] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0237.349] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0237.447] ReadFile (in: hFile=0xd0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x90b, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x90b, lpOverlapped=0x0) returned 1 [0237.448] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x910, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x910, lpOverlapped=0x0) returned 1 [0237.449] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0237.471] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0237.482] CloseHandle (hObject=0xd0) returned 1 [0237.482] CloseHandle (hObject=0xe8) returned 1 [0237.482] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uAgHV6h2x- V2KmJs_-C.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\uaghv6h2x- v2kmjs_-c.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uAgHV6h2x- V2KmJs_-C.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\uaghv6h2x- v2kmjs_-c.png.dvodltmf")) returned 0 [0237.483] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uAgHV6h2x- V2KmJs_-C.png.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\uaghv6h2x- v2kmjs_-c.png.dvodltmf")) returned 0x20 [0237.483] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uAgHV6h2x- V2KmJs_-C.png", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb46a1eb0, ftCreationTime.dwHighDateTime=0x1d4d476, ftLastAccessTime.dwLowDateTime=0x2ce927e0, ftLastAccessTime.dwHighDateTime=0x1d4d3a1, ftLastWriteTime.dwLowDateTime=0x2ce927e0, ftLastWriteTime.dwHighDateTime=0x1d4d3a1, nFileSizeHigh=0x0, nFileSizeLow=0x90b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="uAgHV6h2x- V2KmJs_-C.png", cAlternateFileName="UAGHV6~1.PNG")) returned 0x2e8458 [0237.484] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb46a1eb0, ftCreationTime.dwHighDateTime=0x1d4d476, ftLastAccessTime.dwLowDateTime=0x2ce927e0, ftLastAccessTime.dwHighDateTime=0x1d4d3a1, ftLastWriteTime.dwLowDateTime=0x2ce927e0, ftLastWriteTime.dwHighDateTime=0x1d4d3a1, nFileSizeHigh=0x0, nFileSizeLow=0x90b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="uAgHV6h2x- V2KmJs_-C.png", cAlternateFileName="UAGHV6~1.PNG")) returned 0 [0237.484] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0237.484] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uAgHV6h2x- V2KmJs_-C.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\uaghv6h2x- v2kmjs_-c.png")) returned 1 [0237.485] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uAgHV6h2x- V2KmJs_-C.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\uaghv6h2x- v2kmjs_-c.png")) returned 0xffffffff [0237.486] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40765410, ftCreationTime.dwHighDateTime=0x1d4d309, ftLastAccessTime.dwLowDateTime=0x99386d0, ftLastAccessTime.dwHighDateTime=0x1d4ca98, ftLastWriteTime.dwLowDateTime=0x99386d0, ftLastWriteTime.dwHighDateTime=0x1d4ca98, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="XYiG", cAlternateFileName="")) returned 1 [0237.486] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XYiG\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40765410, ftCreationTime.dwHighDateTime=0x1d4d309, ftLastAccessTime.dwLowDateTime=0x99386d0, ftLastAccessTime.dwHighDateTime=0x1d4ca98, ftLastWriteTime.dwLowDateTime=0x99386d0, ftLastWriteTime.dwHighDateTime=0x1d4ca98, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0237.486] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40765410, ftCreationTime.dwHighDateTime=0x1d4d309, ftLastAccessTime.dwLowDateTime=0x99386d0, ftLastAccessTime.dwHighDateTime=0x1d4ca98, ftLastWriteTime.dwLowDateTime=0x99386d0, ftLastWriteTime.dwHighDateTime=0x1d4ca98, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0237.486] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbbcbed0, ftCreationTime.dwHighDateTime=0x1d4d2c8, ftLastAccessTime.dwLowDateTime=0xdeaa5190, ftLastAccessTime.dwHighDateTime=0x1d4c8a5, ftLastWriteTime.dwLowDateTime=0xdeaa5190, ftLastWriteTime.dwHighDateTime=0x1d4c8a5, nFileSizeHigh=0x0, nFileSizeLow=0x5b00, dwReserved0=0x7e, dwReserved1=0x0, cFileName="3qAmIeEuD.jpg", cAlternateFileName="3QAMIE~1.JPG")) returned 1 [0237.486] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XYiG\\3qAmIeEuD.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xyig\\3qamieeud.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd0 [0237.486] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XYiG\\3qAmIeEuD.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xyig\\3qamieeud.jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0237.487] GetFileSize (in: hFile=0xd0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5b00 [0237.487] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0237.487] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0237.575] ReadFile (in: hFile=0xd0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x5b00, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x5b00, lpOverlapped=0x0) returned 1 [0237.576] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x5b10, lpOverlapped=0x0) returned 1 [0237.577] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0237.600] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0237.611] CloseHandle (hObject=0xd0) returned 1 [0237.611] CloseHandle (hObject=0xd8) returned 1 [0237.611] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XYiG\\3qAmIeEuD.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xyig\\3qamieeud.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XYiG\\3qAmIeEuD.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xyig\\3qamieeud.jpg.dvodltmf")) returned 0 [0237.612] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XYiG\\3qAmIeEuD.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xyig\\3qamieeud.jpg.dvodltmf")) returned 0x20 [0237.612] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XYiG\\3qAmIeEuD.jpg", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbbcbed0, ftCreationTime.dwHighDateTime=0x1d4d2c8, ftLastAccessTime.dwLowDateTime=0xdeaa5190, ftLastAccessTime.dwHighDateTime=0x1d4c8a5, ftLastWriteTime.dwLowDateTime=0xdeaa5190, ftLastWriteTime.dwHighDateTime=0x1d4c8a5, nFileSizeHigh=0x0, nFileSizeLow=0x5b00, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="3qAmIeEuD.jpg", cAlternateFileName="3QAMIE~1.JPG")) returned 0x2e8498 [0237.612] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbbcbed0, ftCreationTime.dwHighDateTime=0x1d4d2c8, ftLastAccessTime.dwLowDateTime=0xdeaa5190, ftLastAccessTime.dwHighDateTime=0x1d4c8a5, ftLastWriteTime.dwLowDateTime=0xdeaa5190, ftLastWriteTime.dwHighDateTime=0x1d4c8a5, nFileSizeHigh=0x0, nFileSizeLow=0x5b00, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="3qAmIeEuD.jpg", cAlternateFileName="3QAMIE~1.JPG")) returned 0 [0237.612] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0237.613] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XYiG\\3qAmIeEuD.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xyig\\3qamieeud.jpg")) returned 1 [0237.614] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XYiG\\3qAmIeEuD.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xyig\\3qamieeud.jpg")) returned 0xffffffff [0237.614] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b9b7850, ftCreationTime.dwHighDateTime=0x1d4cb20, ftLastAccessTime.dwLowDateTime=0x72dece50, ftLastAccessTime.dwHighDateTime=0x1d4c7a6, ftLastWriteTime.dwLowDateTime=0x72dece50, ftLastWriteTime.dwHighDateTime=0x1d4c7a6, nFileSizeHigh=0x0, nFileSizeLow=0x10f3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="W5noju-.gif", cAlternateFileName="")) returned 1 [0237.614] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XYiG\\W5noju-.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xyig\\w5noju-.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0237.614] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XYiG\\W5noju-.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xyig\\w5noju-.gif.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd0 [0237.615] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10f3c [0237.615] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0237.615] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0237.703] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x10f3c, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x10f3c, lpOverlapped=0x0) returned 1 [0237.704] WriteFile (in: hFile=0xd0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10f40, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x10f40, lpOverlapped=0x0) returned 1 [0237.706] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0237.728] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0237.739] CloseHandle (hObject=0xd8) returned 1 [0237.739] CloseHandle (hObject=0xd0) returned 1 [0237.740] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XYiG\\W5noju-.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xyig\\w5noju-.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XYiG\\W5noju-.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xyig\\w5noju-.gif.dvodltmf")) returned 0 [0237.740] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XYiG\\W5noju-.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xyig\\w5noju-.gif.dvodltmf")) returned 0x20 [0237.741] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XYiG\\W5noju-.gif", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b9b7850, ftCreationTime.dwHighDateTime=0x1d4cb20, ftLastAccessTime.dwLowDateTime=0x72dece50, ftLastAccessTime.dwHighDateTime=0x1d4c7a6, ftLastWriteTime.dwLowDateTime=0x72dece50, ftLastWriteTime.dwHighDateTime=0x1d4c7a6, nFileSizeHigh=0x0, nFileSizeLow=0x10f3c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="W5noju-.gif", cAlternateFileName="")) returned 0x2e8498 [0237.741] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b9b7850, ftCreationTime.dwHighDateTime=0x1d4cb20, ftLastAccessTime.dwLowDateTime=0x72dece50, ftLastAccessTime.dwHighDateTime=0x1d4c7a6, ftLastWriteTime.dwLowDateTime=0x72dece50, ftLastWriteTime.dwHighDateTime=0x1d4c7a6, nFileSizeHigh=0x0, nFileSizeLow=0x10f3c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="W5noju-.gif", cAlternateFileName="")) returned 0 [0237.741] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0237.741] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XYiG\\W5noju-.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xyig\\w5noju-.gif")) returned 1 [0237.742] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XYiG\\W5noju-.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xyig\\w5noju-.gif")) returned 0xffffffff [0237.742] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b9b7850, ftCreationTime.dwHighDateTime=0x1d4cb20, ftLastAccessTime.dwLowDateTime=0x72dece50, ftLastAccessTime.dwHighDateTime=0x1d4c7a6, ftLastWriteTime.dwLowDateTime=0x72dece50, ftLastWriteTime.dwHighDateTime=0x1d4c7a6, nFileSizeHigh=0x0, nFileSizeLow=0x10f3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="W5noju-.gif", cAlternateFileName="")) returned 0 [0237.743] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0237.743] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9b97700, ftCreationTime.dwHighDateTime=0x1d4cd31, ftLastAccessTime.dwLowDateTime=0x5d5dc620, ftLastAccessTime.dwHighDateTime=0x1d4c635, ftLastWriteTime.dwLowDateTime=0x5d5dc620, ftLastWriteTime.dwHighDateTime=0x1d4c635, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d6770, dwReserved1=0x18f524, cFileName="zyLW8gkkgWn", cAlternateFileName="ZYLW8G~1")) returned 1 [0237.743] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9b97700, ftCreationTime.dwHighDateTime=0x1d4cd31, ftLastAccessTime.dwLowDateTime=0x5d5dc620, ftLastAccessTime.dwHighDateTime=0x1d4c635, ftLastWriteTime.dwLowDateTime=0x5d5dc620, ftLastWriteTime.dwHighDateTime=0x1d4c635, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0237.743] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9b97700, ftCreationTime.dwHighDateTime=0x1d4cd31, ftLastAccessTime.dwLowDateTime=0x5d5dc620, ftLastAccessTime.dwHighDateTime=0x1d4c635, ftLastWriteTime.dwLowDateTime=0x5d5dc620, ftLastWriteTime.dwHighDateTime=0x1d4c635, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="..", cAlternateFileName="")) returned 1 [0237.743] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x716c1e80, ftCreationTime.dwHighDateTime=0x1d4cd17, ftLastAccessTime.dwLowDateTime=0xdd467550, ftLastAccessTime.dwHighDateTime=0x1d4cf07, ftLastWriteTime.dwLowDateTime=0xdd467550, ftLastWriteTime.dwHighDateTime=0x1d4cf07, nFileSizeHigh=0x0, nFileSizeLow=0x470a, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="fqnZE84.gif", cAlternateFileName="")) returned 1 [0237.743] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\fqnZE84.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zylw8gkkgwn\\fqnze84.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd0 [0237.743] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\fqnZE84.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zylw8gkkgwn\\fqnze84.gif.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0237.744] GetFileSize (in: hFile=0xd0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x470a [0237.744] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0237.744] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0237.839] ReadFile (in: hFile=0xd0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x470a, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x470a, lpOverlapped=0x0) returned 1 [0237.840] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4710, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x4710, lpOverlapped=0x0) returned 1 [0237.841] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0237.863] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0237.874] CloseHandle (hObject=0xd0) returned 1 [0237.874] CloseHandle (hObject=0xd8) returned 1 [0237.874] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\fqnZE84.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zylw8gkkgwn\\fqnze84.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\fqnZE84.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zylw8gkkgwn\\fqnze84.gif.dvodltmf")) returned 0 [0237.875] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\fqnZE84.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zylw8gkkgwn\\fqnze84.gif.dvodltmf")) returned 0x20 [0237.875] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\fqnZE84.gif", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x716c1e80, ftCreationTime.dwHighDateTime=0x1d4cd17, ftLastAccessTime.dwLowDateTime=0xdd467550, ftLastAccessTime.dwHighDateTime=0x1d4cf07, ftLastWriteTime.dwLowDateTime=0xdd467550, ftLastWriteTime.dwHighDateTime=0x1d4cf07, nFileSizeHigh=0x0, nFileSizeLow=0x470a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="fqnZE84.gif", cAlternateFileName="")) returned 0x2e8498 [0237.875] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x716c1e80, ftCreationTime.dwHighDateTime=0x1d4cd17, ftLastAccessTime.dwLowDateTime=0xdd467550, ftLastAccessTime.dwHighDateTime=0x1d4cf07, ftLastWriteTime.dwLowDateTime=0xdd467550, ftLastWriteTime.dwHighDateTime=0x1d4cf07, nFileSizeHigh=0x0, nFileSizeLow=0x470a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="fqnZE84.gif", cAlternateFileName="")) returned 0 [0237.875] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0237.875] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\fqnZE84.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zylw8gkkgwn\\fqnze84.gif")) returned 1 [0237.877] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\fqnZE84.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zylw8gkkgwn\\fqnze84.gif")) returned 0xffffffff [0237.877] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6abace0, ftCreationTime.dwHighDateTime=0x1d4cae3, ftLastAccessTime.dwLowDateTime=0xb36da1b0, ftLastAccessTime.dwHighDateTime=0x1d4c9bf, ftLastWriteTime.dwLowDateTime=0xb36da1b0, ftLastWriteTime.dwHighDateTime=0x1d4c9bf, nFileSizeHigh=0x0, nFileSizeLow=0xef0b, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="gBMJ et.jpg", cAlternateFileName="GBMJET~1.JPG")) returned 1 [0237.877] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\gBMJ et.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zylw8gkkgwn\\gbmj et.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0237.877] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\gBMJ et.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zylw8gkkgwn\\gbmj et.jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd0 [0237.878] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xef0b [0237.878] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0237.878] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0237.967] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xef0b, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0xef0b, lpOverlapped=0x0) returned 1 [0237.969] WriteFile (in: hFile=0xd0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xef10, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0xef10, lpOverlapped=0x0) returned 1 [0237.970] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0237.993] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0238.004] CloseHandle (hObject=0xd8) returned 1 [0238.004] CloseHandle (hObject=0xd0) returned 1 [0238.004] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\gBMJ et.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zylw8gkkgwn\\gbmj et.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\gBMJ et.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zylw8gkkgwn\\gbmj et.jpg.dvodltmf")) returned 0 [0238.005] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\gBMJ et.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zylw8gkkgwn\\gbmj et.jpg.dvodltmf")) returned 0x20 [0238.005] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\gBMJ et.jpg", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6abace0, ftCreationTime.dwHighDateTime=0x1d4cae3, ftLastAccessTime.dwLowDateTime=0xb36da1b0, ftLastAccessTime.dwHighDateTime=0x1d4c9bf, ftLastWriteTime.dwLowDateTime=0xb36da1b0, ftLastWriteTime.dwHighDateTime=0x1d4c9bf, nFileSizeHigh=0x0, nFileSizeLow=0xef0b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="gBMJ et.jpg", cAlternateFileName="GBMJET~1.JPG")) returned 0x2e8498 [0238.006] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6abace0, ftCreationTime.dwHighDateTime=0x1d4cae3, ftLastAccessTime.dwLowDateTime=0xb36da1b0, ftLastAccessTime.dwHighDateTime=0x1d4c9bf, ftLastWriteTime.dwLowDateTime=0xb36da1b0, ftLastWriteTime.dwHighDateTime=0x1d4c9bf, nFileSizeHigh=0x0, nFileSizeLow=0xef0b, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="gBMJ et.jpg", cAlternateFileName="GBMJET~1.JPG")) returned 0 [0238.006] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0238.006] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\gBMJ et.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zylw8gkkgwn\\gbmj et.jpg")) returned 1 [0238.021] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\gBMJ et.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zylw8gkkgwn\\gbmj et.jpg")) returned 0xffffffff [0238.021] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf28052f0, ftCreationTime.dwHighDateTime=0x1d4c7d3, ftLastAccessTime.dwLowDateTime=0x602ce170, ftLastAccessTime.dwHighDateTime=0x1d4c742, ftLastWriteTime.dwLowDateTime=0x602ce170, ftLastWriteTime.dwHighDateTime=0x1d4c742, nFileSizeHigh=0x0, nFileSizeLow=0x4721, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="IDakXGLR0FBjl4Pii89.bmp", cAlternateFileName="IDAKXG~1.BMP")) returned 1 [0238.021] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\IDakXGLR0FBjl4Pii89.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zylw8gkkgwn\\idakxglr0fbjl4pii89.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd0 [0238.021] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\IDakXGLR0FBjl4Pii89.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zylw8gkkgwn\\idakxglr0fbjl4pii89.bmp.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0238.022] GetFileSize (in: hFile=0xd0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4721 [0238.022] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0238.022] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0238.111] ReadFile (in: hFile=0xd0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4721, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x4721, lpOverlapped=0x0) returned 1 [0238.112] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4730, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x4730, lpOverlapped=0x0) returned 1 [0238.113] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0238.136] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0238.147] CloseHandle (hObject=0xd0) returned 1 [0238.147] CloseHandle (hObject=0xd8) returned 1 [0238.147] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\IDakXGLR0FBjl4Pii89.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zylw8gkkgwn\\idakxglr0fbjl4pii89.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\IDakXGLR0FBjl4Pii89.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zylw8gkkgwn\\idakxglr0fbjl4pii89.bmp.dvodltmf")) returned 0 [0238.148] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\IDakXGLR0FBjl4Pii89.bmp.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zylw8gkkgwn\\idakxglr0fbjl4pii89.bmp.dvodltmf")) returned 0x20 [0238.148] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\IDakXGLR0FBjl4Pii89.bmp", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf28052f0, ftCreationTime.dwHighDateTime=0x1d4c7d3, ftLastAccessTime.dwLowDateTime=0x602ce170, ftLastAccessTime.dwHighDateTime=0x1d4c742, ftLastWriteTime.dwLowDateTime=0x602ce170, ftLastWriteTime.dwHighDateTime=0x1d4c742, nFileSizeHigh=0x0, nFileSizeLow=0x4721, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="IDakXGLR0FBjl4Pii89.bmp", cAlternateFileName="IDAKXG~1.BMP")) returned 0x2e8498 [0238.148] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf28052f0, ftCreationTime.dwHighDateTime=0x1d4c7d3, ftLastAccessTime.dwLowDateTime=0x602ce170, ftLastAccessTime.dwHighDateTime=0x1d4c742, ftLastWriteTime.dwLowDateTime=0x602ce170, ftLastWriteTime.dwHighDateTime=0x1d4c742, nFileSizeHigh=0x0, nFileSizeLow=0x4721, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="IDakXGLR0FBjl4Pii89.bmp", cAlternateFileName="IDAKXG~1.BMP")) returned 0 [0238.148] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0238.148] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\IDakXGLR0FBjl4Pii89.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zylw8gkkgwn\\idakxglr0fbjl4pii89.bmp")) returned 1 [0238.150] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\IDakXGLR0FBjl4Pii89.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zylw8gkkgwn\\idakxglr0fbjl4pii89.bmp")) returned 0xffffffff [0238.150] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c6fbb0, ftCreationTime.dwHighDateTime=0x1d4d1eb, ftLastAccessTime.dwLowDateTime=0x7a65e5f0, ftLastAccessTime.dwHighDateTime=0x1d4ca80, ftLastWriteTime.dwLowDateTime=0x7a65e5f0, ftLastWriteTime.dwHighDateTime=0x1d4ca80, nFileSizeHigh=0x0, nFileSizeLow=0x18c60, dwReserved0=0x0, dwReserved1=0x0, cFileName="p_KzsX.gif", cAlternateFileName="")) returned 1 [0238.150] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\p_KzsX.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zylw8gkkgwn\\p_kzsx.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0238.150] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\p_KzsX.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zylw8gkkgwn\\p_kzsx.gif.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd0 [0238.151] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18c60 [0238.151] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0238.151] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0238.240] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x18c60, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x18c60, lpOverlapped=0x0) returned 1 [0238.241] WriteFile (in: hFile=0xd0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x18c70, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x18c70, lpOverlapped=0x0) returned 1 [0238.244] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0238.266] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0238.277] CloseHandle (hObject=0xd8) returned 1 [0238.277] CloseHandle (hObject=0xd0) returned 1 [0238.277] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\p_KzsX.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zylw8gkkgwn\\p_kzsx.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\p_KzsX.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zylw8gkkgwn\\p_kzsx.gif.dvodltmf")) returned 0 [0238.278] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\p_KzsX.gif.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zylw8gkkgwn\\p_kzsx.gif.dvodltmf")) returned 0x20 [0238.278] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\p_KzsX.gif", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c6fbb0, ftCreationTime.dwHighDateTime=0x1d4d1eb, ftLastAccessTime.dwLowDateTime=0x7a65e5f0, ftLastAccessTime.dwHighDateTime=0x1d4ca80, ftLastWriteTime.dwLowDateTime=0x7a65e5f0, ftLastWriteTime.dwHighDateTime=0x1d4ca80, nFileSizeHigh=0x0, nFileSizeLow=0x18c60, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="p_KzsX.gif", cAlternateFileName="")) returned 0x2e8498 [0238.279] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c6fbb0, ftCreationTime.dwHighDateTime=0x1d4d1eb, ftLastAccessTime.dwLowDateTime=0x7a65e5f0, ftLastAccessTime.dwHighDateTime=0x1d4ca80, ftLastWriteTime.dwLowDateTime=0x7a65e5f0, ftLastWriteTime.dwHighDateTime=0x1d4ca80, nFileSizeHigh=0x0, nFileSizeLow=0x18c60, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="p_KzsX.gif", cAlternateFileName="")) returned 0 [0238.279] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0238.279] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\p_KzsX.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zylw8gkkgwn\\p_kzsx.gif")) returned 1 [0238.280] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\p_KzsX.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zylw8gkkgwn\\p_kzsx.gif")) returned 0xffffffff [0238.281] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x666c5160, ftCreationTime.dwHighDateTime=0x1d4c96d, ftLastAccessTime.dwLowDateTime=0x14e13f0, ftLastAccessTime.dwHighDateTime=0x1d4d150, ftLastWriteTime.dwLowDateTime=0x14e13f0, ftLastWriteTime.dwHighDateTime=0x1d4d150, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="SO5Gg xGozv6CUDTj4U", cAlternateFileName="SO5GGX~1")) returned 1 [0238.281] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\SO5Gg xGozv6CUDTj4U\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x666c5160, ftCreationTime.dwHighDateTime=0x1d4c96d, ftLastAccessTime.dwLowDateTime=0x14e13f0, ftLastAccessTime.dwHighDateTime=0x1d4d150, ftLastWriteTime.dwLowDateTime=0x14e13f0, ftLastWriteTime.dwHighDateTime=0x1d4d150, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0238.281] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x666c5160, ftCreationTime.dwHighDateTime=0x1d4c96d, ftLastAccessTime.dwLowDateTime=0x14e13f0, ftLastAccessTime.dwHighDateTime=0x1d4d150, ftLastWriteTime.dwLowDateTime=0x14e13f0, ftLastWriteTime.dwHighDateTime=0x1d4d150, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.281] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfca340, ftCreationTime.dwHighDateTime=0x1d4cfc9, ftLastAccessTime.dwLowDateTime=0xbd575910, ftLastAccessTime.dwHighDateTime=0x1d4d3fa, ftLastWriteTime.dwLowDateTime=0xbd575910, ftLastWriteTime.dwHighDateTime=0x1d4d3fa, nFileSizeHigh=0x0, nFileSizeLow=0xa555, dwReserved0=0x7a, dwReserved1=0x0, cFileName="alhB3.jpg", cAlternateFileName="")) returned 1 [0238.281] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\SO5Gg xGozv6CUDTj4U\\alhB3.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zylw8gkkgwn\\so5gg xgozv6cudtj4u\\alhb3.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0238.281] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\SO5Gg xGozv6CUDTj4U\\alhB3.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zylw8gkkgwn\\so5gg xgozv6cudtj4u\\alhb3.jpg.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0238.282] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa555 [0238.282] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0238.282] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0238.374] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa555, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0xa555, lpOverlapped=0x0) returned 1 [0238.375] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa560, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0xa560, lpOverlapped=0x0) returned 1 [0238.381] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0238.403] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0238.414] CloseHandle (hObject=0xd8) returned 1 [0238.414] CloseHandle (hObject=0xec) returned 1 [0238.414] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\SO5Gg xGozv6CUDTj4U\\alhB3.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zylw8gkkgwn\\so5gg xgozv6cudtj4u\\alhb3.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\SO5Gg xGozv6CUDTj4U\\alhB3.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zylw8gkkgwn\\so5gg xgozv6cudtj4u\\alhb3.jpg.dvodltmf")) returned 0 [0238.415] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\SO5Gg xGozv6CUDTj4U\\alhB3.jpg.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zylw8gkkgwn\\so5gg xgozv6cudtj4u\\alhb3.jpg.dvodltmf")) returned 0x20 [0238.415] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\SO5Gg xGozv6CUDTj4U\\alhB3.jpg", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfca340, ftCreationTime.dwHighDateTime=0x1d4cfc9, ftLastAccessTime.dwLowDateTime=0xbd575910, ftLastAccessTime.dwHighDateTime=0x1d4d3fa, ftLastWriteTime.dwLowDateTime=0xbd575910, ftLastWriteTime.dwHighDateTime=0x1d4d3fa, nFileSizeHigh=0x0, nFileSizeLow=0xa555, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="alhB3.jpg", cAlternateFileName="")) returned 0x2e84d8 [0238.415] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfca340, ftCreationTime.dwHighDateTime=0x1d4cfc9, ftLastAccessTime.dwLowDateTime=0xbd575910, ftLastAccessTime.dwHighDateTime=0x1d4d3fa, ftLastWriteTime.dwLowDateTime=0xbd575910, ftLastWriteTime.dwHighDateTime=0x1d4d3fa, nFileSizeHigh=0x0, nFileSizeLow=0xa555, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="alhB3.jpg", cAlternateFileName="")) returned 0 [0238.415] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0238.415] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\SO5Gg xGozv6CUDTj4U\\alhB3.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zylw8gkkgwn\\so5gg xgozv6cudtj4u\\alhb3.jpg")) returned 1 [0238.417] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zyLW8gkkgWn\\SO5Gg xGozv6CUDTj4U\\alhB3.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zylw8gkkgwn\\so5gg xgozv6cudtj4u\\alhb3.jpg")) returned 0xffffffff [0238.417] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfca340, ftCreationTime.dwHighDateTime=0x1d4cfc9, ftLastAccessTime.dwLowDateTime=0xbd575910, ftLastAccessTime.dwHighDateTime=0x1d4d3fa, ftLastWriteTime.dwLowDateTime=0xbd575910, ftLastWriteTime.dwHighDateTime=0x1d4d3fa, nFileSizeHigh=0x0, nFileSizeLow=0xa555, dwReserved0=0x7a, dwReserved1=0x0, cFileName="alhB3.jpg", cAlternateFileName="")) returned 0 [0238.417] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0238.417] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x666c5160, ftCreationTime.dwHighDateTime=0x1d4c96d, ftLastAccessTime.dwLowDateTime=0x14e13f0, ftLastAccessTime.dwHighDateTime=0x1d4d150, ftLastWriteTime.dwLowDateTime=0x14e13f0, ftLastWriteTime.dwHighDateTime=0x1d4d150, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="SO5Gg xGozv6CUDTj4U", cAlternateFileName="SO5GGX~1")) returned 0 [0238.417] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0238.417] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9b97700, ftCreationTime.dwHighDateTime=0x1d4cd31, ftLastAccessTime.dwLowDateTime=0x5d5dc620, ftLastAccessTime.dwHighDateTime=0x1d4c635, ftLastWriteTime.dwLowDateTime=0x5d5dc620, ftLastWriteTime.dwHighDateTime=0x1d4c635, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d6770, dwReserved1=0x18f524, cFileName="zyLW8gkkgWn", cAlternateFileName="ZYLW8G~1")) returned 0 [0238.417] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0238.417] FindNextFileA (in: hFindFile=0x2dab90, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2d5f734a, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0238.417] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9b97700, ftCreationTime.dwHighDateTime=0x1d4cd31, ftLastAccessTime.dwLowDateTime=0x5d5dc620, ftLastAccessTime.dwHighDateTime=0x1d4c635, ftLastWriteTime.dwLowDateTime=0x5d5dc620, ftLastWriteTime.dwHighDateTime=0x1d4c635, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d6770, dwReserved1=0x18f524, cFileName="zyLW8gkkgWn", cAlternateFileName="\x90«-")) returned 0xffffffff [0238.417] FindNextFileA (in: hFindFile=0x2dab90, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2d5f734a, cFileName="Recent", cAlternateFileName="")) returned 1 [0238.417] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9b97700, ftCreationTime.dwHighDateTime=0x1d4cd31, ftLastAccessTime.dwLowDateTime=0x5d5dc620, ftLastAccessTime.dwHighDateTime=0x1d4c635, ftLastWriteTime.dwLowDateTime=0x5d5dc620, ftLastWriteTime.dwHighDateTime=0x1d4c635, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d6770, dwReserved1=0x18f524, cFileName="zyLW8gkkgWn", cAlternateFileName="\x90«-")) returned 0xffffffff [0238.417] FindNextFileA (in: hFindFile=0x2dab90, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2d5f734a, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0238.417] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44554336, dwReserved1=0x55346a54, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0238.418] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44554336, dwReserved1=0x55346a54, cFileName="..", cAlternateFileName="")) returned 1 [0238.418] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x44554336, dwReserved1=0x55346a54, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0238.418] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0238.418] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd0 [0238.419] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11a [0238.419] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0238.419] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0238.513] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x11a, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x11a, lpOverlapped=0x0) returned 1 [0238.514] WriteFile (in: hFile=0xd0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x120, lpOverlapped=0x0) returned 1 [0238.515] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0238.539] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0238.551] CloseHandle (hObject=0xe8) returned 1 [0238.551] CloseHandle (hObject=0xd0) returned 1 [0238.551] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\desktop.ini.dvodltmf")) returned 0 [0238.552] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\desktop.ini.dvodltmf")) returned 0x20 [0238.552] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8458 [0238.552] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0238.553] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0238.553] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\desktop.ini")) returned 1 [0238.553] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\desktop.ini")) returned 0xffffffff [0238.554] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x44554336, dwReserved1=0x55346a54, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0238.554] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0238.554] FindNextFileA (in: hFindFile=0x2dab90, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2d5f734a, cFileName="Searches", cAlternateFileName="")) returned 1 [0238.554] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0238.554] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="..", cAlternateFileName="")) returned 1 [0238.554] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0238.554] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd0 [0238.554] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0238.555] GetFileSize (in: hFile=0xd0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x20c [0238.555] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0238.555] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0238.649] ReadFile (in: hFile=0xd0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x20c, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x20c, lpOverlapped=0x0) returned 1 [0238.650] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x210, lpOverlapped=0x0) returned 1 [0238.651] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0238.675] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0238.686] CloseHandle (hObject=0xd0) returned 1 [0238.686] CloseHandle (hObject=0xe8) returned 1 [0238.686] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\desktop.ini.dvodltmf")) returned 0 [0238.687] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\desktop.ini.dvodltmf")) returned 0x20 [0238.687] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8458 [0238.688] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0238.688] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0238.688] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\desktop.ini")) returned 1 [0238.689] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\desktop.ini")) returned 0xffffffff [0238.689] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0238.689] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\everywhere.search-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0238.689] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\everywhere.search-ms.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd0 [0238.690] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf8 [0238.690] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0238.690] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0238.822] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xf8, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0xf8, lpOverlapped=0x0) returned 1 [0238.823] WriteFile (in: hFile=0xd0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x100, lpOverlapped=0x0) returned 1 [0238.824] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0238.847] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0238.858] CloseHandle (hObject=0xe8) returned 1 [0238.858] CloseHandle (hObject=0xd0) returned 1 [0238.858] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\everywhere.search-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\everywhere.search-ms.dvodltmf")) returned 0 [0238.859] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\everywhere.search-ms.dvodltmf")) returned 0x20 [0238.859] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 0x2e8458 [0238.860] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 0 [0238.860] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0238.860] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\everywhere.search-ms")) returned 0 [0238.860] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\everywhere.search-ms")) returned 0x23 [0238.860] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0238.860] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\indexed locations.search-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd0 [0238.860] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Indexed Locations.search-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\indexed locations.search-ms.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0238.861] GetFileSize (in: hFile=0xd0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf8 [0238.861] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0238.862] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0238.951] ReadFile (in: hFile=0xd0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xf8, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0xf8, lpOverlapped=0x0) returned 1 [0238.952] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x100, lpOverlapped=0x0) returned 1 [0238.953] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0238.976] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0238.988] CloseHandle (hObject=0xd0) returned 1 [0238.988] CloseHandle (hObject=0xe8) returned 1 [0238.988] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\indexed locations.search-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Indexed Locations.search-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\indexed locations.search-ms.dvodltmf")) returned 0 [0238.989] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Indexed Locations.search-ms.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\indexed locations.search-ms.dvodltmf")) returned 0x20 [0238.989] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Indexed Locations.search-ms", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0x2e8458 [0238.989] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0 [0238.989] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0238.990] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\indexed locations.search-ms")) returned 0 [0238.990] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\indexed locations.search-ms")) returned 0x23 [0238.990] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0 [0238.990] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0238.990] FindNextFileA (in: hFindFile=0x2dab90, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x732e736e, cFileName="SendTo", cAlternateFileName="")) returned 1 [0238.990] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="\x90«-")) returned 0xffffffff [0238.990] FindNextFileA (in: hFindFile=0x2dab90, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x732e736e, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0238.990] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="\x90«-")) returned 0xffffffff [0238.990] FindNextFileA (in: hFindFile=0x2dab90, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x732e736e, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0238.990] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="\x90«-")) returned 0xffffffff [0238.990] FindNextFileA (in: hFindFile=0x2dab90, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x728ce9a0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x728ce9a0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x732e736e, cFileName="Videos", cAlternateFileName="")) returned 1 [0238.990] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x728ce9a0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x728ce9a0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0238.991] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x728ce9a0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x728ce9a0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="..", cAlternateFileName="")) returned 1 [0238.991] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d260ac0, ftCreationTime.dwHighDateTime=0x1d4cd55, ftLastAccessTime.dwLowDateTime=0x9f8be2c0, ftLastAccessTime.dwHighDateTime=0x1d4c76b, ftLastWriteTime.dwLowDateTime=0x9f8be2c0, ftLastWriteTime.dwHighDateTime=0x1d4c76b, nFileSizeHigh=0x0, nFileSizeLow=0x1197d, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="-s68PmzrfV775c.swf", cAlternateFileName="-S68PM~1.SWF")) returned 1 [0238.991] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\-s68PmzrfV775c.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\-s68pmzrfv775c.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0238.991] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\-s68PmzrfV775c.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\-s68pmzrfv775c.swf.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd0 [0238.992] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1197d [0238.992] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0238.992] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0239.084] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1197d, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x1197d, lpOverlapped=0x0) returned 1 [0239.085] WriteFile (in: hFile=0xd0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x11980, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x11980, lpOverlapped=0x0) returned 1 [0239.087] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0239.111] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0239.122] CloseHandle (hObject=0xe8) returned 1 [0239.122] CloseHandle (hObject=0xd0) returned 1 [0239.123] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\-s68PmzrfV775c.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\-s68pmzrfv775c.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\-s68PmzrfV775c.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\-s68pmzrfv775c.swf.dvodltmf")) returned 0 [0239.124] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\-s68PmzrfV775c.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\-s68pmzrfv775c.swf.dvodltmf")) returned 0x20 [0239.124] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\-s68PmzrfV775c.swf", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d260ac0, ftCreationTime.dwHighDateTime=0x1d4cd55, ftLastAccessTime.dwLowDateTime=0x9f8be2c0, ftLastAccessTime.dwHighDateTime=0x1d4c76b, ftLastWriteTime.dwLowDateTime=0x9f8be2c0, ftLastWriteTime.dwHighDateTime=0x1d4c76b, nFileSizeHigh=0x0, nFileSizeLow=0x1197d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="-s68PmzrfV775c.swf", cAlternateFileName="-S68PM~1.SWF")) returned 0x2e8458 [0239.124] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d260ac0, ftCreationTime.dwHighDateTime=0x1d4cd55, ftLastAccessTime.dwLowDateTime=0x9f8be2c0, ftLastAccessTime.dwHighDateTime=0x1d4c76b, ftLastWriteTime.dwLowDateTime=0x9f8be2c0, ftLastWriteTime.dwHighDateTime=0x1d4c76b, nFileSizeHigh=0x0, nFileSizeLow=0x1197d, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="-s68PmzrfV775c.swf", cAlternateFileName="-S68PM~1.SWF")) returned 0 [0239.124] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0239.124] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\-s68PmzrfV775c.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\-s68pmzrfv775c.swf")) returned 1 [0239.125] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\-s68PmzrfV775c.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\-s68pmzrfv775c.swf")) returned 0xffffffff [0239.125] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6cf6c20, ftCreationTime.dwHighDateTime=0x1d4c7af, ftLastAccessTime.dwLowDateTime=0x68611940, ftLastAccessTime.dwHighDateTime=0x1d4d3f1, ftLastWriteTime.dwLowDateTime=0x68611940, ftLastWriteTime.dwHighDateTime=0x1d4d3f1, nFileSizeHigh=0x0, nFileSizeLow=0x2103, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="30Xz.swf", cAlternateFileName="")) returned 1 [0239.126] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\30Xz.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\30xz.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd0 [0239.126] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\30Xz.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\30xz.swf.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0239.126] GetFileSize (in: hFile=0xd0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2103 [0239.126] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0239.127] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0239.216] ReadFile (in: hFile=0xd0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2103, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x2103, lpOverlapped=0x0) returned 1 [0239.217] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2110, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x2110, lpOverlapped=0x0) returned 1 [0239.218] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0239.242] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0239.253] CloseHandle (hObject=0xd0) returned 1 [0239.253] CloseHandle (hObject=0xe8) returned 1 [0239.253] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\30Xz.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\30xz.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\30Xz.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\30xz.swf.dvodltmf")) returned 0 [0239.254] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\30Xz.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\30xz.swf.dvodltmf")) returned 0x20 [0239.254] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\30Xz.swf", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6cf6c20, ftCreationTime.dwHighDateTime=0x1d4c7af, ftLastAccessTime.dwLowDateTime=0x68611940, ftLastAccessTime.dwHighDateTime=0x1d4d3f1, ftLastWriteTime.dwLowDateTime=0x68611940, ftLastWriteTime.dwHighDateTime=0x1d4d3f1, nFileSizeHigh=0x0, nFileSizeLow=0x2103, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="30Xz.swf", cAlternateFileName="")) returned 0x2e8458 [0239.255] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6cf6c20, ftCreationTime.dwHighDateTime=0x1d4c7af, ftLastAccessTime.dwLowDateTime=0x68611940, ftLastAccessTime.dwHighDateTime=0x1d4d3f1, ftLastWriteTime.dwLowDateTime=0x68611940, ftLastWriteTime.dwHighDateTime=0x1d4d3f1, nFileSizeHigh=0x0, nFileSizeLow=0x2103, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="30Xz.swf", cAlternateFileName="")) returned 0 [0239.255] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0239.255] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\30Xz.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\30xz.swf")) returned 1 [0239.256] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\30Xz.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\30xz.swf")) returned 0xffffffff [0239.256] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0239.256] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0239.256] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\desktop.ini.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd0 [0239.257] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f8 [0239.257] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0239.257] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0239.348] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1f8, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x1f8, lpOverlapped=0x0) returned 1 [0239.348] WriteFile (in: hFile=0xd0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x200, lpOverlapped=0x0) returned 1 [0239.349] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0239.420] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0239.431] CloseHandle (hObject=0xe8) returned 1 [0239.431] CloseHandle (hObject=0xd0) returned 1 [0239.431] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\desktop.ini.dvodltmf")) returned 0 [0239.432] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\desktop.ini.dvodltmf")) returned 0x20 [0239.433] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0x2e8458 [0239.433] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0239.433] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0239.433] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\desktop.ini")) returned 1 [0239.434] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\desktop.ini")) returned 0xffffffff [0239.434] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7ff3730, ftCreationTime.dwHighDateTime=0x1d4c754, ftLastAccessTime.dwLowDateTime=0x35fc3d00, ftLastAccessTime.dwHighDateTime=0x1d4cb12, ftLastWriteTime.dwLowDateTime=0x35fc3d00, ftLastWriteTime.dwHighDateTime=0x1d4cb12, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="z3blHvjoX1", cAlternateFileName="Z3BLHV~1")) returned 1 [0239.434] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7ff3730, ftCreationTime.dwHighDateTime=0x1d4c754, ftLastAccessTime.dwLowDateTime=0x35fc3d00, ftLastAccessTime.dwHighDateTime=0x1d4cb12, ftLastWriteTime.dwLowDateTime=0x35fc3d00, ftLastWriteTime.dwHighDateTime=0x1d4cb12, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x60, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0239.434] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7ff3730, ftCreationTime.dwHighDateTime=0x1d4c754, ftLastAccessTime.dwLowDateTime=0x35fc3d00, ftLastAccessTime.dwHighDateTime=0x1d4cb12, ftLastWriteTime.dwLowDateTime=0x35fc3d00, ftLastWriteTime.dwHighDateTime=0x1d4cb12, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x60, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.434] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd7bfe00, ftCreationTime.dwHighDateTime=0x1d4cf9a, ftLastAccessTime.dwLowDateTime=0x40208ea0, ftLastAccessTime.dwHighDateTime=0x1d4d227, ftLastWriteTime.dwLowDateTime=0x40208ea0, ftLastWriteTime.dwHighDateTime=0x1d4d227, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x60, dwReserved1=0x0, cFileName="-x mXlGCowEqZikIAM", cAlternateFileName="-XMXLG~1")) returned 1 [0239.434] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd7bfe00, ftCreationTime.dwHighDateTime=0x1d4cf9a, ftLastAccessTime.dwLowDateTime=0x40208ea0, ftLastAccessTime.dwHighDateTime=0x1d4d227, ftLastWriteTime.dwLowDateTime=0x40208ea0, ftLastWriteTime.dwHighDateTime=0x1d4d227, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0063, dwReserved1=0x770073, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0239.434] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd7bfe00, ftCreationTime.dwHighDateTime=0x1d4cf9a, ftLastAccessTime.dwLowDateTime=0x40208ea0, ftLastAccessTime.dwHighDateTime=0x1d4d227, ftLastWriteTime.dwLowDateTime=0x40208ea0, ftLastWriteTime.dwHighDateTime=0x1d4d227, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0063, dwReserved1=0x770073, cFileName="..", cAlternateFileName="")) returned 1 [0239.434] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd59de00, ftCreationTime.dwHighDateTime=0x1d4cf00, ftLastAccessTime.dwLowDateTime=0xec312d10, ftLastAccessTime.dwHighDateTime=0x1d4c6d0, ftLastWriteTime.dwLowDateTime=0xec312d10, ftLastWriteTime.dwHighDateTime=0x1d4c6d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0063, dwReserved1=0x770073, cFileName="8LcN6A2xkeU9B04", cAlternateFileName="8LCN6A~1")) returned 1 [0239.434] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\8LcN6A2xkeU9B04\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd59de00, ftCreationTime.dwHighDateTime=0x1d4cf00, ftLastAccessTime.dwLowDateTime=0xec312d10, ftLastAccessTime.dwHighDateTime=0x1d4c6d0, ftLastWriteTime.dwLowDateTime=0xec312d10, ftLastWriteTime.dwHighDateTime=0x1d4c6d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0239.435] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd59de00, ftCreationTime.dwHighDateTime=0x1d4cf00, ftLastAccessTime.dwLowDateTime=0xec312d10, ftLastAccessTime.dwHighDateTime=0x1d4c6d0, ftLastWriteTime.dwLowDateTime=0xec312d10, ftLastWriteTime.dwHighDateTime=0x1d4c6d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.435] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1b69fd0, ftCreationTime.dwHighDateTime=0x1d4c85a, ftLastAccessTime.dwLowDateTime=0xdc836f70, ftLastAccessTime.dwHighDateTime=0x1d4c7e0, ftLastWriteTime.dwLowDateTime=0xdc836f70, ftLastWriteTime.dwHighDateTime=0x1d4c7e0, nFileSizeHigh=0x0, nFileSizeLow=0x16b3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="qaKFTKFT.mkv", cAlternateFileName="")) returned 1 [0239.435] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\8LcN6A2xkeU9B04\\qaKFTKFT.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\8lcn6a2xkeu9b04\\qakftkft.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0239.435] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\8LcN6A2xkeU9B04\\qaKFTKFT.mkv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\8lcn6a2xkeu9b04\\qakftkft.mkv.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0239.436] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16b3a [0239.436] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0239.436] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0239.527] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x16b3a, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x16b3a, lpOverlapped=0x0) returned 1 [0239.529] WriteFile (in: hFile=0xd4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x16b40, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x16b40, lpOverlapped=0x0) returned 1 [0239.531] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0239.555] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0239.566] CloseHandle (hObject=0xd8) returned 1 [0239.566] CloseHandle (hObject=0xd4) returned 1 [0239.566] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\8LcN6A2xkeU9B04\\qaKFTKFT.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\8lcn6a2xkeu9b04\\qakftkft.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\8LcN6A2xkeU9B04\\qaKFTKFT.mkv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\8lcn6a2xkeu9b04\\qakftkft.mkv.dvodltmf")) returned 0 [0239.567] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\8LcN6A2xkeU9B04\\qaKFTKFT.mkv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\8lcn6a2xkeu9b04\\qakftkft.mkv.dvodltmf")) returned 0x20 [0239.567] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\8LcN6A2xkeU9B04\\qaKFTKFT.mkv", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1b69fd0, ftCreationTime.dwHighDateTime=0x1d4c85a, ftLastAccessTime.dwLowDateTime=0xdc836f70, ftLastAccessTime.dwHighDateTime=0x1d4c7e0, ftLastWriteTime.dwLowDateTime=0xdc836f70, ftLastWriteTime.dwHighDateTime=0x1d4c7e0, nFileSizeHigh=0x0, nFileSizeLow=0x16b3a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="qaKFTKFT.mkv", cAlternateFileName="")) returned 0x2e8518 [0239.568] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1b69fd0, ftCreationTime.dwHighDateTime=0x1d4c85a, ftLastAccessTime.dwLowDateTime=0xdc836f70, ftLastAccessTime.dwHighDateTime=0x1d4c7e0, ftLastWriteTime.dwLowDateTime=0xdc836f70, ftLastWriteTime.dwHighDateTime=0x1d4c7e0, nFileSizeHigh=0x0, nFileSizeLow=0x16b3a, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="qaKFTKFT.mkv", cAlternateFileName="")) returned 0 [0239.568] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0239.568] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\8LcN6A2xkeU9B04\\qaKFTKFT.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\8lcn6a2xkeu9b04\\qakftkft.mkv")) returned 1 [0239.570] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\8LcN6A2xkeU9B04\\qaKFTKFT.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\8lcn6a2xkeu9b04\\qakftkft.mkv")) returned 0xffffffff [0239.570] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1b69fd0, ftCreationTime.dwHighDateTime=0x1d4c85a, ftLastAccessTime.dwLowDateTime=0xdc836f70, ftLastAccessTime.dwHighDateTime=0x1d4c7e0, ftLastWriteTime.dwLowDateTime=0xdc836f70, ftLastWriteTime.dwHighDateTime=0x1d4c7e0, nFileSizeHigh=0x0, nFileSizeLow=0x16b3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="qaKFTKFT.mkv", cAlternateFileName="")) returned 0 [0239.570] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0239.570] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdf6fec0, ftCreationTime.dwHighDateTime=0x1d4d536, ftLastAccessTime.dwLowDateTime=0xbd813870, ftLastAccessTime.dwHighDateTime=0x1d4d51c, ftLastWriteTime.dwLowDateTime=0xbd813870, ftLastWriteTime.dwHighDateTime=0x1d4d51c, nFileSizeHigh=0x0, nFileSizeLow=0xf232, dwReserved0=0x2e0076, dwReserved1=0x770073, cFileName="jZzYLcMb7tKC5JZmB.mp4", cAlternateFileName="JZZYLC~1.MP4")) returned 1 [0239.570] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\jZzYLcMb7tKC5JZmB.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\jzzylcmb7tkc5jzmb.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0239.570] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\jZzYLcMb7tKC5JZmB.mp4.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\jzzylcmb7tkc5jzmb.mp4.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0239.571] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf232 [0239.571] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0239.571] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0239.664] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xf232, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0xf232, lpOverlapped=0x0) returned 1 [0239.665] WriteFile (in: hFile=0xd4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf240, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0xf240, lpOverlapped=0x0) returned 1 [0239.667] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0239.690] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0239.702] CloseHandle (hObject=0xec) returned 1 [0239.702] CloseHandle (hObject=0xd4) returned 1 [0239.702] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\jZzYLcMb7tKC5JZmB.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\jzzylcmb7tkc5jzmb.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\jZzYLcMb7tKC5JZmB.mp4.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\jzzylcmb7tkc5jzmb.mp4.dvodltmf")) returned 0 [0239.703] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\jZzYLcMb7tKC5JZmB.mp4.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\jzzylcmb7tkc5jzmb.mp4.dvodltmf")) returned 0x20 [0239.703] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\jZzYLcMb7tKC5JZmB.mp4", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdf6fec0, ftCreationTime.dwHighDateTime=0x1d4d536, ftLastAccessTime.dwLowDateTime=0xbd813870, ftLastAccessTime.dwHighDateTime=0x1d4d51c, ftLastWriteTime.dwLowDateTime=0xbd813870, ftLastWriteTime.dwHighDateTime=0x1d4d51c, nFileSizeHigh=0x0, nFileSizeLow=0xf232, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="jZzYLcMb7tKC5JZmB.mp4", cAlternateFileName="JZZYLC~1.MP4")) returned 0x2e84d8 [0239.703] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdf6fec0, ftCreationTime.dwHighDateTime=0x1d4d536, ftLastAccessTime.dwLowDateTime=0xbd813870, ftLastAccessTime.dwHighDateTime=0x1d4d51c, ftLastWriteTime.dwLowDateTime=0xbd813870, ftLastWriteTime.dwHighDateTime=0x1d4d51c, nFileSizeHigh=0x0, nFileSizeLow=0xf232, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="jZzYLcMb7tKC5JZmB.mp4", cAlternateFileName="JZZYLC~1.MP4")) returned 0 [0239.703] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0239.703] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\jZzYLcMb7tKC5JZmB.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\jzzylcmb7tkc5jzmb.mp4")) returned 1 [0239.705] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\jZzYLcMb7tKC5JZmB.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\jzzylcmb7tkc5jzmb.mp4")) returned 0xffffffff [0239.705] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fd20ca0, ftCreationTime.dwHighDateTime=0x1d4d23e, ftLastAccessTime.dwLowDateTime=0x1bc73c90, ftLastAccessTime.dwHighDateTime=0x1d4d30b, ftLastWriteTime.dwLowDateTime=0x1bc73c90, ftLastWriteTime.dwHighDateTime=0x1d4d30b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f054, cFileName="l1LjkHRO25HgVAKEXl", cAlternateFileName="L1LJKH~1")) returned 1 [0239.705] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fd20ca0, ftCreationTime.dwHighDateTime=0x1d4d23e, ftLastAccessTime.dwLowDateTime=0x1bc73c90, ftLastAccessTime.dwHighDateTime=0x1d4d30b, ftLastWriteTime.dwLowDateTime=0x1bc73c90, ftLastWriteTime.dwHighDateTime=0x1d4d30b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0239.705] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fd20ca0, ftCreationTime.dwHighDateTime=0x1d4d23e, ftLastAccessTime.dwLowDateTime=0x1bc73c90, ftLastAccessTime.dwHighDateTime=0x1d4d30b, ftLastWriteTime.dwLowDateTime=0x1bc73c90, ftLastWriteTime.dwHighDateTime=0x1d4d30b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.705] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3636e40, ftCreationTime.dwHighDateTime=0x1d4c53a, ftLastAccessTime.dwLowDateTime=0xda90110, ftLastAccessTime.dwHighDateTime=0x1d4d285, ftLastWriteTime.dwLowDateTime=0xda90110, ftLastWriteTime.dwHighDateTime=0x1d4d285, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb0, dwReserved1=0x0, cFileName="ihS5FJ", cAlternateFileName="")) returned 1 [0239.705] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\ihS5FJ\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3636e40, ftCreationTime.dwHighDateTime=0x1d4c53a, ftLastAccessTime.dwLowDateTime=0xda90110, ftLastAccessTime.dwHighDateTime=0x1d4d285, ftLastWriteTime.dwLowDateTime=0xda90110, ftLastWriteTime.dwHighDateTime=0x1d4d285, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a004a, dwReserved1=0x42006d, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0239.705] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3636e40, ftCreationTime.dwHighDateTime=0x1d4c53a, ftLastAccessTime.dwLowDateTime=0xda90110, ftLastAccessTime.dwHighDateTime=0x1d4d285, ftLastWriteTime.dwLowDateTime=0xda90110, ftLastWriteTime.dwHighDateTime=0x1d4d285, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a004a, dwReserved1=0x42006d, cFileName="..", cAlternateFileName="")) returned 1 [0239.705] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd38e4ed0, ftCreationTime.dwHighDateTime=0x1d4d1bd, ftLastAccessTime.dwLowDateTime=0x16e40090, ftLastAccessTime.dwHighDateTime=0x1d4c835, ftLastWriteTime.dwLowDateTime=0x16e40090, ftLastWriteTime.dwHighDateTime=0x1d4c835, nFileSizeHigh=0x0, nFileSizeLow=0x16c3c, dwReserved0=0x5a004a, dwReserved1=0x42006d, cFileName="FyoM cvLz.mp4", cAlternateFileName="FYOMCV~1.MP4")) returned 1 [0239.705] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\ihS5FJ\\FyoM cvLz.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\ihs5fj\\fyom cvlz.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0239.705] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\ihS5FJ\\FyoM cvLz.mp4.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\ihs5fj\\fyom cvlz.mp4.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0239.706] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16c3c [0239.706] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0239.706] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0239.796] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x16c3c, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x16c3c, lpOverlapped=0x0) returned 1 [0239.798] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x16c40, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x16c40, lpOverlapped=0x0) returned 1 [0239.800] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0239.823] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0239.842] CloseHandle (hObject=0xd8) returned 1 [0239.842] CloseHandle (hObject=0xe0) returned 1 [0239.842] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\ihS5FJ\\FyoM cvLz.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\ihs5fj\\fyom cvlz.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\ihS5FJ\\FyoM cvLz.mp4.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\ihs5fj\\fyom cvlz.mp4.dvodltmf")) returned 0 [0239.843] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\ihS5FJ\\FyoM cvLz.mp4.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\ihs5fj\\fyom cvlz.mp4.dvodltmf")) returned 0x20 [0239.843] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\ihS5FJ\\FyoM cvLz.mp4", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd38e4ed0, ftCreationTime.dwHighDateTime=0x1d4d1bd, ftLastAccessTime.dwLowDateTime=0x16e40090, ftLastAccessTime.dwHighDateTime=0x1d4c835, ftLastWriteTime.dwLowDateTime=0x16e40090, ftLastWriteTime.dwHighDateTime=0x1d4c835, nFileSizeHigh=0x0, nFileSizeLow=0x16c3c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="FyoM cvLz.mp4", cAlternateFileName="FYOMCV~1.MP4")) returned 0x2e8558 [0239.844] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd38e4ed0, ftCreationTime.dwHighDateTime=0x1d4d1bd, ftLastAccessTime.dwLowDateTime=0x16e40090, ftLastAccessTime.dwHighDateTime=0x1d4c835, ftLastWriteTime.dwLowDateTime=0x16e40090, ftLastWriteTime.dwHighDateTime=0x1d4c835, nFileSizeHigh=0x0, nFileSizeLow=0x16c3c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="FyoM cvLz.mp4", cAlternateFileName="FYOMCV~1.MP4")) returned 0 [0239.844] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0239.844] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\ihS5FJ\\FyoM cvLz.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\ihs5fj\\fyom cvlz.mp4")) returned 1 [0239.845] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\ihS5FJ\\FyoM cvLz.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\ihs5fj\\fyom cvlz.mp4")) returned 0xffffffff [0239.845] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a5b360, ftCreationTime.dwHighDateTime=0x1d4d5a1, ftLastAccessTime.dwLowDateTime=0x7ca333e0, ftLastAccessTime.dwHighDateTime=0x1d4c8a0, ftLastWriteTime.dwLowDateTime=0x7ca333e0, ftLastWriteTime.dwHighDateTime=0x1d4c8a0, nFileSizeHigh=0x0, nFileSizeLow=0xf286, dwReserved0=0x2dbbd0, dwReserved1=0x18eb84, cFileName="m6AiZsr7jG.swf", cAlternateFileName="M6AIZS~1.SWF")) returned 1 [0239.845] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\ihS5FJ\\m6AiZsr7jG.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\ihs5fj\\m6aizsr7jg.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0239.846] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\ihS5FJ\\m6AiZsr7jG.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\ihs5fj\\m6aizsr7jg.swf.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0239.846] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf286 [0239.846] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0239.847] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0239.938] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xf286, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xf286, lpOverlapped=0x0) returned 1 [0239.940] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf290, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xf290, lpOverlapped=0x0) returned 1 [0239.942] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0239.965] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0239.982] CloseHandle (hObject=0xe0) returned 1 [0239.983] CloseHandle (hObject=0xd8) returned 1 [0239.984] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\ihS5FJ\\m6AiZsr7jG.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\ihs5fj\\m6aizsr7jg.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\ihS5FJ\\m6AiZsr7jG.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\ihs5fj\\m6aizsr7jg.swf.dvodltmf")) returned 0 [0239.986] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\ihS5FJ\\m6AiZsr7jG.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\ihs5fj\\m6aizsr7jg.swf.dvodltmf")) returned 0x20 [0239.986] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\ihS5FJ\\m6AiZsr7jG.swf", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a5b360, ftCreationTime.dwHighDateTime=0x1d4d5a1, ftLastAccessTime.dwLowDateTime=0x7ca333e0, ftLastAccessTime.dwHighDateTime=0x1d4c8a0, ftLastWriteTime.dwLowDateTime=0x7ca333e0, ftLastWriteTime.dwHighDateTime=0x1d4c8a0, nFileSizeHigh=0x0, nFileSizeLow=0xf286, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="m6AiZsr7jG.swf", cAlternateFileName="M6AIZS~1.SWF")) returned 0x2e8558 [0239.987] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a5b360, ftCreationTime.dwHighDateTime=0x1d4d5a1, ftLastAccessTime.dwLowDateTime=0x7ca333e0, ftLastAccessTime.dwHighDateTime=0x1d4c8a0, ftLastWriteTime.dwLowDateTime=0x7ca333e0, ftLastWriteTime.dwHighDateTime=0x1d4c8a0, nFileSizeHigh=0x0, nFileSizeLow=0xf286, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="m6AiZsr7jG.swf", cAlternateFileName="M6AIZS~1.SWF")) returned 0 [0239.987] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0239.987] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\ihS5FJ\\m6AiZsr7jG.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\ihs5fj\\m6aizsr7jg.swf")) returned 1 [0239.989] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\ihS5FJ\\m6AiZsr7jG.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\ihs5fj\\m6aizsr7jg.swf")) returned 0xffffffff [0239.989] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafa2f9c0, ftCreationTime.dwHighDateTime=0x1d4d141, ftLastAccessTime.dwLowDateTime=0xe7cdbd70, ftLastAccessTime.dwHighDateTime=0x1d4c8f5, ftLastWriteTime.dwLowDateTime=0xe7cdbd70, ftLastWriteTime.dwHighDateTime=0x1d4c8f5, nFileSizeHigh=0x0, nFileSizeLow=0xdab, dwReserved0=0x2dbbd0, dwReserved1=0x18eb84, cFileName="MMLt.swf", cAlternateFileName="")) returned 1 [0239.989] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\ihS5FJ\\MMLt.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\ihs5fj\\mmlt.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0239.989] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\ihS5FJ\\MMLt.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\ihs5fj\\mmlt.swf.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0239.991] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdab [0239.991] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0239.991] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0240.087] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xdab, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xdab, lpOverlapped=0x0) returned 1 [0240.088] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xdb0, lpOverlapped=0x0) returned 1 [0240.089] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0240.114] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0240.125] CloseHandle (hObject=0xd8) returned 1 [0240.125] CloseHandle (hObject=0xe0) returned 1 [0240.125] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\ihS5FJ\\MMLt.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\ihs5fj\\mmlt.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\ihS5FJ\\MMLt.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\ihs5fj\\mmlt.swf.dvodltmf")) returned 0 [0240.126] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\ihS5FJ\\MMLt.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\ihs5fj\\mmlt.swf.dvodltmf")) returned 0x20 [0240.126] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\ihS5FJ\\MMLt.swf", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafa2f9c0, ftCreationTime.dwHighDateTime=0x1d4d141, ftLastAccessTime.dwLowDateTime=0xe7cdbd70, ftLastAccessTime.dwHighDateTime=0x1d4c8f5, ftLastWriteTime.dwLowDateTime=0xe7cdbd70, ftLastWriteTime.dwHighDateTime=0x1d4c8f5, nFileSizeHigh=0x0, nFileSizeLow=0xdab, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="MMLt.swf", cAlternateFileName="")) returned 0x2e8558 [0240.127] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafa2f9c0, ftCreationTime.dwHighDateTime=0x1d4d141, ftLastAccessTime.dwLowDateTime=0xe7cdbd70, ftLastAccessTime.dwHighDateTime=0x1d4c8f5, ftLastWriteTime.dwLowDateTime=0xe7cdbd70, ftLastWriteTime.dwHighDateTime=0x1d4c8f5, nFileSizeHigh=0x0, nFileSizeLow=0xdab, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="MMLt.swf", cAlternateFileName="")) returned 0 [0240.127] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0240.127] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\ihS5FJ\\MMLt.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\ihs5fj\\mmlt.swf")) returned 1 [0240.128] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\ihS5FJ\\MMLt.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\ihs5fj\\mmlt.swf")) returned 0xffffffff [0240.128] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb03efe90, ftCreationTime.dwHighDateTime=0x1d4cc52, ftLastAccessTime.dwLowDateTime=0x3ea30630, ftLastAccessTime.dwHighDateTime=0x1d4d2b2, ftLastWriteTime.dwLowDateTime=0x3ea30630, ftLastWriteTime.dwHighDateTime=0x1d4d2b2, nFileSizeHigh=0x0, nFileSizeLow=0x11c15, dwReserved0=0x2dbbd0, dwReserved1=0x18eb84, cFileName="Teuzuh1a.mp4", cAlternateFileName="")) returned 1 [0240.128] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\ihS5FJ\\Teuzuh1a.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\ihs5fj\\teuzuh1a.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0240.128] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\ihS5FJ\\Teuzuh1a.mp4.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\ihs5fj\\teuzuh1a.mp4.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0240.128] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11c15 [0240.128] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0240.129] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0240.219] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x11c15, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x11c15, lpOverlapped=0x0) returned 1 [0240.221] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x11c20, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x11c20, lpOverlapped=0x0) returned 1 [0240.233] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0240.256] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0240.267] CloseHandle (hObject=0xe0) returned 1 [0240.267] CloseHandle (hObject=0xd8) returned 1 [0240.268] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\ihS5FJ\\Teuzuh1a.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\ihs5fj\\teuzuh1a.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\ihS5FJ\\Teuzuh1a.mp4.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\ihs5fj\\teuzuh1a.mp4.dvodltmf")) returned 0 [0240.269] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\ihS5FJ\\Teuzuh1a.mp4.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\ihs5fj\\teuzuh1a.mp4.dvodltmf")) returned 0x20 [0240.269] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\ihS5FJ\\Teuzuh1a.mp4", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb03efe90, ftCreationTime.dwHighDateTime=0x1d4cc52, ftLastAccessTime.dwLowDateTime=0x3ea30630, ftLastAccessTime.dwHighDateTime=0x1d4d2b2, ftLastWriteTime.dwLowDateTime=0x3ea30630, ftLastWriteTime.dwHighDateTime=0x1d4d2b2, nFileSizeHigh=0x0, nFileSizeLow=0x11c15, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Teuzuh1a.mp4", cAlternateFileName="")) returned 0x2e8558 [0240.269] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb03efe90, ftCreationTime.dwHighDateTime=0x1d4cc52, ftLastAccessTime.dwLowDateTime=0x3ea30630, ftLastAccessTime.dwHighDateTime=0x1d4d2b2, ftLastWriteTime.dwLowDateTime=0x3ea30630, ftLastWriteTime.dwHighDateTime=0x1d4d2b2, nFileSizeHigh=0x0, nFileSizeLow=0x11c15, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Teuzuh1a.mp4", cAlternateFileName="")) returned 0 [0240.269] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0240.269] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\ihS5FJ\\Teuzuh1a.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\ihs5fj\\teuzuh1a.mp4")) returned 1 [0240.270] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\ihS5FJ\\Teuzuh1a.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\ihs5fj\\teuzuh1a.mp4")) returned 0xffffffff [0240.270] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb03efe90, ftCreationTime.dwHighDateTime=0x1d4cc52, ftLastAccessTime.dwLowDateTime=0x3ea30630, ftLastAccessTime.dwHighDateTime=0x1d4d2b2, ftLastWriteTime.dwLowDateTime=0x3ea30630, ftLastWriteTime.dwHighDateTime=0x1d4d2b2, nFileSizeHigh=0x0, nFileSizeLow=0x11c15, dwReserved0=0x2dbbd0, dwReserved1=0x18eb84, cFileName="Teuzuh1a.mp4", cAlternateFileName="")) returned 0 [0240.271] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0240.271] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5447d020, ftCreationTime.dwHighDateTime=0x1d4cd2a, ftLastAccessTime.dwLowDateTime=0xd180bb90, ftLastAccessTime.dwHighDateTime=0x1d4cd8b, ftLastWriteTime.dwLowDateTime=0xd180bb90, ftLastWriteTime.dwHighDateTime=0x1d4cd8b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x667734, dwReserved1=0x0, cFileName="sVfTBTyNMNlPOziIoPg", cAlternateFileName="SVFTBT~1")) returned 1 [0240.271] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\sVfTBTyNMNlPOziIoPg\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5447d020, ftCreationTime.dwHighDateTime=0x1d4cd2a, ftLastAccessTime.dwLowDateTime=0xd180bb90, ftLastAccessTime.dwHighDateTime=0x1d4cd8b, ftLastWriteTime.dwLowDateTime=0xd180bb90, ftLastWriteTime.dwHighDateTime=0x1d4cd8b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18eb84, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0240.271] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5447d020, ftCreationTime.dwHighDateTime=0x1d4cd2a, ftLastAccessTime.dwLowDateTime=0xd180bb90, ftLastAccessTime.dwHighDateTime=0x1d4cd8b, ftLastWriteTime.dwLowDateTime=0xd180bb90, ftLastWriteTime.dwHighDateTime=0x1d4cd8b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18eb84, cFileName="..", cAlternateFileName="")) returned 1 [0240.271] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9739eb0, ftCreationTime.dwHighDateTime=0x1d4c67e, ftLastAccessTime.dwLowDateTime=0x387fd50, ftLastAccessTime.dwHighDateTime=0x1d4cd3d, ftLastWriteTime.dwLowDateTime=0x387fd50, ftLastWriteTime.dwHighDateTime=0x1d4cd3d, nFileSizeHigh=0x0, nFileSizeLow=0xbddc, dwReserved0=0x2dbbd0, dwReserved1=0x18eb84, cFileName="flv st3DMyG570.swf", cAlternateFileName="FLVST3~1.SWF")) returned 1 [0240.271] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\sVfTBTyNMNlPOziIoPg\\flv st3DMyG570.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\svftbtynmnlpoziiopg\\flv st3dmyg570.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0240.271] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\sVfTBTyNMNlPOziIoPg\\flv st3DMyG570.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\svftbtynmnlpoziiopg\\flv st3dmyg570.swf.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0240.272] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbddc [0240.272] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0240.272] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0240.410] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xbddc, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xbddc, lpOverlapped=0x0) returned 1 [0240.411] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xbde0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xbde0, lpOverlapped=0x0) returned 1 [0240.413] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0240.436] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0240.447] CloseHandle (hObject=0xd8) returned 1 [0240.447] CloseHandle (hObject=0xe0) returned 1 [0240.447] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\sVfTBTyNMNlPOziIoPg\\flv st3DMyG570.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\svftbtynmnlpoziiopg\\flv st3dmyg570.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\sVfTBTyNMNlPOziIoPg\\flv st3DMyG570.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\svftbtynmnlpoziiopg\\flv st3dmyg570.swf.dvodltmf")) returned 0 [0240.448] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\sVfTBTyNMNlPOziIoPg\\flv st3DMyG570.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\svftbtynmnlpoziiopg\\flv st3dmyg570.swf.dvodltmf")) returned 0x20 [0240.448] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\sVfTBTyNMNlPOziIoPg\\flv st3DMyG570.swf", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9739eb0, ftCreationTime.dwHighDateTime=0x1d4c67e, ftLastAccessTime.dwLowDateTime=0x387fd50, ftLastAccessTime.dwHighDateTime=0x1d4cd3d, ftLastWriteTime.dwLowDateTime=0x387fd50, ftLastWriteTime.dwHighDateTime=0x1d4cd3d, nFileSizeHigh=0x0, nFileSizeLow=0xbddc, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="flv st3DMyG570.swf", cAlternateFileName="FLVST3~1.SWF")) returned 0x2e8558 [0240.449] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9739eb0, ftCreationTime.dwHighDateTime=0x1d4c67e, ftLastAccessTime.dwLowDateTime=0x387fd50, ftLastAccessTime.dwHighDateTime=0x1d4cd3d, ftLastWriteTime.dwLowDateTime=0x387fd50, ftLastWriteTime.dwHighDateTime=0x1d4cd3d, nFileSizeHigh=0x0, nFileSizeLow=0xbddc, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="flv st3DMyG570.swf", cAlternateFileName="FLVST3~1.SWF")) returned 0 [0240.449] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0240.449] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\sVfTBTyNMNlPOziIoPg\\flv st3DMyG570.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\svftbtynmnlpoziiopg\\flv st3dmyg570.swf")) returned 1 [0240.450] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\sVfTBTyNMNlPOziIoPg\\flv st3DMyG570.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\svftbtynmnlpoziiopg\\flv st3dmyg570.swf")) returned 0xffffffff [0240.450] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53bb0ce0, ftCreationTime.dwHighDateTime=0x1d4c96e, ftLastAccessTime.dwLowDateTime=0xa30fff30, ftLastAccessTime.dwHighDateTime=0x1d4c5a4, ftLastWriteTime.dwLowDateTime=0xa30fff30, ftLastWriteTime.dwHighDateTime=0x1d4c5a4, nFileSizeHigh=0x0, nFileSizeLow=0xe28a, dwReserved0=0x2dbbd0, dwReserved1=0x18eb84, cFileName="KguSvtd0LLiS6TzQSZt.flv", cAlternateFileName="KGUSVT~1.FLV")) returned 1 [0240.450] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\sVfTBTyNMNlPOziIoPg\\KguSvtd0LLiS6TzQSZt.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\svftbtynmnlpoziiopg\\kgusvtd0llis6tzqszt.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0240.450] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\sVfTBTyNMNlPOziIoPg\\KguSvtd0LLiS6TzQSZt.flv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\svftbtynmnlpoziiopg\\kgusvtd0llis6tzqszt.flv.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0240.451] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe28a [0240.451] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0240.451] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0240.542] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe28a, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xe28a, lpOverlapped=0x0) returned 1 [0240.543] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe290, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xe290, lpOverlapped=0x0) returned 1 [0240.545] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0240.568] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0240.579] CloseHandle (hObject=0xe0) returned 1 [0240.579] CloseHandle (hObject=0xd8) returned 1 [0240.580] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\sVfTBTyNMNlPOziIoPg\\KguSvtd0LLiS6TzQSZt.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\svftbtynmnlpoziiopg\\kgusvtd0llis6tzqszt.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\sVfTBTyNMNlPOziIoPg\\KguSvtd0LLiS6TzQSZt.flv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\svftbtynmnlpoziiopg\\kgusvtd0llis6tzqszt.flv.dvodltmf")) returned 0 [0240.581] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\sVfTBTyNMNlPOziIoPg\\KguSvtd0LLiS6TzQSZt.flv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\svftbtynmnlpoziiopg\\kgusvtd0llis6tzqszt.flv.dvodltmf")) returned 0x20 [0240.581] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\sVfTBTyNMNlPOziIoPg\\KguSvtd0LLiS6TzQSZt.flv", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53bb0ce0, ftCreationTime.dwHighDateTime=0x1d4c96e, ftLastAccessTime.dwLowDateTime=0xa30fff30, ftLastAccessTime.dwHighDateTime=0x1d4c5a4, ftLastWriteTime.dwLowDateTime=0xa30fff30, ftLastWriteTime.dwHighDateTime=0x1d4c5a4, nFileSizeHigh=0x0, nFileSizeLow=0xe28a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="KguSvtd0LLiS6TzQSZt.flv", cAlternateFileName="KGUSVT~1.FLV")) returned 0x2e8558 [0240.581] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53bb0ce0, ftCreationTime.dwHighDateTime=0x1d4c96e, ftLastAccessTime.dwLowDateTime=0xa30fff30, ftLastAccessTime.dwHighDateTime=0x1d4c5a4, ftLastWriteTime.dwLowDateTime=0xa30fff30, ftLastWriteTime.dwHighDateTime=0x1d4c5a4, nFileSizeHigh=0x0, nFileSizeLow=0xe28a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="KguSvtd0LLiS6TzQSZt.flv", cAlternateFileName="KGUSVT~1.FLV")) returned 0 [0240.581] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0240.581] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\sVfTBTyNMNlPOziIoPg\\KguSvtd0LLiS6TzQSZt.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\svftbtynmnlpoziiopg\\kgusvtd0llis6tzqszt.flv")) returned 1 [0240.583] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\sVfTBTyNMNlPOziIoPg\\KguSvtd0LLiS6TzQSZt.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\svftbtynmnlpoziiopg\\kgusvtd0llis6tzqszt.flv")) returned 0xffffffff [0240.583] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c8f6130, ftCreationTime.dwHighDateTime=0x1d4c9da, ftLastAccessTime.dwLowDateTime=0x8764b1b0, ftLastAccessTime.dwHighDateTime=0x1d4d1eb, ftLastWriteTime.dwLowDateTime=0x8764b1b0, ftLastWriteTime.dwHighDateTime=0x1d4d1eb, nFileSizeHigh=0x0, nFileSizeLow=0x15787, dwReserved0=0x2dbbd0, dwReserved1=0x18eb84, cFileName="RXvF2y7yj q82Scckfr.swf", cAlternateFileName="RXVF2Y~1.SWF")) returned 1 [0240.583] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\sVfTBTyNMNlPOziIoPg\\RXvF2y7yj q82Scckfr.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\svftbtynmnlpoziiopg\\rxvf2y7yj q82scckfr.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0240.583] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\sVfTBTyNMNlPOziIoPg\\RXvF2y7yj q82Scckfr.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\svftbtynmnlpoziiopg\\rxvf2y7yj q82scckfr.swf.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0240.584] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15787 [0240.584] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0240.584] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0240.675] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x15787, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x15787, lpOverlapped=0x0) returned 1 [0240.677] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x15790, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x15790, lpOverlapped=0x0) returned 1 [0240.679] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0240.701] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0240.712] CloseHandle (hObject=0xd8) returned 1 [0240.713] CloseHandle (hObject=0xe0) returned 1 [0240.713] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\sVfTBTyNMNlPOziIoPg\\RXvF2y7yj q82Scckfr.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\svftbtynmnlpoziiopg\\rxvf2y7yj q82scckfr.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\sVfTBTyNMNlPOziIoPg\\RXvF2y7yj q82Scckfr.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\svftbtynmnlpoziiopg\\rxvf2y7yj q82scckfr.swf.dvodltmf")) returned 0 [0240.714] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\sVfTBTyNMNlPOziIoPg\\RXvF2y7yj q82Scckfr.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\svftbtynmnlpoziiopg\\rxvf2y7yj q82scckfr.swf.dvodltmf")) returned 0x20 [0240.714] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\sVfTBTyNMNlPOziIoPg\\RXvF2y7yj q82Scckfr.swf", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c8f6130, ftCreationTime.dwHighDateTime=0x1d4c9da, ftLastAccessTime.dwLowDateTime=0x8764b1b0, ftLastAccessTime.dwHighDateTime=0x1d4d1eb, ftLastWriteTime.dwLowDateTime=0x8764b1b0, ftLastWriteTime.dwHighDateTime=0x1d4d1eb, nFileSizeHigh=0x0, nFileSizeLow=0x15787, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="RXvF2y7yj q82Scckfr.swf", cAlternateFileName="RXVF2Y~1.SWF")) returned 0x2e8558 [0240.714] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c8f6130, ftCreationTime.dwHighDateTime=0x1d4c9da, ftLastAccessTime.dwLowDateTime=0x8764b1b0, ftLastAccessTime.dwHighDateTime=0x1d4d1eb, ftLastWriteTime.dwLowDateTime=0x8764b1b0, ftLastWriteTime.dwHighDateTime=0x1d4d1eb, nFileSizeHigh=0x0, nFileSizeLow=0x15787, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="RXvF2y7yj q82Scckfr.swf", cAlternateFileName="RXVF2Y~1.SWF")) returned 0 [0240.714] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0240.714] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\sVfTBTyNMNlPOziIoPg\\RXvF2y7yj q82Scckfr.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\svftbtynmnlpoziiopg\\rxvf2y7yj q82scckfr.swf")) returned 1 [0240.716] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\sVfTBTyNMNlPOziIoPg\\RXvF2y7yj q82Scckfr.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\svftbtynmnlpoziiopg\\rxvf2y7yj q82scckfr.swf")) returned 0xffffffff [0240.716] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c8f6130, ftCreationTime.dwHighDateTime=0x1d4c9da, ftLastAccessTime.dwLowDateTime=0x8764b1b0, ftLastAccessTime.dwHighDateTime=0x1d4d1eb, ftLastWriteTime.dwLowDateTime=0x8764b1b0, ftLastWriteTime.dwHighDateTime=0x1d4d1eb, nFileSizeHigh=0x0, nFileSizeLow=0x15787, dwReserved0=0x2dbbd0, dwReserved1=0x18eb84, cFileName="RXvF2y7yj q82Scckfr.swf", cAlternateFileName="RXVF2Y~1.SWF")) returned 0 [0240.716] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0240.716] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6dcff370, ftCreationTime.dwHighDateTime=0x1d4d021, ftLastAccessTime.dwLowDateTime=0x71305630, ftLastAccessTime.dwHighDateTime=0x1d4cf55, ftLastWriteTime.dwLowDateTime=0x71305630, ftLastWriteTime.dwHighDateTime=0x1d4cf55, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x63533238, dwReserved1=0x72666b63, cFileName="yc9JRcGYnx", cAlternateFileName="YC9JRC~1")) returned 1 [0240.716] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\yc9JRcGYnx\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6dcff370, ftCreationTime.dwHighDateTime=0x1d4d021, ftLastAccessTime.dwLowDateTime=0x71305630, ftLastAccessTime.dwHighDateTime=0x1d4cf55, ftLastWriteTime.dwLowDateTime=0x71305630, ftLastWriteTime.dwHighDateTime=0x1d4cf55, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18eb84, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0240.716] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6dcff370, ftCreationTime.dwHighDateTime=0x1d4d021, ftLastAccessTime.dwLowDateTime=0x71305630, ftLastAccessTime.dwHighDateTime=0x1d4cf55, ftLastWriteTime.dwLowDateTime=0x71305630, ftLastWriteTime.dwHighDateTime=0x1d4cf55, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18eb84, cFileName="..", cAlternateFileName="")) returned 1 [0240.716] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7da2cc00, ftCreationTime.dwHighDateTime=0x1d4d445, ftLastAccessTime.dwLowDateTime=0x65eaacc0, ftLastAccessTime.dwHighDateTime=0x1d4d159, ftLastWriteTime.dwLowDateTime=0x65eaacc0, ftLastWriteTime.dwHighDateTime=0x1d4d159, nFileSizeHigh=0x0, nFileSizeLow=0x1bac, dwReserved0=0x2dbbd0, dwReserved1=0x18eb84, cFileName="AUz31NoiR.avi", cAlternateFileName="AUZ31N~1.AVI")) returned 1 [0240.716] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\yc9JRcGYnx\\AUz31NoiR.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\yc9jrcgynx\\auz31noir.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0240.716] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\yc9JRcGYnx\\AUz31NoiR.avi.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\yc9jrcgynx\\auz31noir.avi.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0240.717] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1bac [0240.717] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0240.717] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0240.858] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1bac, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x1bac, lpOverlapped=0x0) returned 1 [0240.859] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x1bb0, lpOverlapped=0x0) returned 1 [0240.860] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0240.883] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0240.895] CloseHandle (hObject=0xe0) returned 1 [0240.895] CloseHandle (hObject=0xd8) returned 1 [0240.895] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\yc9JRcGYnx\\AUz31NoiR.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\yc9jrcgynx\\auz31noir.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\yc9JRcGYnx\\AUz31NoiR.avi.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\yc9jrcgynx\\auz31noir.avi.dvodltmf")) returned 0 [0240.896] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\yc9JRcGYnx\\AUz31NoiR.avi.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\yc9jrcgynx\\auz31noir.avi.dvodltmf")) returned 0x20 [0240.896] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\yc9JRcGYnx\\AUz31NoiR.avi", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7da2cc00, ftCreationTime.dwHighDateTime=0x1d4d445, ftLastAccessTime.dwLowDateTime=0x65eaacc0, ftLastAccessTime.dwHighDateTime=0x1d4d159, ftLastWriteTime.dwLowDateTime=0x65eaacc0, ftLastWriteTime.dwHighDateTime=0x1d4d159, nFileSizeHigh=0x0, nFileSizeLow=0x1bac, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AUz31NoiR.avi", cAlternateFileName="AUZ31N~1.AVI")) returned 0x2e8558 [0240.897] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7da2cc00, ftCreationTime.dwHighDateTime=0x1d4d445, ftLastAccessTime.dwLowDateTime=0x65eaacc0, ftLastAccessTime.dwHighDateTime=0x1d4d159, ftLastWriteTime.dwLowDateTime=0x65eaacc0, ftLastWriteTime.dwHighDateTime=0x1d4d159, nFileSizeHigh=0x0, nFileSizeLow=0x1bac, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AUz31NoiR.avi", cAlternateFileName="AUZ31N~1.AVI")) returned 0 [0240.897] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0240.897] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\yc9JRcGYnx\\AUz31NoiR.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\yc9jrcgynx\\auz31noir.avi")) returned 1 [0240.898] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\yc9JRcGYnx\\AUz31NoiR.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\yc9jrcgynx\\auz31noir.avi")) returned 0xffffffff [0240.898] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7da2cc00, ftCreationTime.dwHighDateTime=0x1d4d445, ftLastAccessTime.dwLowDateTime=0x65eaacc0, ftLastAccessTime.dwHighDateTime=0x1d4d159, ftLastWriteTime.dwLowDateTime=0x65eaacc0, ftLastWriteTime.dwHighDateTime=0x1d4d159, nFileSizeHigh=0x0, nFileSizeLow=0x1bac, dwReserved0=0x2dbbd0, dwReserved1=0x18eb84, cFileName="AUz31NoiR.avi", cAlternateFileName="AUZ31N~1.AVI")) returned 0 [0240.898] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0240.898] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846b9f0, ftCreationTime.dwHighDateTime=0x1d4cec7, ftLastAccessTime.dwLowDateTime=0x9c3f47a0, ftLastAccessTime.dwHighDateTime=0x1d4cef1, ftLastWriteTime.dwLowDateTime=0x9c3f47a0, ftLastWriteTime.dwHighDateTime=0x1d4cef1, nFileSizeHigh=0x0, nFileSizeLow=0xe06f, dwReserved0=0x63536976, dwReserved1=0x72666b63, cFileName="Zp5Y_FVIHinRwh0M.swf", cAlternateFileName="ZP5Y_F~1.SWF")) returned 1 [0240.898] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\Zp5Y_FVIHinRwh0M.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\zp5y_fvihinrwh0m.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0240.898] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\Zp5Y_FVIHinRwh0M.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\zp5y_fvihinrwh0m.swf.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0240.899] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe06f [0240.899] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0240.899] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0240.991] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe06f, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0xe06f, lpOverlapped=0x0) returned 1 [0240.992] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe070, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0xe070, lpOverlapped=0x0) returned 1 [0240.994] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0241.016] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0241.027] CloseHandle (hObject=0xec) returned 1 [0241.027] CloseHandle (hObject=0xd8) returned 1 [0241.027] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\Zp5Y_FVIHinRwh0M.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\zp5y_fvihinrwh0m.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\Zp5Y_FVIHinRwh0M.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\zp5y_fvihinrwh0m.swf.dvodltmf")) returned 0 [0241.028] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\Zp5Y_FVIHinRwh0M.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\zp5y_fvihinrwh0m.swf.dvodltmf")) returned 0x20 [0241.028] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\Zp5Y_FVIHinRwh0M.swf", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846b9f0, ftCreationTime.dwHighDateTime=0x1d4cec7, ftLastAccessTime.dwLowDateTime=0x9c3f47a0, ftLastAccessTime.dwHighDateTime=0x1d4cef1, ftLastWriteTime.dwLowDateTime=0x9c3f47a0, ftLastWriteTime.dwHighDateTime=0x1d4cef1, nFileSizeHigh=0x0, nFileSizeLow=0xe06f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Zp5Y_FVIHinRwh0M.swf", cAlternateFileName="ZP5Y_F~1.SWF")) returned 0x2e8518 [0241.028] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846b9f0, ftCreationTime.dwHighDateTime=0x1d4cec7, ftLastAccessTime.dwLowDateTime=0x9c3f47a0, ftLastAccessTime.dwHighDateTime=0x1d4cef1, ftLastWriteTime.dwLowDateTime=0x9c3f47a0, ftLastWriteTime.dwHighDateTime=0x1d4cef1, nFileSizeHigh=0x0, nFileSizeLow=0xe06f, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Zp5Y_FVIHinRwh0M.swf", cAlternateFileName="ZP5Y_F~1.SWF")) returned 0 [0241.028] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0241.028] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\Zp5Y_FVIHinRwh0M.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\zp5y_fvihinrwh0m.swf")) returned 1 [0241.031] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\l1LjkHRO25HgVAKEXl\\Zp5Y_FVIHinRwh0M.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\l1ljkhro25hgvakexl\\zp5y_fvihinrwh0m.swf")) returned 0xffffffff [0241.031] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846b9f0, ftCreationTime.dwHighDateTime=0x1d4cec7, ftLastAccessTime.dwLowDateTime=0x9c3f47a0, ftLastAccessTime.dwHighDateTime=0x1d4cef1, ftLastWriteTime.dwLowDateTime=0x9c3f47a0, ftLastWriteTime.dwHighDateTime=0x1d4cef1, nFileSizeHigh=0x0, nFileSizeLow=0xe06f, dwReserved0=0x63536976, dwReserved1=0x72666b63, cFileName="Zp5Y_FVIHinRwh0M.swf", cAlternateFileName="ZP5Y_F~1.SWF")) returned 0 [0241.031] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0241.031] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f339d80, ftCreationTime.dwHighDateTime=0x1d4d33a, ftLastAccessTime.dwLowDateTime=0x83c481d0, ftLastAccessTime.dwHighDateTime=0x1d4cb9b, ftLastWriteTime.dwLowDateTime=0x83c481d0, ftLastWriteTime.dwHighDateTime=0x1d4cb9b, nFileSizeHigh=0x0, nFileSizeLow=0xd832, dwReserved0=0x30687752, dwReserved1=0x77732e4d, cFileName="Mcw4fYHrUz2R.mp4", cAlternateFileName="MCW4FY~1.MP4")) returned 1 [0241.031] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\Mcw4fYHrUz2R.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\mcw4fyhruz2r.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0241.031] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\Mcw4fYHrUz2R.mp4.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\mcw4fyhruz2r.mp4.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0241.032] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd832 [0241.032] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0241.032] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0241.119] ReadFile (in: hFile=0xd4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd832, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0xd832, lpOverlapped=0x0) returned 1 [0241.121] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd840, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0xd840, lpOverlapped=0x0) returned 1 [0241.122] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0241.145] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0241.156] CloseHandle (hObject=0xd4) returned 1 [0241.156] CloseHandle (hObject=0xd8) returned 1 [0241.156] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\Mcw4fYHrUz2R.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\mcw4fyhruz2r.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\Mcw4fYHrUz2R.mp4.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\mcw4fyhruz2r.mp4.dvodltmf")) returned 0 [0241.157] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\Mcw4fYHrUz2R.mp4.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\mcw4fyhruz2r.mp4.dvodltmf")) returned 0x20 [0241.157] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\Mcw4fYHrUz2R.mp4", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f339d80, ftCreationTime.dwHighDateTime=0x1d4d33a, ftLastAccessTime.dwLowDateTime=0x83c481d0, ftLastAccessTime.dwHighDateTime=0x1d4cb9b, ftLastWriteTime.dwLowDateTime=0x83c481d0, ftLastWriteTime.dwHighDateTime=0x1d4cb9b, nFileSizeHigh=0x0, nFileSizeLow=0xd832, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Mcw4fYHrUz2R.mp4", cAlternateFileName="MCW4FY~1.MP4")) returned 0x2e84d8 [0241.157] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f339d80, ftCreationTime.dwHighDateTime=0x1d4d33a, ftLastAccessTime.dwLowDateTime=0x83c481d0, ftLastAccessTime.dwHighDateTime=0x1d4cb9b, ftLastWriteTime.dwLowDateTime=0x83c481d0, ftLastWriteTime.dwHighDateTime=0x1d4cb9b, nFileSizeHigh=0x0, nFileSizeLow=0xd832, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Mcw4fYHrUz2R.mp4", cAlternateFileName="MCW4FY~1.MP4")) returned 0 [0241.157] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0241.157] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\Mcw4fYHrUz2R.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\mcw4fyhruz2r.mp4")) returned 1 [0241.158] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\Mcw4fYHrUz2R.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\mcw4fyhruz2r.mp4")) returned 0xffffffff [0241.159] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a9c600, ftCreationTime.dwHighDateTime=0x1d4c787, ftLastAccessTime.dwLowDateTime=0x58d8df50, ftLastAccessTime.dwHighDateTime=0x1d4c53a, ftLastWriteTime.dwLowDateTime=0x58d8df50, ftLastWriteTime.dwHighDateTime=0x1d4c53a, nFileSizeHigh=0x0, nFileSizeLow=0x971b, dwReserved0=0x2dbbd0, dwReserved1=0x18f054, cFileName="StJACC4 ObpLCWS.flv", cAlternateFileName="STJACC~1.FLV")) returned 1 [0241.159] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\StJACC4 ObpLCWS.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\stjacc4 obplcws.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0241.159] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\StJACC4 ObpLCWS.flv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\stjacc4 obplcws.flv.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0241.159] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x971b [0241.159] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0241.160] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0241.249] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x971b, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x971b, lpOverlapped=0x0) returned 1 [0241.250] WriteFile (in: hFile=0xd4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x9720, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x9720, lpOverlapped=0x0) returned 1 [0241.251] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0241.274] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0241.285] CloseHandle (hObject=0xd8) returned 1 [0241.285] CloseHandle (hObject=0xd4) returned 1 [0241.285] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\StJACC4 ObpLCWS.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\stjacc4 obplcws.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\StJACC4 ObpLCWS.flv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\stjacc4 obplcws.flv.dvodltmf")) returned 0 [0241.286] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\StJACC4 ObpLCWS.flv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\stjacc4 obplcws.flv.dvodltmf")) returned 0x20 [0241.286] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\StJACC4 ObpLCWS.flv", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a9c600, ftCreationTime.dwHighDateTime=0x1d4c787, ftLastAccessTime.dwLowDateTime=0x58d8df50, ftLastAccessTime.dwHighDateTime=0x1d4c53a, ftLastWriteTime.dwLowDateTime=0x58d8df50, ftLastWriteTime.dwHighDateTime=0x1d4c53a, nFileSizeHigh=0x0, nFileSizeLow=0x971b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="StJACC4 ObpLCWS.flv", cAlternateFileName="STJACC~1.FLV")) returned 0x2e84d8 [0241.286] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a9c600, ftCreationTime.dwHighDateTime=0x1d4c787, ftLastAccessTime.dwLowDateTime=0x58d8df50, ftLastAccessTime.dwHighDateTime=0x1d4c53a, ftLastWriteTime.dwLowDateTime=0x58d8df50, ftLastWriteTime.dwHighDateTime=0x1d4c53a, nFileSizeHigh=0x0, nFileSizeLow=0x971b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="StJACC4 ObpLCWS.flv", cAlternateFileName="STJACC~1.FLV")) returned 0 [0241.287] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0241.287] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\StJACC4 ObpLCWS.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\stjacc4 obplcws.flv")) returned 1 [0241.289] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\-x mXlGCowEqZikIAM\\StJACC4 ObpLCWS.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\-x mxlgcoweqzikiam\\stjacc4 obplcws.flv")) returned 0xffffffff [0241.289] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a9c600, ftCreationTime.dwHighDateTime=0x1d4c787, ftLastAccessTime.dwLowDateTime=0x58d8df50, ftLastAccessTime.dwHighDateTime=0x1d4c53a, ftLastWriteTime.dwLowDateTime=0x58d8df50, ftLastWriteTime.dwHighDateTime=0x1d4c53a, nFileSizeHigh=0x0, nFileSizeLow=0x971b, dwReserved0=0x2dbbd0, dwReserved1=0x18f054, cFileName="StJACC4 ObpLCWS.flv", cAlternateFileName="STJACC~1.FLV")) returned 0 [0241.289] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0241.289] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf55da0, ftCreationTime.dwHighDateTime=0x1d4d3e7, ftLastAccessTime.dwLowDateTime=0x272cb8a0, ftLastAccessTime.dwHighDateTime=0x1d4c878, ftLastWriteTime.dwLowDateTime=0x272cb8a0, ftLastWriteTime.dwHighDateTime=0x1d4c878, nFileSizeHigh=0x0, nFileSizeLow=0x43e5, dwReserved0=0x5357434c, dwReserved1=0x766c662e, cFileName="EUveWA99SN741202TX.mp4", cAlternateFileName="EUVEWA~1.MP4")) returned 1 [0241.289] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\EUveWA99SN741202TX.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\euvewa99sn741202tx.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0241.289] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\EUveWA99SN741202TX.mp4.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\euvewa99sn741202tx.mp4.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0241.290] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43e5 [0241.290] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0241.290] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0241.391] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x43e5, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x43e5, lpOverlapped=0x0) returned 1 [0241.392] WriteFile (in: hFile=0xd4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x43f0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x43f0, lpOverlapped=0x0) returned 1 [0241.393] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0241.416] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0241.428] CloseHandle (hObject=0xe8) returned 1 [0241.428] CloseHandle (hObject=0xd4) returned 1 [0241.428] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\EUveWA99SN741202TX.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\euvewa99sn741202tx.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\EUveWA99SN741202TX.mp4.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\euvewa99sn741202tx.mp4.dvodltmf")) returned 0 [0241.429] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\EUveWA99SN741202TX.mp4.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\euvewa99sn741202tx.mp4.dvodltmf")) returned 0x20 [0241.429] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\EUveWA99SN741202TX.mp4", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf55da0, ftCreationTime.dwHighDateTime=0x1d4d3e7, ftLastAccessTime.dwLowDateTime=0x272cb8a0, ftLastAccessTime.dwHighDateTime=0x1d4c878, ftLastWriteTime.dwLowDateTime=0x272cb8a0, ftLastWriteTime.dwHighDateTime=0x1d4c878, nFileSizeHigh=0x0, nFileSizeLow=0x43e5, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="EUveWA99SN741202TX.mp4", cAlternateFileName="EUVEWA~1.MP4")) returned 0x2e8498 [0241.430] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf55da0, ftCreationTime.dwHighDateTime=0x1d4d3e7, ftLastAccessTime.dwLowDateTime=0x272cb8a0, ftLastAccessTime.dwHighDateTime=0x1d4c878, ftLastWriteTime.dwLowDateTime=0x272cb8a0, ftLastWriteTime.dwHighDateTime=0x1d4c878, nFileSizeHigh=0x0, nFileSizeLow=0x43e5, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="EUveWA99SN741202TX.mp4", cAlternateFileName="EUVEWA~1.MP4")) returned 0 [0241.430] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0241.430] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\EUveWA99SN741202TX.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\euvewa99sn741202tx.mp4")) returned 1 [0241.431] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\EUveWA99SN741202TX.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\euvewa99sn741202tx.mp4")) returned 0xffffffff [0241.431] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a38f140, ftCreationTime.dwHighDateTime=0x1d4cc28, ftLastAccessTime.dwLowDateTime=0xd9fd1240, ftLastAccessTime.dwHighDateTime=0x1d4c85a, ftLastWriteTime.dwLowDateTime=0xd9fd1240, ftLastWriteTime.dwHighDateTime=0x1d4c85a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FB8ZrXYafps9Z", cAlternateFileName="FB8ZRX~1")) returned 1 [0241.431] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\FB8ZrXYafps9Z\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a38f140, ftCreationTime.dwHighDateTime=0x1d4cc28, ftLastAccessTime.dwLowDateTime=0xd9fd1240, ftLastAccessTime.dwHighDateTime=0x1d4c85a, ftLastWriteTime.dwLowDateTime=0xd9fd1240, ftLastWriteTime.dwHighDateTime=0x1d4c85a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0241.431] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a38f140, ftCreationTime.dwHighDateTime=0x1d4cc28, ftLastAccessTime.dwLowDateTime=0xd9fd1240, ftLastAccessTime.dwHighDateTime=0x1d4c85a, ftLastWriteTime.dwLowDateTime=0xd9fd1240, ftLastWriteTime.dwHighDateTime=0x1d4c85a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0241.431] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x386635f0, ftCreationTime.dwHighDateTime=0x1d4d256, ftLastAccessTime.dwLowDateTime=0x788f5c40, ftLastAccessTime.dwHighDateTime=0x1d4ce25, ftLastWriteTime.dwLowDateTime=0x788f5c40, ftLastWriteTime.dwHighDateTime=0x1d4ce25, nFileSizeHigh=0x0, nFileSizeLow=0x13026, dwReserved0=0x8c, dwReserved1=0x0, cFileName="7q6Ye7UYZNFp_8Yh2.mp4", cAlternateFileName="7Q6YE7~1.MP4")) returned 1 [0241.431] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\FB8ZrXYafps9Z\\7q6Ye7UYZNFp_8Yh2.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\fb8zrxyafps9z\\7q6ye7uyznfp_8yh2.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0241.431] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\FB8ZrXYafps9Z\\7q6Ye7UYZNFp_8Yh2.mp4.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\fb8zrxyafps9z\\7q6ye7uyznfp_8yh2.mp4.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0241.432] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13026 [0241.432] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0241.432] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0241.530] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x13026, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x13026, lpOverlapped=0x0) returned 1 [0241.531] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x13030, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x13030, lpOverlapped=0x0) returned 1 [0241.533] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0241.556] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0241.569] CloseHandle (hObject=0xe8) returned 1 [0241.569] CloseHandle (hObject=0xd8) returned 1 [0241.569] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\FB8ZrXYafps9Z\\7q6Ye7UYZNFp_8Yh2.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\fb8zrxyafps9z\\7q6ye7uyznfp_8yh2.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\FB8ZrXYafps9Z\\7q6Ye7UYZNFp_8Yh2.mp4.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\fb8zrxyafps9z\\7q6ye7uyznfp_8yh2.mp4.dvodltmf")) returned 0 [0241.570] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\FB8ZrXYafps9Z\\7q6Ye7UYZNFp_8Yh2.mp4.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\fb8zrxyafps9z\\7q6ye7uyznfp_8yh2.mp4.dvodltmf")) returned 0x20 [0241.570] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\FB8ZrXYafps9Z\\7q6Ye7UYZNFp_8Yh2.mp4", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x386635f0, ftCreationTime.dwHighDateTime=0x1d4d256, ftLastAccessTime.dwLowDateTime=0x788f5c40, ftLastAccessTime.dwHighDateTime=0x1d4ce25, ftLastWriteTime.dwLowDateTime=0x788f5c40, ftLastWriteTime.dwHighDateTime=0x1d4ce25, nFileSizeHigh=0x0, nFileSizeLow=0x13026, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="7q6Ye7UYZNFp_8Yh2.mp4", cAlternateFileName="7Q6YE7~1.MP4")) returned 0x2e84d8 [0241.571] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x386635f0, ftCreationTime.dwHighDateTime=0x1d4d256, ftLastAccessTime.dwLowDateTime=0x788f5c40, ftLastAccessTime.dwHighDateTime=0x1d4ce25, ftLastWriteTime.dwLowDateTime=0x788f5c40, ftLastWriteTime.dwHighDateTime=0x1d4ce25, nFileSizeHigh=0x0, nFileSizeLow=0x13026, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="7q6Ye7UYZNFp_8Yh2.mp4", cAlternateFileName="7Q6YE7~1.MP4")) returned 0 [0241.571] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0241.571] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\FB8ZrXYafps9Z\\7q6Ye7UYZNFp_8Yh2.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\fb8zrxyafps9z\\7q6ye7uyznfp_8yh2.mp4")) returned 1 [0241.572] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\FB8ZrXYafps9Z\\7q6Ye7UYZNFp_8Yh2.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\fb8zrxyafps9z\\7q6ye7uyznfp_8yh2.mp4")) returned 0xffffffff [0241.572] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb86845e0, ftCreationTime.dwHighDateTime=0x1d4d39b, ftLastAccessTime.dwLowDateTime=0xb3347930, ftLastAccessTime.dwHighDateTime=0x1d4ceb5, ftLastWriteTime.dwLowDateTime=0xb3347930, ftLastWriteTime.dwHighDateTime=0x1d4ceb5, nFileSizeHigh=0x0, nFileSizeLow=0x29ee, dwReserved0=0x2dbbd0, dwReserved1=0x18f054, cFileName="Bys8pb nsUGWr_vpl.avi", cAlternateFileName="BYS8PB~1.AVI")) returned 1 [0241.572] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\FB8ZrXYafps9Z\\Bys8pb nsUGWr_vpl.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\fb8zrxyafps9z\\bys8pb nsugwr_vpl.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0241.573] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\FB8ZrXYafps9Z\\Bys8pb nsUGWr_vpl.avi.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\fb8zrxyafps9z\\bys8pb nsugwr_vpl.avi.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0241.573] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29ee [0241.573] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0241.574] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0241.679] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x29ee, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x29ee, lpOverlapped=0x0) returned 1 [0241.680] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x29f0, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x29f0, lpOverlapped=0x0) returned 1 [0241.682] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0241.711] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0241.722] CloseHandle (hObject=0xd8) returned 1 [0241.722] CloseHandle (hObject=0xe8) returned 1 [0241.722] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\FB8ZrXYafps9Z\\Bys8pb nsUGWr_vpl.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\fb8zrxyafps9z\\bys8pb nsugwr_vpl.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\FB8ZrXYafps9Z\\Bys8pb nsUGWr_vpl.avi.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\fb8zrxyafps9z\\bys8pb nsugwr_vpl.avi.dvodltmf")) returned 0 [0241.724] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\FB8ZrXYafps9Z\\Bys8pb nsUGWr_vpl.avi.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\fb8zrxyafps9z\\bys8pb nsugwr_vpl.avi.dvodltmf")) returned 0x20 [0241.724] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\FB8ZrXYafps9Z\\Bys8pb nsUGWr_vpl.avi", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb86845e0, ftCreationTime.dwHighDateTime=0x1d4d39b, ftLastAccessTime.dwLowDateTime=0xb3347930, ftLastAccessTime.dwHighDateTime=0x1d4ceb5, ftLastWriteTime.dwLowDateTime=0xb3347930, ftLastWriteTime.dwHighDateTime=0x1d4ceb5, nFileSizeHigh=0x0, nFileSizeLow=0x29ee, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Bys8pb nsUGWr_vpl.avi", cAlternateFileName="BYS8PB~1.AVI")) returned 0x2e84d8 [0241.724] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb86845e0, ftCreationTime.dwHighDateTime=0x1d4d39b, ftLastAccessTime.dwLowDateTime=0xb3347930, ftLastAccessTime.dwHighDateTime=0x1d4ceb5, ftLastWriteTime.dwLowDateTime=0xb3347930, ftLastWriteTime.dwHighDateTime=0x1d4ceb5, nFileSizeHigh=0x0, nFileSizeLow=0x29ee, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Bys8pb nsUGWr_vpl.avi", cAlternateFileName="BYS8PB~1.AVI")) returned 0 [0241.724] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0241.724] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\FB8ZrXYafps9Z\\Bys8pb nsUGWr_vpl.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\fb8zrxyafps9z\\bys8pb nsugwr_vpl.avi")) returned 1 [0241.725] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\FB8ZrXYafps9Z\\Bys8pb nsUGWr_vpl.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\fb8zrxyafps9z\\bys8pb nsugwr_vpl.avi")) returned 0xffffffff [0241.725] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8722cbd0, ftCreationTime.dwHighDateTime=0x1d4d50e, ftLastAccessTime.dwLowDateTime=0x272ba5c0, ftLastAccessTime.dwHighDateTime=0x1d4c8fd, ftLastWriteTime.dwLowDateTime=0x272ba5c0, ftLastWriteTime.dwHighDateTime=0x1d4c8fd, nFileSizeHigh=0x0, nFileSizeLow=0x9058, dwReserved0=0x2dbbd0, dwReserved1=0x18f054, cFileName="gpHSxu6OeEFyb_1eOz.flv", cAlternateFileName="GPHSXU~1.FLV")) returned 1 [0241.725] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\FB8ZrXYafps9Z\\gpHSxu6OeEFyb_1eOz.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\fb8zrxyafps9z\\gphsxu6oeefyb_1eoz.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0241.725] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\FB8ZrXYafps9Z\\gpHSxu6OeEFyb_1eOz.flv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\fb8zrxyafps9z\\gphsxu6oeefyb_1eoz.flv.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0241.726] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9058 [0241.726] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0241.726] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0241.845] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x9058, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x9058, lpOverlapped=0x0) returned 1 [0241.846] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x9060, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x9060, lpOverlapped=0x0) returned 1 [0241.848] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0241.878] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0241.889] CloseHandle (hObject=0xe8) returned 1 [0241.889] CloseHandle (hObject=0xd8) returned 1 [0241.889] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\FB8ZrXYafps9Z\\gpHSxu6OeEFyb_1eOz.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\fb8zrxyafps9z\\gphsxu6oeefyb_1eoz.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\FB8ZrXYafps9Z\\gpHSxu6OeEFyb_1eOz.flv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\fb8zrxyafps9z\\gphsxu6oeefyb_1eoz.flv.dvodltmf")) returned 0 [0241.890] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\FB8ZrXYafps9Z\\gpHSxu6OeEFyb_1eOz.flv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\fb8zrxyafps9z\\gphsxu6oeefyb_1eoz.flv.dvodltmf")) returned 0x20 [0241.890] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\FB8ZrXYafps9Z\\gpHSxu6OeEFyb_1eOz.flv", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8722cbd0, ftCreationTime.dwHighDateTime=0x1d4d50e, ftLastAccessTime.dwLowDateTime=0x272ba5c0, ftLastAccessTime.dwHighDateTime=0x1d4c8fd, ftLastWriteTime.dwLowDateTime=0x272ba5c0, ftLastWriteTime.dwHighDateTime=0x1d4c8fd, nFileSizeHigh=0x0, nFileSizeLow=0x9058, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="gpHSxu6OeEFyb_1eOz.flv", cAlternateFileName="GPHSXU~1.FLV")) returned 0x2e84d8 [0241.890] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8722cbd0, ftCreationTime.dwHighDateTime=0x1d4d50e, ftLastAccessTime.dwLowDateTime=0x272ba5c0, ftLastAccessTime.dwHighDateTime=0x1d4c8fd, ftLastWriteTime.dwLowDateTime=0x272ba5c0, ftLastWriteTime.dwHighDateTime=0x1d4c8fd, nFileSizeHigh=0x0, nFileSizeLow=0x9058, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="gpHSxu6OeEFyb_1eOz.flv", cAlternateFileName="GPHSXU~1.FLV")) returned 0 [0241.890] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0241.890] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\FB8ZrXYafps9Z\\gpHSxu6OeEFyb_1eOz.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\fb8zrxyafps9z\\gphsxu6oeefyb_1eoz.flv")) returned 1 [0241.892] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\FB8ZrXYafps9Z\\gpHSxu6OeEFyb_1eOz.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\fb8zrxyafps9z\\gphsxu6oeefyb_1eoz.flv")) returned 0xffffffff [0241.892] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2e788a0, ftCreationTime.dwHighDateTime=0x1d4d274, ftLastAccessTime.dwLowDateTime=0x4cd06db0, ftLastAccessTime.dwHighDateTime=0x1d4cfe7, ftLastWriteTime.dwLowDateTime=0x4cd06db0, ftLastWriteTime.dwHighDateTime=0x1d4cfe7, nFileSizeHigh=0x0, nFileSizeLow=0x7009, dwReserved0=0x2dbbd0, dwReserved1=0x18f054, cFileName="rcyk-_3V.swf", cAlternateFileName="")) returned 1 [0241.892] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\FB8ZrXYafps9Z\\rcyk-_3V.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\fb8zrxyafps9z\\rcyk-_3v.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0241.892] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\FB8ZrXYafps9Z\\rcyk-_3V.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\fb8zrxyafps9z\\rcyk-_3v.swf.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0241.893] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7009 [0241.893] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0241.893] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0241.982] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x7009, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x7009, lpOverlapped=0x0) returned 1 [0241.983] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x7010, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x7010, lpOverlapped=0x0) returned 1 [0241.985] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0242.010] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0242.021] CloseHandle (hObject=0xd8) returned 1 [0242.021] CloseHandle (hObject=0xe8) returned 1 [0242.021] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\FB8ZrXYafps9Z\\rcyk-_3V.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\fb8zrxyafps9z\\rcyk-_3v.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\FB8ZrXYafps9Z\\rcyk-_3V.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\fb8zrxyafps9z\\rcyk-_3v.swf.dvodltmf")) returned 0 [0242.022] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\FB8ZrXYafps9Z\\rcyk-_3V.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\fb8zrxyafps9z\\rcyk-_3v.swf.dvodltmf")) returned 0x20 [0242.022] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\FB8ZrXYafps9Z\\rcyk-_3V.swf", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2e788a0, ftCreationTime.dwHighDateTime=0x1d4d274, ftLastAccessTime.dwLowDateTime=0x4cd06db0, ftLastAccessTime.dwHighDateTime=0x1d4cfe7, ftLastWriteTime.dwLowDateTime=0x4cd06db0, ftLastWriteTime.dwHighDateTime=0x1d4cfe7, nFileSizeHigh=0x0, nFileSizeLow=0x7009, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="rcyk-_3V.swf", cAlternateFileName="")) returned 0x2e84d8 [0242.023] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2e788a0, ftCreationTime.dwHighDateTime=0x1d4d274, ftLastAccessTime.dwLowDateTime=0x4cd06db0, ftLastAccessTime.dwHighDateTime=0x1d4cfe7, ftLastWriteTime.dwLowDateTime=0x4cd06db0, ftLastWriteTime.dwHighDateTime=0x1d4cfe7, nFileSizeHigh=0x0, nFileSizeLow=0x7009, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="rcyk-_3V.swf", cAlternateFileName="")) returned 0 [0242.023] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0242.023] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\FB8ZrXYafps9Z\\rcyk-_3V.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\fb8zrxyafps9z\\rcyk-_3v.swf")) returned 1 [0242.024] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\FB8ZrXYafps9Z\\rcyk-_3V.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\fb8zrxyafps9z\\rcyk-_3v.swf")) returned 0xffffffff [0242.024] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2e788a0, ftCreationTime.dwHighDateTime=0x1d4d274, ftLastAccessTime.dwLowDateTime=0x4cd06db0, ftLastAccessTime.dwHighDateTime=0x1d4cfe7, ftLastWriteTime.dwLowDateTime=0x4cd06db0, ftLastWriteTime.dwHighDateTime=0x1d4cfe7, nFileSizeHigh=0x0, nFileSizeLow=0x7009, dwReserved0=0x2dbbd0, dwReserved1=0x18f054, cFileName="rcyk-_3V.swf", cAlternateFileName="")) returned 0 [0242.024] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0242.024] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54037240, ftCreationTime.dwHighDateTime=0x1d4ce29, ftLastAccessTime.dwLowDateTime=0x36dae240, ftLastAccessTime.dwHighDateTime=0x1d4c7a6, ftLastWriteTime.dwLowDateTime=0x36dae240, ftLastWriteTime.dwHighDateTime=0x1d4c7a6, nFileSizeHigh=0x0, nFileSizeLow=0x2519, dwReserved0=0x315f6266, dwReserved1=0x2e7a4f65, cFileName="iT9cS8I.flv", cAlternateFileName="")) returned 1 [0242.024] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\iT9cS8I.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\it9cs8i.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0242.024] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\iT9cS8I.flv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\it9cs8i.flv.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0242.025] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2519 [0242.025] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0242.025] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0242.114] ReadFile (in: hFile=0xd4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2519, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x2519, lpOverlapped=0x0) returned 1 [0242.115] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x2520, lpOverlapped=0x0) returned 1 [0242.116] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0242.139] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0242.150] CloseHandle (hObject=0xd4) returned 1 [0242.150] CloseHandle (hObject=0xe8) returned 1 [0242.150] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\iT9cS8I.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\it9cs8i.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\iT9cS8I.flv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\it9cs8i.flv.dvodltmf")) returned 0 [0242.151] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\iT9cS8I.flv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\it9cs8i.flv.dvodltmf")) returned 0x20 [0242.151] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\iT9cS8I.flv", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54037240, ftCreationTime.dwHighDateTime=0x1d4ce29, ftLastAccessTime.dwLowDateTime=0x36dae240, ftLastAccessTime.dwHighDateTime=0x1d4c7a6, ftLastWriteTime.dwLowDateTime=0x36dae240, ftLastWriteTime.dwHighDateTime=0x1d4c7a6, nFileSizeHigh=0x0, nFileSizeLow=0x2519, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="iT9cS8I.flv", cAlternateFileName="")) returned 0x2e8498 [0242.151] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54037240, ftCreationTime.dwHighDateTime=0x1d4ce29, ftLastAccessTime.dwLowDateTime=0x36dae240, ftLastAccessTime.dwHighDateTime=0x1d4c7a6, ftLastWriteTime.dwLowDateTime=0x36dae240, ftLastWriteTime.dwHighDateTime=0x1d4c7a6, nFileSizeHigh=0x0, nFileSizeLow=0x2519, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="iT9cS8I.flv", cAlternateFileName="")) returned 0 [0242.151] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0242.151] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\iT9cS8I.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\it9cs8i.flv")) returned 1 [0242.153] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\iT9cS8I.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\it9cs8i.flv")) returned 0xffffffff [0242.153] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc42a950, ftCreationTime.dwHighDateTime=0x1d4cb29, ftLastAccessTime.dwLowDateTime=0xa1b16f70, ftLastAccessTime.dwHighDateTime=0x1d4cffe, ftLastWriteTime.dwLowDateTime=0xa1b16f70, ftLastWriteTime.dwHighDateTime=0x1d4cffe, nFileSizeHigh=0x0, nFileSizeLow=0xe179, dwReserved0=0x0, dwReserved1=0x0, cFileName="jSgtytSYGdfVNm6.swf", cAlternateFileName="JSGTYT~1.SWF")) returned 1 [0242.153] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\jSgtytSYGdfVNm6.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\jsgtytsygdfvnm6.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0242.153] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\jSgtytSYGdfVNm6.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\jsgtytsygdfvnm6.swf.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0242.154] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe179 [0242.154] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0242.154] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0242.247] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe179, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0xe179, lpOverlapped=0x0) returned 1 [0242.248] WriteFile (in: hFile=0xd4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe180, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0xe180, lpOverlapped=0x0) returned 1 [0242.250] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0242.273] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0242.284] CloseHandle (hObject=0xe8) returned 1 [0242.284] CloseHandle (hObject=0xd4) returned 1 [0242.284] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\jSgtytSYGdfVNm6.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\jsgtytsygdfvnm6.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\jSgtytSYGdfVNm6.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\jsgtytsygdfvnm6.swf.dvodltmf")) returned 0 [0242.286] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\jSgtytSYGdfVNm6.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\jsgtytsygdfvnm6.swf.dvodltmf")) returned 0x20 [0242.286] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\jSgtytSYGdfVNm6.swf", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc42a950, ftCreationTime.dwHighDateTime=0x1d4cb29, ftLastAccessTime.dwLowDateTime=0xa1b16f70, ftLastAccessTime.dwHighDateTime=0x1d4cffe, ftLastWriteTime.dwLowDateTime=0xa1b16f70, ftLastWriteTime.dwHighDateTime=0x1d4cffe, nFileSizeHigh=0x0, nFileSizeLow=0xe179, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="jSgtytSYGdfVNm6.swf", cAlternateFileName="JSGTYT~1.SWF")) returned 0x2e8498 [0242.286] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc42a950, ftCreationTime.dwHighDateTime=0x1d4cb29, ftLastAccessTime.dwLowDateTime=0xa1b16f70, ftLastAccessTime.dwHighDateTime=0x1d4cffe, ftLastWriteTime.dwLowDateTime=0xa1b16f70, ftLastWriteTime.dwHighDateTime=0x1d4cffe, nFileSizeHigh=0x0, nFileSizeLow=0xe179, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="jSgtytSYGdfVNm6.swf", cAlternateFileName="JSGTYT~1.SWF")) returned 0 [0242.286] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0242.286] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\jSgtytSYGdfVNm6.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\jsgtytsygdfvnm6.swf")) returned 1 [0242.287] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\jSgtytSYGdfVNm6.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\jsgtytsygdfvnm6.swf")) returned 0xffffffff [0242.287] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa947f410, ftCreationTime.dwHighDateTime=0x1d4cf2d, ftLastAccessTime.dwLowDateTime=0xcc2ebf90, ftLastAccessTime.dwHighDateTime=0x1d4d158, ftLastWriteTime.dwLowDateTime=0xcc2ebf90, ftLastWriteTime.dwHighDateTime=0x1d4d158, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="KFP7T", cAlternateFileName="")) returned 1 [0242.287] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\KFP7T\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa947f410, ftCreationTime.dwHighDateTime=0x1d4cf2d, ftLastAccessTime.dwLowDateTime=0xcc2ebf90, ftLastAccessTime.dwHighDateTime=0x1d4d158, ftLastWriteTime.dwLowDateTime=0xcc2ebf90, ftLastWriteTime.dwHighDateTime=0x1d4d158, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x86, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0242.287] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa947f410, ftCreationTime.dwHighDateTime=0x1d4cf2d, ftLastAccessTime.dwLowDateTime=0xcc2ebf90, ftLastAccessTime.dwHighDateTime=0x1d4d158, ftLastWriteTime.dwLowDateTime=0xcc2ebf90, ftLastWriteTime.dwHighDateTime=0x1d4d158, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x86, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.287] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6408d4b0, ftCreationTime.dwHighDateTime=0x1d4c856, ftLastAccessTime.dwLowDateTime=0x4f189320, ftLastAccessTime.dwHighDateTime=0x1d4cabc, ftLastWriteTime.dwLowDateTime=0x4f189320, ftLastWriteTime.dwHighDateTime=0x1d4cabc, nFileSizeHigh=0x0, nFileSizeLow=0xf7ae, dwReserved0=0x86, dwReserved1=0x0, cFileName="al m.avi", cAlternateFileName="ALM~1.AVI")) returned 1 [0242.288] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\KFP7T\\al m.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\kfp7t\\al m.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0242.288] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\KFP7T\\al m.avi.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\kfp7t\\al m.avi.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0242.288] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf7ae [0242.288] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0242.289] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0242.384] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xf7ae, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0xf7ae, lpOverlapped=0x0) returned 1 [0242.385] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf7b0, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0xf7b0, lpOverlapped=0x0) returned 1 [0242.387] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0242.410] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0242.420] CloseHandle (hObject=0xe8) returned 1 [0242.421] CloseHandle (hObject=0xd8) returned 1 [0242.421] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\KFP7T\\al m.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\kfp7t\\al m.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\KFP7T\\al m.avi.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\kfp7t\\al m.avi.dvodltmf")) returned 0 [0242.422] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\KFP7T\\al m.avi.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\kfp7t\\al m.avi.dvodltmf")) returned 0x20 [0242.422] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\KFP7T\\al m.avi", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6408d4b0, ftCreationTime.dwHighDateTime=0x1d4c856, ftLastAccessTime.dwLowDateTime=0x4f189320, ftLastAccessTime.dwHighDateTime=0x1d4cabc, ftLastWriteTime.dwLowDateTime=0x4f189320, ftLastWriteTime.dwHighDateTime=0x1d4cabc, nFileSizeHigh=0x0, nFileSizeLow=0xf7ae, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="al m.avi", cAlternateFileName="ALM~1.AVI")) returned 0x2e84d8 [0242.422] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6408d4b0, ftCreationTime.dwHighDateTime=0x1d4c856, ftLastAccessTime.dwLowDateTime=0x4f189320, ftLastAccessTime.dwHighDateTime=0x1d4cabc, ftLastWriteTime.dwLowDateTime=0x4f189320, ftLastWriteTime.dwHighDateTime=0x1d4cabc, nFileSizeHigh=0x0, nFileSizeLow=0xf7ae, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="al m.avi", cAlternateFileName="ALM~1.AVI")) returned 0 [0242.422] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0242.422] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\KFP7T\\al m.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\kfp7t\\al m.avi")) returned 1 [0242.423] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\KFP7T\\al m.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\kfp7t\\al m.avi")) returned 0xffffffff [0242.423] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6408d4b0, ftCreationTime.dwHighDateTime=0x1d4c856, ftLastAccessTime.dwLowDateTime=0x4f189320, ftLastAccessTime.dwHighDateTime=0x1d4cabc, ftLastWriteTime.dwLowDateTime=0x4f189320, ftLastWriteTime.dwHighDateTime=0x1d4cabc, nFileSizeHigh=0x0, nFileSizeLow=0xf7ae, dwReserved0=0x86, dwReserved1=0x0, cFileName="al m.avi", cAlternateFileName="ALM~1.AVI")) returned 0 [0242.424] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0242.424] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf551b270, ftCreationTime.dwHighDateTime=0x1d4c883, ftLastAccessTime.dwLowDateTime=0xa4d639c0, ftLastAccessTime.dwHighDateTime=0x1d4cc06, ftLastWriteTime.dwLowDateTime=0xa4d639c0, ftLastWriteTime.dwHighDateTime=0x1d4cc06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="KgFNlaafJUydHCHoAmQ", cAlternateFileName="KGFNLA~1")) returned 1 [0242.424] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\KgFNlaafJUydHCHoAmQ\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf551b270, ftCreationTime.dwHighDateTime=0x1d4c883, ftLastAccessTime.dwLowDateTime=0xa4d639c0, ftLastAccessTime.dwHighDateTime=0x1d4cc06, ftLastWriteTime.dwLowDateTime=0xa4d639c0, ftLastWriteTime.dwHighDateTime=0x1d4cc06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f054, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0242.424] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf551b270, ftCreationTime.dwHighDateTime=0x1d4c883, ftLastAccessTime.dwLowDateTime=0xa4d639c0, ftLastAccessTime.dwHighDateTime=0x1d4cc06, ftLastWriteTime.dwLowDateTime=0xa4d639c0, ftLastWriteTime.dwHighDateTime=0x1d4cc06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f054, cFileName="..", cAlternateFileName="")) returned 1 [0242.424] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf551b270, ftCreationTime.dwHighDateTime=0x1d4c883, ftLastAccessTime.dwLowDateTime=0xa4d639c0, ftLastAccessTime.dwHighDateTime=0x1d4cc06, ftLastWriteTime.dwLowDateTime=0xa4d639c0, ftLastWriteTime.dwHighDateTime=0x1d4cc06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f054, cFileName="..", cAlternateFileName="")) returned 0 [0242.424] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0242.424] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c3f690, ftCreationTime.dwHighDateTime=0x1d4cb0e, ftLastAccessTime.dwLowDateTime=0x5e466b90, ftLastAccessTime.dwHighDateTime=0x1d4d3e2, ftLastWriteTime.dwLowDateTime=0x5e466b90, ftLastWriteTime.dwHighDateTime=0x1d4d3e2, nFileSizeHigh=0x0, nFileSizeLow=0x552e, dwReserved0=0x2dbbd0, dwReserved1=0x18f2bc, cFileName="lzBU.mkv", cAlternateFileName="")) returned 1 [0242.424] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\lzBU.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\lzbu.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0242.424] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\lzBU.mkv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\lzbu.mkv.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0242.425] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x552e [0242.425] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0242.425] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0242.527] ReadFile (in: hFile=0xd4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x552e, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x552e, lpOverlapped=0x0) returned 1 [0242.528] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x5530, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x5530, lpOverlapped=0x0) returned 1 [0242.530] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0242.553] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0242.564] CloseHandle (hObject=0xd4) returned 1 [0242.564] CloseHandle (hObject=0xd8) returned 1 [0242.564] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\lzBU.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\lzbu.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\lzBU.mkv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\lzbu.mkv.dvodltmf")) returned 0 [0242.565] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\lzBU.mkv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\lzbu.mkv.dvodltmf")) returned 0x20 [0242.565] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\lzBU.mkv", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c3f690, ftCreationTime.dwHighDateTime=0x1d4cb0e, ftLastAccessTime.dwLowDateTime=0x5e466b90, ftLastAccessTime.dwHighDateTime=0x1d4d3e2, ftLastWriteTime.dwLowDateTime=0x5e466b90, ftLastWriteTime.dwHighDateTime=0x1d4d3e2, nFileSizeHigh=0x0, nFileSizeLow=0x552e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="lzBU.mkv", cAlternateFileName="")) returned 0x2e8498 [0242.566] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c3f690, ftCreationTime.dwHighDateTime=0x1d4cb0e, ftLastAccessTime.dwLowDateTime=0x5e466b90, ftLastAccessTime.dwHighDateTime=0x1d4d3e2, ftLastWriteTime.dwLowDateTime=0x5e466b90, ftLastWriteTime.dwHighDateTime=0x1d4d3e2, nFileSizeHigh=0x0, nFileSizeLow=0x552e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="lzBU.mkv", cAlternateFileName="")) returned 0 [0242.566] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0242.566] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\lzBU.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\lzbu.mkv")) returned 1 [0242.567] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\lzBU.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\lzbu.mkv")) returned 0xffffffff [0242.568] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd43f1b30, ftCreationTime.dwHighDateTime=0x1d4d581, ftLastAccessTime.dwLowDateTime=0x9b7c0d40, ftLastAccessTime.dwHighDateTime=0x1d4cdb5, ftLastWriteTime.dwLowDateTime=0x9b7c0d40, ftLastWriteTime.dwHighDateTime=0x1d4cdb5, nFileSizeHigh=0x0, nFileSizeLow=0x182af, dwReserved0=0x0, dwReserved1=0x0, cFileName="NgUoI04cW-JZfa61y.flv", cAlternateFileName="NGUOI0~1.FLV")) returned 1 [0242.568] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\NgUoI04cW-JZfa61y.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\nguoi04cw-jzfa61y.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0242.568] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\NgUoI04cW-JZfa61y.flv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\nguoi04cw-jzfa61y.flv.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0242.569] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x182af [0242.569] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0242.569] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0242.659] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x182af, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x182af, lpOverlapped=0x0) returned 1 [0242.661] WriteFile (in: hFile=0xd4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x182b0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x182b0, lpOverlapped=0x0) returned 1 [0242.663] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0242.686] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0242.697] CloseHandle (hObject=0xd8) returned 1 [0242.697] CloseHandle (hObject=0xd4) returned 1 [0242.697] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\NgUoI04cW-JZfa61y.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\nguoi04cw-jzfa61y.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\NgUoI04cW-JZfa61y.flv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\nguoi04cw-jzfa61y.flv.dvodltmf")) returned 0 [0242.698] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\NgUoI04cW-JZfa61y.flv.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\nguoi04cw-jzfa61y.flv.dvodltmf")) returned 0x20 [0242.698] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\NgUoI04cW-JZfa61y.flv", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd43f1b30, ftCreationTime.dwHighDateTime=0x1d4d581, ftLastAccessTime.dwLowDateTime=0x9b7c0d40, ftLastAccessTime.dwHighDateTime=0x1d4cdb5, ftLastWriteTime.dwLowDateTime=0x9b7c0d40, ftLastWriteTime.dwHighDateTime=0x1d4cdb5, nFileSizeHigh=0x0, nFileSizeLow=0x182af, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="NgUoI04cW-JZfa61y.flv", cAlternateFileName="NGUOI0~1.FLV")) returned 0x2e8498 [0242.698] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd43f1b30, ftCreationTime.dwHighDateTime=0x1d4d581, ftLastAccessTime.dwLowDateTime=0x9b7c0d40, ftLastAccessTime.dwHighDateTime=0x1d4cdb5, ftLastWriteTime.dwLowDateTime=0x9b7c0d40, ftLastWriteTime.dwHighDateTime=0x1d4cdb5, nFileSizeHigh=0x0, nFileSizeLow=0x182af, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="NgUoI04cW-JZfa61y.flv", cAlternateFileName="NGUOI0~1.FLV")) returned 0 [0242.699] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0242.699] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\NgUoI04cW-JZfa61y.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\nguoi04cw-jzfa61y.flv")) returned 1 [0242.700] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\NgUoI04cW-JZfa61y.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\nguoi04cw-jzfa61y.flv")) returned 0xffffffff [0242.700] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa64fce70, ftCreationTime.dwHighDateTime=0x1d4d1b9, ftLastAccessTime.dwLowDateTime=0xb3eae2a0, ftLastAccessTime.dwHighDateTime=0x1d4c73b, ftLastWriteTime.dwLowDateTime=0xb3eae2a0, ftLastWriteTime.dwHighDateTime=0x1d4c73b, nFileSizeHigh=0x0, nFileSizeLow=0xfe1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="P54zZv.mp4", cAlternateFileName="")) returned 1 [0242.701] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\P54zZv.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\p54zzv.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0242.701] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\P54zZv.mp4.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\p54zzv.mp4.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0242.701] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfe1f [0242.701] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0242.702] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0242.804] ReadFile (in: hFile=0xd4, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xfe1f, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0xfe1f, lpOverlapped=0x0) returned 1 [0242.805] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xfe20, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0xfe20, lpOverlapped=0x0) returned 1 [0242.807] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0242.830] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0242.841] CloseHandle (hObject=0xd4) returned 1 [0242.841] CloseHandle (hObject=0xd8) returned 1 [0242.841] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\P54zZv.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\p54zzv.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\P54zZv.mp4.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\p54zzv.mp4.dvodltmf")) returned 0 [0242.842] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\P54zZv.mp4.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\p54zzv.mp4.dvodltmf")) returned 0x20 [0242.843] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\P54zZv.mp4", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa64fce70, ftCreationTime.dwHighDateTime=0x1d4d1b9, ftLastAccessTime.dwLowDateTime=0xb3eae2a0, ftLastAccessTime.dwHighDateTime=0x1d4c73b, ftLastWriteTime.dwLowDateTime=0xb3eae2a0, ftLastWriteTime.dwHighDateTime=0x1d4c73b, nFileSizeHigh=0x0, nFileSizeLow=0xfe1f, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="P54zZv.mp4", cAlternateFileName="")) returned 0x2e8498 [0242.843] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa64fce70, ftCreationTime.dwHighDateTime=0x1d4d1b9, ftLastAccessTime.dwLowDateTime=0xb3eae2a0, ftLastAccessTime.dwHighDateTime=0x1d4c73b, ftLastWriteTime.dwLowDateTime=0xb3eae2a0, ftLastWriteTime.dwHighDateTime=0x1d4c73b, nFileSizeHigh=0x0, nFileSizeLow=0xfe1f, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="P54zZv.mp4", cAlternateFileName="")) returned 0 [0242.843] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0242.843] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\P54zZv.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\p54zzv.mp4")) returned 1 [0242.844] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\P54zZv.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\p54zzv.mp4")) returned 0xffffffff [0242.844] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69be79b0, ftCreationTime.dwHighDateTime=0x1d4d31d, ftLastAccessTime.dwLowDateTime=0x6581b0, ftLastAccessTime.dwHighDateTime=0x1d4d40e, ftLastWriteTime.dwLowDateTime=0x6581b0, ftLastWriteTime.dwHighDateTime=0x1d4d40e, nFileSizeHigh=0x0, nFileSizeLow=0x189ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="YZH-bf1KYt_e0Q4n.swf", cAlternateFileName="YZH-BF~1.SWF")) returned 1 [0242.844] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\YZH-bf1KYt_e0Q4n.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\yzh-bf1kyt_e0q4n.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0242.844] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\YZH-bf1KYt_e0Q4n.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\yzh-bf1kyt_e0q4n.swf.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0242.845] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x189ec [0242.845] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0242.846] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0242.941] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x189ec, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x189ec, lpOverlapped=0x0) returned 1 [0242.943] WriteFile (in: hFile=0xd4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x189f0, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x189f0, lpOverlapped=0x0) returned 1 [0242.946] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0242.968] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0242.980] CloseHandle (hObject=0xd8) returned 1 [0242.980] CloseHandle (hObject=0xd4) returned 1 [0242.980] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\YZH-bf1KYt_e0Q4n.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\yzh-bf1kyt_e0q4n.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\YZH-bf1KYt_e0Q4n.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\yzh-bf1kyt_e0q4n.swf.dvodltmf")) returned 0 [0242.981] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\YZH-bf1KYt_e0Q4n.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\yzh-bf1kyt_e0q4n.swf.dvodltmf")) returned 0x20 [0242.981] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\YZH-bf1KYt_e0Q4n.swf", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69be79b0, ftCreationTime.dwHighDateTime=0x1d4d31d, ftLastAccessTime.dwLowDateTime=0x6581b0, ftLastAccessTime.dwHighDateTime=0x1d4d40e, ftLastWriteTime.dwLowDateTime=0x6581b0, ftLastWriteTime.dwHighDateTime=0x1d4d40e, nFileSizeHigh=0x0, nFileSizeLow=0x189ec, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="YZH-bf1KYt_e0Q4n.swf", cAlternateFileName="YZH-BF~1.SWF")) returned 0x2e8498 [0242.981] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69be79b0, ftCreationTime.dwHighDateTime=0x1d4d31d, ftLastAccessTime.dwLowDateTime=0x6581b0, ftLastAccessTime.dwHighDateTime=0x1d4d40e, ftLastWriteTime.dwLowDateTime=0x6581b0, ftLastWriteTime.dwHighDateTime=0x1d4d40e, nFileSizeHigh=0x0, nFileSizeLow=0x189ec, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="YZH-bf1KYt_e0Q4n.swf", cAlternateFileName="YZH-BF~1.SWF")) returned 0 [0242.981] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0242.982] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\YZH-bf1KYt_e0Q4n.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\yzh-bf1kyt_e0q4n.swf")) returned 1 [0242.983] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z3blHvjoX1\\YZH-bf1KYt_e0Q4n.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z3blhvjox1\\yzh-bf1kyt_e0q4n.swf")) returned 0xffffffff [0242.983] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69be79b0, ftCreationTime.dwHighDateTime=0x1d4d31d, ftLastAccessTime.dwLowDateTime=0x6581b0, ftLastAccessTime.dwHighDateTime=0x1d4d40e, ftLastWriteTime.dwLowDateTime=0x6581b0, ftLastWriteTime.dwHighDateTime=0x1d4d40e, nFileSizeHigh=0x0, nFileSizeLow=0x189ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="YZH-bf1KYt_e0Q4n.swf", cAlternateFileName="YZH-BF~1.SWF")) returned 0 [0242.983] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0242.983] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x476a30a0, ftCreationTime.dwHighDateTime=0x1d4c672, ftLastAccessTime.dwLowDateTime=0x92cb7e40, ftLastAccessTime.dwHighDateTime=0x1d4d285, ftLastWriteTime.dwLowDateTime=0x92cb7e40, ftLastWriteTime.dwHighDateTime=0x1d4d285, nFileSizeHigh=0x0, nFileSizeLow=0x1031e, dwReserved0=0x34513065, dwReserved1=0x77732e6e, cFileName="Z_uGYEoPQ3Q2RZsnFid.swf", cAlternateFileName="Z_UGYE~1.SWF")) returned 1 [0242.983] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Z_uGYEoPQ3Q2RZsnFid.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z_ugyeopq3q2rzsnfid.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd0 [0242.983] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Z_uGYEoPQ3Q2RZsnFid.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z_ugyeopq3q2rzsnfid.swf.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0242.984] GetFileSize (in: hFile=0xd0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1031e [0242.984] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0242.984] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0243.072] ReadFile (in: hFile=0xd0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1031e, lpNumberOfBytesRead=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f518*=0x1031e, lpOverlapped=0x0) returned 1 [0243.073] WriteFile (in: hFile=0xd4, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10320, lpNumberOfBytesWritten=0x18f518, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f518*=0x10320, lpOverlapped=0x0) returned 1 [0243.075] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0243.098] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0243.109] CloseHandle (hObject=0xd0) returned 1 [0243.109] CloseHandle (hObject=0xd4) returned 1 [0243.109] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Z_uGYEoPQ3Q2RZsnFid.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z_ugyeopq3q2rzsnfid.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Z_uGYEoPQ3Q2RZsnFid.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z_ugyeopq3q2rzsnfid.swf.dvodltmf")) returned 0 [0243.110] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Z_uGYEoPQ3Q2RZsnFid.swf.dvodltmf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z_ugyeopq3q2rzsnfid.swf.dvodltmf")) returned 0x20 [0243.110] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Z_uGYEoPQ3Q2RZsnFid.swf", lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x476a30a0, ftCreationTime.dwHighDateTime=0x1d4c672, ftLastAccessTime.dwLowDateTime=0x92cb7e40, ftLastAccessTime.dwHighDateTime=0x1d4d285, ftLastWriteTime.dwLowDateTime=0x92cb7e40, ftLastWriteTime.dwHighDateTime=0x1d4d285, nFileSizeHigh=0x0, nFileSizeLow=0x1031e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Z_uGYEoPQ3Q2RZsnFid.swf", cAlternateFileName="Z_UGYE~1.SWF")) returned 0x2e8458 [0243.110] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f414 | out: lpFindFileData=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x476a30a0, ftCreationTime.dwHighDateTime=0x1d4c672, ftLastAccessTime.dwLowDateTime=0x92cb7e40, ftLastAccessTime.dwHighDateTime=0x1d4d285, ftLastWriteTime.dwLowDateTime=0x92cb7e40, ftLastWriteTime.dwHighDateTime=0x1d4d285, nFileSizeHigh=0x0, nFileSizeLow=0x1031e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Z_uGYEoPQ3Q2RZsnFid.swf", cAlternateFileName="Z_UGYE~1.SWF")) returned 0 [0243.110] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0243.110] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Z_uGYEoPQ3Q2RZsnFid.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z_ugyeopq3q2rzsnfid.swf")) returned 1 [0243.112] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Z_uGYEoPQ3Q2RZsnFid.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z_ugyeopq3q2rzsnfid.swf")) returned 0xffffffff [0243.112] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x476a30a0, ftCreationTime.dwHighDateTime=0x1d4c672, ftLastAccessTime.dwLowDateTime=0x92cb7e40, ftLastAccessTime.dwHighDateTime=0x1d4d285, ftLastWriteTime.dwLowDateTime=0x92cb7e40, ftLastWriteTime.dwHighDateTime=0x1d4d285, nFileSizeHigh=0x0, nFileSizeLow=0x1031e, dwReserved0=0x34513065, dwReserved1=0x77732e6e, cFileName="Z_uGYEoPQ3Q2RZsnFid.swf", cAlternateFileName="Z_UGYE~1.SWF")) returned 0 [0243.112] FindClose (in: hFindFile=0x2e8418 | out: hFindFile=0x2e8418) returned 1 [0243.112] FindNextFileA (in: hFindFile=0x2dab90, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x728ce9a0, ftLastAccessTime.dwHighDateTime=0x1d5c039, ftLastWriteTime.dwLowDateTime=0x728ce9a0, ftLastWriteTime.dwHighDateTime=0x1d5c039, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x732e736e, cFileName="Videos", cAlternateFileName="")) returned 0 [0243.112] FindClose (in: hFindFile=0x2dab90 | out: hFindFile=0x2dab90) returned 1 [0243.112] FindNextFileA (in: hFindFile=0x2d9af8, lpFindFileData=0x18fc60 | out: lpFindFileData=0x18fc60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x64623838, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0243.112] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\*.*", lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x735a5232, dwReserved1=0x6469466e, cFileName=".", cAlternateFileName="")) returned 0x2e8418 [0243.113] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x735a5232, dwReserved1=0x6469466e, cFileName="..", cAlternateFileName="")) returned 1 [0243.113] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x735a5232, dwReserved1=0x6469466e, cFileName="Adobe", cAlternateFileName="")) returned 1 [0243.113] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0243.113] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="..", cAlternateFileName="")) returned 1 [0243.113] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0243.113] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0243.113] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0243.114] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0243.114] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0243.114] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0243.114] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Replicate", cAlternateFileName="REPLIC~1")) returned 1 [0243.114] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0243.115] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0243.115] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security", cAlternateFileName="")) returned 1 [0243.115] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0243.115] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0243.115] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1df, dwReserved0=0x0, dwReserved1=0x0, cFileName="directories.acrodata", cAlternateFileName="DIRECT~1.ACR")) returned 1 [0243.116] CreateFileA (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\security\\directories.acrodata"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0243.116] CreateFileA (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata.dvodltmf" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\security\\directories.acrodata.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0243.116] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1df [0243.116] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0243.117] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0243.206] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1df, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x1df, lpOverlapped=0x0) returned 1 [0243.207] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x1e0, lpOverlapped=0x0) returned 1 [0243.207] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0243.231] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0243.245] CloseHandle (hObject=0xec) returned 1 [0243.246] CloseHandle (hObject=0xe0) returned 1 [0243.246] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\security\\directories.acrodata"), lpNewFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata.dvodltmf" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\security\\directories.acrodata.dvodltmf")) returned 0 [0243.247] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata.dvodltmf" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\security\\directories.acrodata.dvodltmf")) returned 0x2020 [0243.247] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1df, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="directories.acrodata", cAlternateFileName="DIRECT~1.ACR")) returned 0x2e8598 [0243.247] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1df, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="directories.acrodata", cAlternateFileName="DIRECT~1.ACR")) returned 0 [0243.247] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0243.247] DeleteFileA (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\security\\directories.acrodata")) returned 1 [0243.248] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\security\\directories.acrodata")) returned 0xffffffff [0243.248] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1df, dwReserved0=0x0, dwReserved1=0x0, cFileName="directories.acrodata", cAlternateFileName="DIRECT~1.ACR")) returned 0 [0243.248] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0243.249] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security", cAlternateFileName="")) returned 0 [0243.249] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0243.249] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Replicate", cAlternateFileName="REPLIC~1")) returned 0 [0243.249] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0243.249] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0 [0243.249] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0243.249] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="ARM", cAlternateFileName="")) returned 1 [0243.249] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0243.249] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0243.249] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf2028d90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xf2028d90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.0", cAlternateFileName="READER~1.0")) returned 1 [0243.249] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf2028d90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xf2028d90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0243.251] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf2028d90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xf2028d90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0243.251] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e186d00, ftCreationTime.dwHighDateTime=0x1cfb543, ftLastAccessTime.dwLowDateTime=0x7e186d00, ftLastAccessTime.dwHighDateTime=0x1cfb543, ftLastWriteTime.dwLowDateTime=0x7e186d00, ftLastWriteTime.dwHighDateTime=0x1cfb543, nFileSizeHigh=0x0, nFileSizeLow=0x3d800, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdbeRdrSecUpd10111.msp", cAlternateFileName="ADBERD~2.MSP")) returned 1 [0243.251] CreateFileA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrsecupd10111.msp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0243.252] CreateFileA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp.dvodltmf" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrsecupd10111.msp.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0243.253] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d800 [0243.253] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0243.254] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0243.382] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3d800, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x3d800, lpOverlapped=0x0) returned 1 [0243.399] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3d810, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x3d810, lpOverlapped=0x0) returned 1 [0243.403] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0243.426] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0243.451] CloseHandle (hObject=0xd8) returned 1 [0243.451] CloseHandle (hObject=0xe8) returned 1 [0243.451] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrsecupd10111.msp"), lpNewFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp.dvodltmf" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrsecupd10111.msp.dvodltmf")) returned 0 [0243.452] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp.dvodltmf" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrsecupd10111.msp.dvodltmf")) returned 0x20 [0243.452] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e186d00, ftCreationTime.dwHighDateTime=0x1cfb543, ftLastAccessTime.dwLowDateTime=0x7e186d00, ftLastAccessTime.dwHighDateTime=0x1cfb543, ftLastWriteTime.dwLowDateTime=0x7e186d00, ftLastWriteTime.dwHighDateTime=0x1cfb543, nFileSizeHigh=0x0, nFileSizeLow=0x3d800, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AdbeRdrSecUpd10111.msp", cAlternateFileName="ADBERD~2.MSP")) returned 0x2e8518 [0243.452] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e186d00, ftCreationTime.dwHighDateTime=0x1cfb543, ftLastAccessTime.dwLowDateTime=0x7e186d00, ftLastAccessTime.dwHighDateTime=0x1cfb543, ftLastWriteTime.dwLowDateTime=0x7e186d00, ftLastWriteTime.dwHighDateTime=0x1cfb543, nFileSizeHigh=0x0, nFileSizeLow=0x3d800, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AdbeRdrSecUpd10111.msp", cAlternateFileName="ADBERD~2.MSP")) returned 0 [0243.452] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0243.452] DeleteFileA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrsecupd10111.msp")) returned 1 [0243.455] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrsecupd10111.msp")) returned 0xffffffff [0243.455] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4450880, ftCreationTime.dwHighDateTime=0x1cf6c45, ftLastAccessTime.dwLowDateTime=0xb4450880, ftLastAccessTime.dwHighDateTime=0x1cf6c45, ftLastWriteTime.dwLowDateTime=0xb4450880, ftLastWriteTime.dwHighDateTime=0x1cf6c45, nFileSizeHigh=0x0, nFileSizeLow=0x10e3000, dwReserved0=0x2dab38, dwReserved1=0x18f054, cFileName="AdbeRdrUpd10110_MUI.msp", cAlternateFileName="ADBERD~1.MSP")) returned 1 [0243.455] CreateFileA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrupd10110_mui.msp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0243.455] CreateFileA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp.dvodltmf" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrupd10110_mui.msp.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0243.456] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10e3000 [0243.456] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0243.456] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0243.547] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x500000, lpOverlapped=0x0) returned 1 [0243.719] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x500000, lpOverlapped=0x0) returned 1 [0243.840] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x500000, lpOverlapped=0x0) returned 1 [0243.980] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x500000, lpOverlapped=0x0) returned 1 [0244.092] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x500000, lpOverlapped=0x0) returned 1 [0244.187] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x500000, lpOverlapped=0x0) returned 1 [0244.319] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1e3000, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x1e3000, lpOverlapped=0x0) returned 1 [0244.428] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1e3010, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x1e3010, lpOverlapped=0x0) returned 1 [0244.479] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0244.503] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0244.514] CloseHandle (hObject=0xe8) returned 1 [0244.514] CloseHandle (hObject=0xd8) returned 1 [0244.514] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrupd10110_mui.msp"), lpNewFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp.dvodltmf" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrupd10110_mui.msp.dvodltmf")) returned 0 [0244.515] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp.dvodltmf" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrupd10110_mui.msp.dvodltmf")) returned 0x20 [0244.515] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4450880, ftCreationTime.dwHighDateTime=0x1cf6c45, ftLastAccessTime.dwLowDateTime=0xb4450880, ftLastAccessTime.dwHighDateTime=0x1cf6c45, ftLastWriteTime.dwLowDateTime=0xb4450880, ftLastWriteTime.dwHighDateTime=0x1cf6c45, nFileSizeHigh=0x0, nFileSizeLow=0x10e3000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AdbeRdrUpd10110_MUI.msp", cAlternateFileName="ADBERD~1.MSP")) returned 0x2e8518 [0244.515] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4450880, ftCreationTime.dwHighDateTime=0x1cf6c45, ftLastAccessTime.dwLowDateTime=0xb4450880, ftLastAccessTime.dwHighDateTime=0x1cf6c45, ftLastWriteTime.dwLowDateTime=0xb4450880, ftLastWriteTime.dwHighDateTime=0x1cf6c45, nFileSizeHigh=0x0, nFileSizeLow=0x10e3000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="AdbeRdrUpd10110_MUI.msp", cAlternateFileName="ADBERD~1.MSP")) returned 0 [0244.516] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0244.516] DeleteFileA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrupd10110_mui.msp")) returned 1 [0244.527] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrupd10110_mui.msp")) returned 0xffffffff [0244.527] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2540cc00, ftCreationTime.dwHighDateTime=0x1d1056e, ftLastAccessTime.dwLowDateTime=0x2540cc00, ftLastAccessTime.dwHighDateTime=0x1d1056e, ftLastWriteTime.dwLowDateTime=0x2540cc00, ftLastWriteTime.dwHighDateTime=0x1d1056e, nFileSizeHigh=0x0, nFileSizeLow=0x109d000, dwReserved0=0x2dab38, dwReserved1=0x18f054, cFileName="AdbeRdrUpd10116_MUI.msp", cAlternateFileName="ADBERD~3.MSP")) returned 1 [0244.527] CreateFileA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrupd10116_mui.msp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0244.528] CreateFileA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp.dvodltmf" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrupd10116_mui.msp.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0244.528] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x109d000 [0244.528] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0244.529] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0244.620] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x500000, lpOverlapped=0x0) returned 1 [0244.859] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x500000, lpOverlapped=0x0) returned 1 [0244.978] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x500000, lpOverlapped=0x0) returned 1 [0245.088] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x500000, lpOverlapped=0x0) returned 1 [0245.196] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x500000, lpOverlapped=0x0) returned 1 [0245.282] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x500000, lpOverlapped=0x0) returned 1 [0245.402] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x19d000, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x19d000, lpOverlapped=0x0) returned 1 [0245.433] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x19d010, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x19d010, lpOverlapped=0x0) returned 1 [0245.467] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0245.490] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0245.501] CloseHandle (hObject=0xd8) returned 1 [0245.501] CloseHandle (hObject=0xe8) returned 1 [0245.501] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrupd10116_mui.msp"), lpNewFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp.dvodltmf" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrupd10116_mui.msp.dvodltmf")) returned 0 [0245.502] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp.dvodltmf" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrupd10116_mui.msp.dvodltmf")) returned 0x20 [0245.502] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2540cc00, ftCreationTime.dwHighDateTime=0x1d1056e, ftLastAccessTime.dwLowDateTime=0x2540cc00, ftLastAccessTime.dwHighDateTime=0x1d1056e, ftLastWriteTime.dwLowDateTime=0x2540cc00, ftLastWriteTime.dwHighDateTime=0x1d1056e, nFileSizeHigh=0x0, nFileSizeLow=0x109d000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AdbeRdrUpd10116_MUI.msp", cAlternateFileName="ADBERD~3.MSP")) returned 0x2e8518 [0245.502] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2540cc00, ftCreationTime.dwHighDateTime=0x1d1056e, ftLastAccessTime.dwLowDateTime=0x2540cc00, ftLastAccessTime.dwHighDateTime=0x1d1056e, ftLastWriteTime.dwLowDateTime=0x2540cc00, ftLastWriteTime.dwHighDateTime=0x1d1056e, nFileSizeHigh=0x0, nFileSizeLow=0x109d000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AdbeRdrUpd10116_MUI.msp", cAlternateFileName="ADBERD~3.MSP")) returned 0 [0245.502] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0245.502] DeleteFileA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrupd10116_mui.msp")) returned 1 [0245.524] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrupd10116_mui.msp")) returned 0xffffffff [0245.524] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2540cc00, ftCreationTime.dwHighDateTime=0x1d1056e, ftLastAccessTime.dwLowDateTime=0x2540cc00, ftLastAccessTime.dwHighDateTime=0x1d1056e, ftLastWriteTime.dwLowDateTime=0x2540cc00, ftLastWriteTime.dwHighDateTime=0x1d1056e, nFileSizeHigh=0x0, nFileSizeLow=0x109d000, dwReserved0=0x2dab38, dwReserved1=0x18f054, cFileName="AdbeRdrUpd10116_MUI.msp", cAlternateFileName="ADBERD~3.MSP")) returned 0 [0245.524] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0245.524] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf2028d90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xf2028d90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.0", cAlternateFileName="READER~1.0")) returned 0 [0245.524] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0245.524] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="ARM", cAlternateFileName="")) returned 0 [0245.524] FindClose (in: hFindFile=0x2e8458 | out: hFindFile=0x2e8458) returned 1 [0245.524] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6469466e, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0245.525] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Application Data\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="ARM", cAlternateFileName="\x18\x84.")) returned 0xffffffff [0245.525] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6469466e, cFileName="Desktop", cAlternateFileName="")) returned 1 [0245.525] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Desktop\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="ARM", cAlternateFileName="\x18\x84.")) returned 0xffffffff [0245.525] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6469466e, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0245.525] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Documents\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="ARM", cAlternateFileName="\x18\x84.")) returned 0xffffffff [0245.525] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6469466e, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0245.525] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Favorites\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dbbd0, dwReserved1=0x18f524, cFileName="ARM", cAlternateFileName="\x18\x84.")) returned 0xffffffff [0245.525] FindNextFileA (in: hFindFile=0x2e8418, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6469466e, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0245.525] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d302e, dwReserved1=0x18f524, cFileName=".", cAlternateFileName="")) returned 0x2e8458 [0245.526] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d302e, dwReserved1=0x18f524, cFileName="..", cAlternateFileName="")) returned 1 [0245.526] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d302e, dwReserved1=0x18f524, cFileName="Assistance", cAlternateFileName="ASSIST~1")) returned 1 [0245.526] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0245.526] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName="..", cAlternateFileName="")) returned 1 [0245.526] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName="Client", cAlternateFileName="")) returned 1 [0245.526] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0245.526] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.526] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0", cAlternateFileName="")) returned 1 [0245.526] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0245.527] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.527] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0245.527] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0245.531] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.531] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2436abaa, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xabde2c6f, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa65a8bbf, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x2f22, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_CValidator.H1D", cAlternateFileName="HELP_C~1.H1D")) returned 1 [0245.531] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_cvalidator.h1d"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0245.537] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_cvalidator.h1d.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0245.538] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2f22 [0245.538] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0245.538] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0245.636] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2f22, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x2f22, lpOverlapped=0x0) returned 1 [0245.638] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2f30, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x2f30, lpOverlapped=0x0) returned 1 [0245.639] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0245.661] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0245.674] CloseHandle (hObject=0xe0) returned 1 [0245.674] CloseHandle (hObject=0xec) returned 1 [0245.674] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_cvalidator.h1d"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_cvalidator.h1d.dvodltmf")) returned 0 [0245.674] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_cvalidator.h1d.dvodltmf")) returned 0x2020 [0245.675] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2436abaa, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xabde2c6f, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa65a8bbf, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x2f22, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Help_CValidator.H1D", cAlternateFileName="HELP_C~1.H1D")) returned 0x2e8598 [0245.675] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2436abaa, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xabde2c6f, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa65a8bbf, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x2f22, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Help_CValidator.H1D", cAlternateFileName="HELP_C~1.H1D")) returned 0 [0245.675] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0245.675] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_cvalidator.h1d")) returned 1 [0245.676] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_cvalidator.h1d")) returned 0xffffffff [0245.676] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae2660aa, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae2660aa, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x365fc, dwReserved0=0x2dab38, dwReserved1=0x18eb84, cFileName="Help_MKWD_AssetId.H1W", cAlternateFileName="HELP_M~1.H1W")) returned 1 [0245.676] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_assetid.h1w"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0245.676] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_assetid.h1w.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0245.677] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x365fc [0245.677] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0245.677] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0245.768] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x365fc, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x365fc, lpOverlapped=0x0) returned 1 [0245.773] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x36600, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x36600, lpOverlapped=0x0) returned 1 [0245.778] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0245.800] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0245.811] CloseHandle (hObject=0xec) returned 1 [0245.811] CloseHandle (hObject=0xe0) returned 1 [0245.812] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_assetid.h1w"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_assetid.h1w.dvodltmf")) returned 0 [0245.812] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_assetid.h1w.dvodltmf")) returned 0x2020 [0245.813] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae2660aa, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae2660aa, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x365fc, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Help_MKWD_AssetId.H1W", cAlternateFileName="HELP_M~1.H1W")) returned 0x2e8598 [0245.813] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae2660aa, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae2660aa, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x365fc, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Help_MKWD_AssetId.H1W", cAlternateFileName="HELP_M~1.H1W")) returned 0 [0245.813] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0245.813] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_assetid.h1w")) returned 1 [0245.815] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_assetid.h1w")) returned 0xffffffff [0245.815] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae409b6f, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae409b6f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x325ec, dwReserved0=0x2dab38, dwReserved1=0x18eb84, cFileName="Help_MKWD_BestBet.H1W", cAlternateFileName="HELP_M~2.H1W")) returned 1 [0245.815] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_bestbet.h1w"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0245.816] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_bestbet.h1w.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0245.817] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x325ec [0245.817] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0245.817] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0245.904] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x325ec, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x325ec, lpOverlapped=0x0) returned 1 [0245.915] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x325f0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x325f0, lpOverlapped=0x0) returned 1 [0245.919] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0245.942] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0245.953] CloseHandle (hObject=0xe0) returned 1 [0245.953] CloseHandle (hObject=0xec) returned 1 [0245.953] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_bestbet.h1w"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_bestbet.h1w.dvodltmf")) returned 0 [0245.954] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_bestbet.h1w.dvodltmf")) returned 0x2020 [0245.954] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae409b6f, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae409b6f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x325ec, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Help_MKWD_BestBet.H1W", cAlternateFileName="HELP_M~2.H1W")) returned 0x2e8598 [0245.955] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae409b6f, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae409b6f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x325ec, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Help_MKWD_BestBet.H1W", cAlternateFileName="HELP_M~2.H1W")) returned 0 [0245.955] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0245.955] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_bestbet.h1w")) returned 1 [0245.957] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_bestbet.h1w")) returned 0xffffffff [0245.957] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x79f1a, dwReserved0=0x2dab38, dwReserved1=0x18eb84, cFileName="Help_MTOC_help.H1H", cAlternateFileName="HELP_M~1.H1H")) returned 1 [0245.957] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mtoc_help.h1h"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0245.957] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mtoc_help.h1h.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0245.958] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x79f1a [0245.958] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0245.958] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0246.047] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x79f1a, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x79f1a, lpOverlapped=0x0) returned 1 [0246.061] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x79f20, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x79f20, lpOverlapped=0x0) returned 1 [0246.072] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0246.094] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0246.105] CloseHandle (hObject=0xec) returned 1 [0246.105] CloseHandle (hObject=0xe0) returned 1 [0246.105] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mtoc_help.h1h"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mtoc_help.h1h.dvodltmf")) returned 0 [0246.106] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mtoc_help.h1h.dvodltmf")) returned 0x2020 [0246.106] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x79f1a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Help_MTOC_help.H1H", cAlternateFileName="HELP_M~1.H1H")) returned 0x2e8598 [0246.107] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x79f1a, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Help_MTOC_help.H1H", cAlternateFileName="HELP_M~1.H1H")) returned 0 [0246.107] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0246.107] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mtoc_help.h1h")) returned 1 [0246.111] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mtoc_help.h1h")) returned 0xffffffff [0246.111] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x26353250, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x3944, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_MValidator.H1D", cAlternateFileName="HELP_M~1.H1D")) returned 1 [0246.111] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.h1d"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0246.111] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.h1d.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0246.112] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3944 [0246.112] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0246.112] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0246.202] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3944, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x3944, lpOverlapped=0x0) returned 1 [0246.204] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3950, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x3950, lpOverlapped=0x0) returned 1 [0246.216] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0246.238] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0246.249] CloseHandle (hObject=0xe0) returned 1 [0246.249] CloseHandle (hObject=0xec) returned 1 [0246.249] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.h1d"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.h1d.dvodltmf")) returned 0 [0246.250] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.h1d.dvodltmf")) returned 0x2020 [0246.250] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x26353250, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x3944, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Help_MValidator.H1D", cAlternateFileName="HELP_M~1.H1D")) returned 0x2e8598 [0246.250] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x26353250, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x3944, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Help_MValidator.H1D", cAlternateFileName="HELP_M~1.H1D")) returned 0 [0246.250] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0246.250] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.h1d")) returned 1 [0246.251] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.h1d")) returned 0xffffffff [0246.251] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x2dab38, dwReserved1=0x18eb84, cFileName="Help_MValidator.Lck", cAlternateFileName="HELP_M~1.LCK")) returned 1 [0246.251] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.lck"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0246.252] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.lck.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0246.252] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4 [0246.252] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0246.252] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0246.341] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x4, lpOverlapped=0x0) returned 1 [0246.342] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x10, lpOverlapped=0x0) returned 1 [0246.343] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0246.371] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0246.383] CloseHandle (hObject=0xec) returned 1 [0246.383] CloseHandle (hObject=0xe0) returned 1 [0246.383] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.lck"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.lck.dvodltmf")) returned 0 [0246.384] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.lck.dvodltmf")) returned 0x2020 [0246.384] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Help_MValidator.Lck", cAlternateFileName="HELP_M~1.LCK")) returned 0x2e8598 [0246.384] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Help_MValidator.Lck", cAlternateFileName="HELP_M~1.LCK")) returned 0 [0246.384] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0246.385] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.lck")) returned 1 [0246.385] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.lck")) returned 0xffffffff [0246.385] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x249fa376, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0xd5310, dwReserved0=0x2dab38, dwReserved1=0x18eb84, cFileName="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q", cAlternateFileName="HELP{9~1.H1Q")) returned 1 [0246.386] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0246.386] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0246.386] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd5310 [0246.386] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0246.387] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0246.477] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd5310, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0xd5310, lpOverlapped=0x0) returned 1 [0246.492] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd5320, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0xd5320, lpOverlapped=0x0) returned 1 [0246.507] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0246.530] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0246.541] CloseHandle (hObject=0xe0) returned 1 [0246.541] CloseHandle (hObject=0xec) returned 1 [0246.541] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q.dvodltmf")) returned 0 [0246.542] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q.dvodltmf")) returned 0x2020 [0246.542] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x249fa376, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0xd5310, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q", cAlternateFileName="HELP{9~1.H1Q")) returned 0x2e8598 [0246.542] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x249fa376, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0xd5310, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q", cAlternateFileName="HELP{9~1.H1Q")) returned 0 [0246.542] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0246.542] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q")) returned 1 [0246.549] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q")) returned 0xffffffff [0246.549] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x249fa376, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0xd5310, dwReserved0=0x2dab38, dwReserved1=0x18eb84, cFileName="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q", cAlternateFileName="HELP{9~1.H1Q")) returned 0 [0246.550] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0246.550] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0246.550] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0246.550] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0", cAlternateFileName="")) returned 0 [0246.550] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0246.550] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName="Client", cAlternateFileName="")) returned 0 [0246.550] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0246.554] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d302e, dwReserved1=0x18f524, cFileName="Crypto", cAlternateFileName="")) returned 1 [0246.554] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0246.554] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName="..", cAlternateFileName="")) returned 1 [0246.554] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName="DSS", cAlternateFileName="")) returned 1 [0246.554] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0246.554] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0246.554] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1 [0246.554] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0246.554] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0246.554] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0246.554] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0246.555] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 0 [0246.555] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0246.555] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName="Keys", cAlternateFileName="")) returned 1 [0246.555] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0246.556] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0246.556] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0246.556] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0246.556] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName="RSA", cAlternateFileName="")) returned 1 [0246.556] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0246.556] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0246.556] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1 [0246.556] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0246.556] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0246.556] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0246.556] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0246.556] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0246.556] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0246.557] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0246.557] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xfc767af0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xfc767af0, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc767af0, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="6D14E4~1")) returned 1 [0246.557] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe5bc2f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x41d, dwReserved0=0x0, dwReserved1=0x0, cFileName="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="D42CC0~1")) returned 1 [0246.557] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe5bc2f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x41d, dwReserved0=0x0, dwReserved1=0x0, cFileName="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="D42CC0~1")) returned 0 [0246.557] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0246.557] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 0 [0246.557] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0246.558] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName="RSA", cAlternateFileName="")) returned 0 [0246.558] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0246.558] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d302e, dwReserved1=0x18f524, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1 [0246.558] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0246.558] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName="..", cAlternateFileName="")) returned 1 [0246.558] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName="Device", cAlternateFileName="")) returned 1 [0246.558] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64383561, dwReserved1=0x62643262, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0246.559] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64383561, dwReserved1=0x62643262, cFileName="..", cAlternateFileName="")) returned 1 [0246.559] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64383561, dwReserved1=0x62643262, cFileName="{113527a4-45d4-4b6f-b567-97838f1b04b0}", cAlternateFileName="{11352~1")) returned 1 [0246.559] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0246.560] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0246.560] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0246.560] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0246.561] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0246.561] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1fad1 [0246.561] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0246.561] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0246.653] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1fad1, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x1fad1, lpOverlapped=0x0) returned 1 [0246.669] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1fae0, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x1fae0, lpOverlapped=0x0) returned 1 [0246.672] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0246.695] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0246.706] CloseHandle (hObject=0xd8) returned 1 [0246.706] CloseHandle (hObject=0xec) returned 1 [0246.706] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.dvodltmf")) returned 0 [0246.707] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.dvodltmf")) returned 0x20 [0246.707] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="background.png", cAlternateFileName="")) returned 0x2e8558 [0246.707] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="background.png", cAlternateFileName="")) returned 0 [0246.707] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0246.707] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png")) returned 0 [0246.707] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png")) returned 0x20 [0246.708] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c5b0d9, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xc7c5b0d9, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xc7c5b0d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb61, dwReserved0=0x2dab38, dwReserved1=0x18edec, cFileName="behavior.xml", cAlternateFileName="")) returned 1 [0246.708] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0246.710] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0246.711] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb61 [0246.711] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0246.712] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0246.822] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb61, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0xb61, lpOverlapped=0x0) returned 1 [0246.823] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0xb70, lpOverlapped=0x0) returned 1 [0246.824] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0246.847] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0246.857] CloseHandle (hObject=0xec) returned 1 [0246.857] CloseHandle (hObject=0xd8) returned 1 [0246.858] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml.dvodltmf")) returned 0 [0246.858] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml.dvodltmf")) returned 0x20 [0246.858] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c5b0d9, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xc7c5b0d9, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xc7c5b0d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb61, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="behavior.xml", cAlternateFileName="")) returned 0x2e8558 [0246.858] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c5b0d9, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xc7c5b0d9, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xc7c5b0d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb61, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="behavior.xml", cAlternateFileName="")) returned 0 [0246.858] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0246.858] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml")) returned 0 [0246.858] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml")) returned 0x20 [0246.859] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xadc8, dwReserved0=0x2dab38, dwReserved1=0x18edec, cFileName="device.png", cAlternateFileName="")) returned 1 [0246.859] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0246.859] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0246.860] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xadc8 [0246.860] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0246.860] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0246.955] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xadc8, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0xadc8, lpOverlapped=0x0) returned 1 [0246.958] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xadd0, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0xadd0, lpOverlapped=0x0) returned 1 [0246.960] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0246.982] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0246.993] CloseHandle (hObject=0xd8) returned 1 [0246.993] CloseHandle (hObject=0xec) returned 1 [0246.993] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.dvodltmf")) returned 0 [0246.993] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.dvodltmf")) returned 0x20 [0246.994] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xadc8, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="device.png", cAlternateFileName="")) returned 0x2e8558 [0246.994] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xadc8, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="device.png", cAlternateFileName="")) returned 0 [0246.994] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0246.994] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png")) returned 0 [0246.994] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png")) returned 0x20 [0246.994] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0a07cc, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0a07cc, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x2dab38, dwReserved1=0x18edec, cFileName="overlay.png", cAlternateFileName="")) returned 1 [0246.994] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0246.995] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0246.995] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x70c1 [0246.995] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0246.995] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0247.085] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x70c1, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x70c1, lpOverlapped=0x0) returned 1 [0247.087] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x70d0, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x70d0, lpOverlapped=0x0) returned 1 [0247.089] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0247.113] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0247.125] CloseHandle (hObject=0xec) returned 1 [0247.125] CloseHandle (hObject=0xd8) returned 1 [0247.125] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.dvodltmf")) returned 0 [0247.125] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.dvodltmf")) returned 0x20 [0247.125] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0a07cc, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0a07cc, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="overlay.png", cAlternateFileName="")) returned 0x2e8558 [0247.125] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0a07cc, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0a07cc, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="overlay.png", cAlternateFileName="")) returned 0 [0247.125] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0247.126] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png")) returned 0 [0247.126] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png")) returned 0x20 [0247.126] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0c6929, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0c6929, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x2dab38, dwReserved1=0x18edec, cFileName="superbar.png", cAlternateFileName="")) returned 1 [0247.126] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0247.127] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0247.127] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x99d3 [0247.127] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0247.128] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0247.217] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x99d3, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x99d3, lpOverlapped=0x0) returned 1 [0247.251] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x99e0, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x99e0, lpOverlapped=0x0) returned 1 [0247.253] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0247.275] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0247.286] CloseHandle (hObject=0xd8) returned 1 [0247.286] CloseHandle (hObject=0xec) returned 1 [0247.286] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.dvodltmf")) returned 0 [0247.287] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.dvodltmf")) returned 0x20 [0247.287] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0c6929, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0c6929, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="superbar.png", cAlternateFileName="")) returned 0x2e8558 [0247.287] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0c6929, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0c6929, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="superbar.png", cAlternateFileName="")) returned 0 [0247.287] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0247.287] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png")) returned 0 [0247.287] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png")) returned 0x20 [0247.287] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0c6929, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0c6929, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x2dab38, dwReserved1=0x18edec, cFileName="superbar.png", cAlternateFileName="")) returned 0 [0247.288] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0247.288] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64676e67, dwReserved1=0x62643262, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 1 [0247.288] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dab38, dwReserved1=0x18edec, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0247.288] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dab38, dwReserved1=0x18edec, cFileName="..", cAlternateFileName="")) returned 1 [0247.288] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c0af2f7, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x9c0af2f7, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x9c0af2f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x2dab38, dwReserved1=0x18edec, cFileName="background.png", cAlternateFileName="")) returned 1 [0247.288] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0247.288] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0247.290] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1fad1 [0247.291] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0247.291] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0247.397] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1fad1, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x1fad1, lpOverlapped=0x0) returned 1 [0247.402] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1fae0, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x1fae0, lpOverlapped=0x0) returned 1 [0247.405] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0247.429] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0247.440] CloseHandle (hObject=0xec) returned 1 [0247.440] CloseHandle (hObject=0xd8) returned 1 [0247.441] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.dvodltmf")) returned 0 [0247.441] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.dvodltmf")) returned 0x20 [0247.442] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c0af2f7, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x9c0af2f7, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x9c0af2f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="background.png", cAlternateFileName="")) returned 0x2e8558 [0247.442] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c0af2f7, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x9c0af2f7, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x9c0af2f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="background.png", cAlternateFileName="")) returned 0 [0247.442] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0247.442] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png")) returned 0 [0247.442] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png")) returned 0x20 [0247.442] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2feb941, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2feb941, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x769, dwReserved0=0x2dab38, dwReserved1=0x18edec, cFileName="behavior.xml", cAlternateFileName="")) returned 1 [0247.442] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0247.443] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0247.444] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x769 [0247.444] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0247.444] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0247.538] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x769, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x769, lpOverlapped=0x0) returned 1 [0247.539] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x770, lpOverlapped=0x0) returned 1 [0247.540] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0247.563] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0247.577] CloseHandle (hObject=0xd8) returned 1 [0247.577] CloseHandle (hObject=0xec) returned 1 [0247.577] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml.dvodltmf")) returned 0 [0247.577] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml.dvodltmf")) returned 0x20 [0247.577] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2feb941, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2feb941, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x769, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="behavior.xml", cAlternateFileName="")) returned 0x2e8558 [0247.578] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2feb941, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2feb941, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x769, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="behavior.xml", cAlternateFileName="")) returned 0 [0247.578] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0247.578] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml")) returned 0 [0247.578] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml")) returned 0x20 [0247.578] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3011a9e, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd3011a9e, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x2dab38, dwReserved1=0x18edec, cFileName="watermark.png", cAlternateFileName="")) returned 1 [0247.578] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0247.578] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0247.579] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x70c1 [0247.579] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0247.579] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0247.669] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x70c1, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x70c1, lpOverlapped=0x0) returned 1 [0247.671] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x70d0, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x70d0, lpOverlapped=0x0) returned 1 [0247.673] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0247.695] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0247.706] CloseHandle (hObject=0xec) returned 1 [0247.707] CloseHandle (hObject=0xd8) returned 1 [0247.707] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.dvodltmf")) returned 0 [0247.707] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.dvodltmf")) returned 0x20 [0247.707] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3011a9e, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd3011a9e, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="watermark.png", cAlternateFileName="")) returned 0x2e8558 [0247.708] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3011a9e, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd3011a9e, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="watermark.png", cAlternateFileName="")) returned 0 [0247.708] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0247.708] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png")) returned 0 [0247.708] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png")) returned 0x20 [0247.708] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3011a9e, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd3011a9e, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x2dab38, dwReserved1=0x18edec, cFileName="watermark.png", cAlternateFileName="")) returned 0 [0247.708] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0247.708] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64676e67, dwReserved1=0x62643262, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 0 [0247.708] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0247.708] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d646161, dwReserved1=0x34373634, cFileName="Task", cAlternateFileName="")) returned 1 [0247.708] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6467676e, dwReserved1=0x62643262, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0247.708] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6467676e, dwReserved1=0x62643262, cFileName="..", cAlternateFileName="")) returned 1 [0247.709] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6467676e, dwReserved1=0x62643262, cFileName="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", cAlternateFileName="{07DEB~1")) returned 1 [0247.709] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dab38, dwReserved1=0x18edec, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0247.711] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dab38, dwReserved1=0x18edec, cFileName="..", cAlternateFileName="")) returned 1 [0247.711] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dab38, dwReserved1=0x18edec, cFileName="en-US", cAlternateFileName="")) returned 1 [0247.711] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0247.711] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.711] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x932b6af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x932b6af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0247.711] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0247.712] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0247.713] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x536 [0247.713] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0247.713] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0247.805] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x536, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x536, lpOverlapped=0x0) returned 1 [0247.806] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x540, lpOverlapped=0x0) returned 1 [0247.807] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0247.830] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0247.841] CloseHandle (hObject=0xec) returned 1 [0247.841] CloseHandle (hObject=0xe0) returned 1 [0247.841] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml.dvodltmf")) returned 0 [0247.841] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml.dvodltmf")) returned 0x20 [0247.841] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x932b6af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x932b6af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="resource.xml", cAlternateFileName="")) returned 0x2e8598 [0247.842] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x932b6af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x932b6af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="resource.xml", cAlternateFileName="")) returned 0 [0247.842] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0247.842] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml")) returned 0 [0247.842] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml")) returned 0x20 [0247.842] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x932b6af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x932b6af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 0 [0247.842] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0247.842] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c7f9e6, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2c7f9e6, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x2dab6c, dwReserved1=0x18edec, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0247.842] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0247.842] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0247.843] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd0a3 [0247.843] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0247.843] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0247.935] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd0a3, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0xd0a3, lpOverlapped=0x0) returned 1 [0247.946] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd0b0, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0xd0b0, lpOverlapped=0x0) returned 1 [0247.948] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0247.971] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0247.982] CloseHandle (hObject=0xd8) returned 1 [0247.982] CloseHandle (hObject=0xe0) returned 1 [0247.982] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico.dvodltmf")) returned 0 [0247.982] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico.dvodltmf")) returned 0x20 [0247.982] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c7f9e6, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2c7f9e6, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="folder.ico", cAlternateFileName="")) returned 0x2e8558 [0247.983] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c7f9e6, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2c7f9e6, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="folder.ico", cAlternateFileName="")) returned 0 [0247.983] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0247.983] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico")) returned 0 [0247.983] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico")) returned 0x20 [0247.983] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2db04ce, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2db04ce, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x72ee, dwReserved0=0x2dab38, dwReserved1=0x18edec, cFileName="netfol.ico", cAlternateFileName="")) returned 1 [0247.983] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0247.984] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0247.984] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x72ee [0247.984] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0247.985] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0248.075] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x72ee, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x72ee, lpOverlapped=0x0) returned 1 [0248.077] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x72f0, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x72f0, lpOverlapped=0x0) returned 1 [0248.079] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0248.102] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0248.114] CloseHandle (hObject=0xe0) returned 1 [0248.114] CloseHandle (hObject=0xd8) returned 1 [0248.114] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico.dvodltmf")) returned 0 [0248.114] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico.dvodltmf")) returned 0x20 [0248.114] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2db04ce, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2db04ce, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x72ee, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="netfol.ico", cAlternateFileName="")) returned 0x2e8558 [0248.115] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2db04ce, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2db04ce, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x72ee, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="netfol.ico", cAlternateFileName="")) returned 0 [0248.115] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0248.115] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico")) returned 0 [0248.115] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico")) returned 0x20 [0248.115] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2ca5b43, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2ca5b43, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c10f535, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x14668, dwReserved0=0x2dab38, dwReserved1=0x18edec, cFileName="pictures.ico", cAlternateFileName="")) returned 1 [0248.115] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0248.115] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0248.116] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14668 [0248.116] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0248.116] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0248.206] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x14668, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x14668, lpOverlapped=0x0) returned 1 [0248.209] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x14670, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x14670, lpOverlapped=0x0) returned 1 [0248.211] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0248.236] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0248.247] CloseHandle (hObject=0xd8) returned 1 [0248.247] CloseHandle (hObject=0xe0) returned 1 [0248.247] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico.dvodltmf")) returned 0 [0248.247] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico.dvodltmf")) returned 0x20 [0248.247] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2ca5b43, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2ca5b43, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c10f535, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x14668, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="pictures.ico", cAlternateFileName="")) returned 0x2e8558 [0248.248] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2ca5b43, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2ca5b43, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c10f535, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x14668, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="pictures.ico", cAlternateFileName="")) returned 0 [0248.248] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0248.248] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico")) returned 0 [0248.248] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico")) returned 0x20 [0248.248] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c59889, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2c59889, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1cdc0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x2dab38, dwReserved1=0x18edec, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0248.248] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0248.249] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0248.250] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x536 [0248.250] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0248.250] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0248.342] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x536, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x536, lpOverlapped=0x0) returned 1 [0248.344] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x540, lpOverlapped=0x0) returned 1 [0248.345] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0248.382] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0248.393] CloseHandle (hObject=0xe0) returned 1 [0248.393] CloseHandle (hObject=0xd8) returned 1 [0248.393] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml.dvodltmf")) returned 0 [0248.394] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml.dvodltmf")) returned 0x20 [0248.394] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c59889, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2c59889, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1cdc0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="resource.xml", cAlternateFileName="")) returned 0x2e8558 [0248.394] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c59889, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2c59889, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1cdc0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="resource.xml", cAlternateFileName="")) returned 0 [0248.394] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0248.394] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml")) returned 0 [0248.394] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml")) returned 0x20 [0248.394] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2cf1dfd, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2cf1dfd, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1f3d69, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xcaa9, dwReserved0=0x2dab38, dwReserved1=0x18edec, cFileName="ringtones.ico", cAlternateFileName="")) returned 1 [0248.394] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0248.395] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0248.395] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcaa9 [0248.395] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0248.396] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0248.486] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xcaa9, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0xcaa9, lpOverlapped=0x0) returned 1 [0249.113] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xcab0, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0xcab0, lpOverlapped=0x0) returned 1 [0249.115] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0249.139] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0249.150] CloseHandle (hObject=0xd8) returned 1 [0249.150] CloseHandle (hObject=0xe0) returned 1 [0249.151] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico.dvodltmf")) returned 0 [0249.151] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico.dvodltmf")) returned 0x20 [0249.151] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2cf1dfd, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2cf1dfd, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1f3d69, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xcaa9, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ringtones.ico", cAlternateFileName="")) returned 0x2e8558 [0249.151] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2cf1dfd, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2cf1dfd, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1f3d69, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xcaa9, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ringtones.ico", cAlternateFileName="")) returned 0 [0249.151] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0249.151] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico")) returned 0 [0249.151] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico")) returned 0x20 [0249.151] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d17f5a, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d17f5a, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1f3d69, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x10850, dwReserved0=0x2dab38, dwReserved1=0x18edec, cFileName="settings.ico", cAlternateFileName="")) returned 1 [0249.152] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0249.152] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0249.152] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10850 [0249.152] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0249.153] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0249.242] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x10850, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x10850, lpOverlapped=0x0) returned 1 [0249.245] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10860, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x10860, lpOverlapped=0x0) returned 1 [0249.247] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0249.270] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0249.281] CloseHandle (hObject=0xe0) returned 1 [0249.281] CloseHandle (hObject=0xd8) returned 1 [0249.281] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico.dvodltmf")) returned 0 [0249.281] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico.dvodltmf")) returned 0x20 [0249.281] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d17f5a, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d17f5a, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1f3d69, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x10850, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="settings.ico", cAlternateFileName="")) returned 0x2e8558 [0249.282] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d17f5a, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d17f5a, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1f3d69, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x10850, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="settings.ico", cAlternateFileName="")) returned 0 [0249.282] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0249.282] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico")) returned 0 [0249.282] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico")) returned 0x20 [0249.282] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d3e0b7, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d3e0b7, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xc04b, dwReserved0=0x2dab38, dwReserved1=0x18edec, cFileName="sync.ico", cAlternateFileName="")) returned 1 [0249.282] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0249.282] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0249.283] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc04b [0249.283] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0249.283] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0249.428] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xc04b, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0xc04b, lpOverlapped=0x0) returned 1 [0249.431] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc050, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0xc050, lpOverlapped=0x0) returned 1 [0249.432] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0249.455] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0249.466] CloseHandle (hObject=0xd8) returned 1 [0249.466] CloseHandle (hObject=0xe0) returned 1 [0249.467] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico.dvodltmf")) returned 0 [0249.467] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico.dvodltmf")) returned 0x20 [0249.467] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d3e0b7, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d3e0b7, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xc04b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="sync.ico", cAlternateFileName="")) returned 0x2e8558 [0249.467] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d3e0b7, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d3e0b7, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xc04b, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="sync.ico", cAlternateFileName="")) returned 0 [0249.467] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0249.467] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico")) returned 0 [0249.467] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico")) returned 0x20 [0249.467] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c219ec7, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x7c219ec7, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3473, dwReserved0=0x2dab38, dwReserved1=0x18edec, cFileName="tasks.xml", cAlternateFileName="")) returned 1 [0249.468] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0249.468] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0249.469] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3473 [0249.469] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0249.470] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0249.567] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3473, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x3473, lpOverlapped=0x0) returned 1 [0249.569] WriteFile (in: hFile=0xd8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3480, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x3480, lpOverlapped=0x0) returned 1 [0249.570] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0249.593] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0249.604] CloseHandle (hObject=0xe0) returned 1 [0249.604] CloseHandle (hObject=0xd8) returned 1 [0249.604] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml.dvodltmf")) returned 0 [0249.605] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml.dvodltmf")) returned 0x20 [0249.605] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c219ec7, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x7c219ec7, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3473, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="tasks.xml", cAlternateFileName="")) returned 0x2e8558 [0249.605] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c219ec7, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x7c219ec7, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3473, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="tasks.xml", cAlternateFileName="")) returned 0 [0249.605] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0249.605] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml")) returned 0 [0249.605] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml")) returned 0x20 [0249.605] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d64214, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d64214, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x2dab38, dwReserved1=0x18edec, cFileName="wmp.ico", cAlternateFileName="")) returned 1 [0249.605] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0249.606] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0249.606] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b9f4 [0249.606] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0249.607] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0249.697] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1b9f4, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x1b9f4, lpOverlapped=0x0) returned 1 [0249.701] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1ba00, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x1ba00, lpOverlapped=0x0) returned 1 [0249.703] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0249.726] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0249.737] CloseHandle (hObject=0xd8) returned 1 [0249.737] CloseHandle (hObject=0xe0) returned 1 [0249.737] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico.dvodltmf")) returned 0 [0249.738] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico.dvodltmf")) returned 0x20 [0249.738] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d64214, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d64214, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="wmp.ico", cAlternateFileName="")) returned 0x2e8558 [0249.738] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d64214, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d64214, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="wmp.ico", cAlternateFileName="")) returned 0 [0249.738] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0249.738] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico")) returned 0 [0249.738] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico")) returned 0x20 [0249.738] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d64214, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d64214, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x2dab38, dwReserved1=0x18edec, cFileName="wmp.ico", cAlternateFileName="")) returned 0 [0249.738] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0249.738] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64676f6f, dwReserved1=0x62643262, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 1 [0249.738] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dab38, dwReserved1=0x18edec, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0249.741] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dab38, dwReserved1=0x18edec, cFileName="..", cAlternateFileName="")) returned 1 [0249.741] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dab38, dwReserved1=0x18edec, cFileName="en-US", cAlternateFileName="")) returned 1 [0249.741] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xba, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8558 [0249.741] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xba, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.741] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0xba, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0249.741] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0249.742] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0249.742] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5e8 [0249.743] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0249.743] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0249.850] ReadFile (in: hFile=0xd8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x5e8, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18eb78*=0x5e8, lpOverlapped=0x0) returned 1 [0249.851] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18eb78*=0x5f0, lpOverlapped=0x0) returned 1 [0249.852] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0249.875] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0249.886] CloseHandle (hObject=0xd8) returned 1 [0249.886] CloseHandle (hObject=0xec) returned 1 [0249.886] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml.dvodltmf")) returned 0 [0249.886] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml.dvodltmf")) returned 0x20 [0249.886] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml", lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="resource.xml", cAlternateFileName="")) returned 0x2e8598 [0249.886] FindNextFileA (in: hFindFile=0x2e8598, lpFindFileData=0x18ea74 | out: lpFindFileData=0x18ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="resource.xml", cAlternateFileName="")) returned 0 [0249.886] FindClose (in: hFindFile=0x2e8598 | out: hFindFile=0x2e8598) returned 1 [0249.886] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml")) returned 0 [0249.887] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml")) returned 0x20 [0249.887] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0xba, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 0 [0249.887] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0249.887] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78a2eab, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x2dab6c, dwReserved1=0x18edec, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0249.887] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0249.887] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0249.888] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd0a3 [0249.888] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0249.888] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0249.985] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd0a3, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0xd0a3, lpOverlapped=0x0) returned 1 [0249.988] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd0b0, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0xd0b0, lpOverlapped=0x0) returned 1 [0249.989] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0250.012] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0250.023] CloseHandle (hObject=0xe0) returned 1 [0250.023] CloseHandle (hObject=0xec) returned 1 [0250.023] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico.dvodltmf")) returned 0 [0250.023] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico.dvodltmf")) returned 0x20 [0250.023] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78a2eab, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="folder.ico", cAlternateFileName="")) returned 0x2e8558 [0250.024] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78a2eab, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="folder.ico", cAlternateFileName="")) returned 0 [0250.024] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0250.024] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico")) returned 0 [0250.024] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico")) returned 0x20 [0250.024] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0eca86, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0eca86, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78c9009, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xe3c8, dwReserved0=0x2dab38, dwReserved1=0x18edec, cFileName="print_pref.ico", cAlternateFileName="")) returned 1 [0250.024] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0250.024] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0250.025] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe3c8 [0250.025] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0250.025] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0250.115] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xe3c8, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0xe3c8, lpOverlapped=0x0) returned 1 [0250.118] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe3d0, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0xe3d0, lpOverlapped=0x0) returned 1 [0250.120] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0250.143] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0250.153] CloseHandle (hObject=0xec) returned 1 [0250.154] CloseHandle (hObject=0xe0) returned 1 [0250.154] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico.dvodltmf")) returned 0 [0250.154] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico.dvodltmf")) returned 0x20 [0250.154] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0eca86, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0eca86, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78c9009, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xe3c8, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="print_pref.ico", cAlternateFileName="")) returned 0x2e8558 [0250.154] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0eca86, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0eca86, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78c9009, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xe3c8, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="print_pref.ico", cAlternateFileName="")) returned 0 [0250.154] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0250.154] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico")) returned 0 [0250.155] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico")) returned 0x20 [0250.155] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0eca86, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0eca86, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78c9009, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xebb8, dwReserved0=0x2dab38, dwReserved1=0x18edec, cFileName="print_property.ico", cAlternateFileName="")) returned 1 [0250.155] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0250.155] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0250.159] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xebb8 [0250.159] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0250.159] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0250.251] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xebb8, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0xebb8, lpOverlapped=0x0) returned 1 [0250.254] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xebc0, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0xebc0, lpOverlapped=0x0) returned 1 [0250.256] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0250.278] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0250.289] CloseHandle (hObject=0xe0) returned 1 [0250.289] CloseHandle (hObject=0xec) returned 1 [0250.289] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico.dvodltmf")) returned 0 [0250.289] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico.dvodltmf")) returned 0x20 [0250.289] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0eca86, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0eca86, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78c9009, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xebb8, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="print_property.ico", cAlternateFileName="")) returned 0x2e8558 [0250.289] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0eca86, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0eca86, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78c9009, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xebb8, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="print_property.ico", cAlternateFileName="")) returned 0 [0250.290] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0250.290] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico")) returned 0 [0250.290] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico")) returned 0x20 [0250.290] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f112be3, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f112be3, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7be8cbf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xdff5, dwReserved0=0x2dab38, dwReserved1=0x18edec, cFileName="print_queue.ico", cAlternateFileName="")) returned 1 [0250.290] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0250.291] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0250.292] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdff5 [0250.292] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0250.292] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0250.388] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xdff5, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0xdff5, lpOverlapped=0x0) returned 1 [0250.390] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xe000, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0xe000, lpOverlapped=0x0) returned 1 [0250.392] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0250.415] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0250.426] CloseHandle (hObject=0xec) returned 1 [0250.426] CloseHandle (hObject=0xe0) returned 1 [0250.426] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico.dvodltmf")) returned 0 [0250.426] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico.dvodltmf")) returned 0x20 [0250.427] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f112be3, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f112be3, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7be8cbf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xdff5, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="print_queue.ico", cAlternateFileName="")) returned 0x2e8558 [0250.427] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f112be3, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f112be3, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7be8cbf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xdff5, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="print_queue.ico", cAlternateFileName="")) returned 0 [0250.427] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0250.427] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico")) returned 0 [0250.427] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico")) returned 0x20 [0250.427] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f138d40, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f138d40, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c0ee1d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xec75, dwReserved0=0x2dab38, dwReserved1=0x18edec, cFileName="scan_.ico", cAlternateFileName="")) returned 1 [0250.427] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0250.427] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0250.428] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xec75 [0250.428] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0250.428] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0250.525] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xec75, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0xec75, lpOverlapped=0x0) returned 1 [0250.528] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xec80, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0xec80, lpOverlapped=0x0) returned 1 [0250.530] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0250.553] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0250.564] CloseHandle (hObject=0xe0) returned 1 [0250.564] CloseHandle (hObject=0xec) returned 1 [0250.564] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico.dvodltmf")) returned 0 [0250.564] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico.dvodltmf")) returned 0x20 [0250.564] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f138d40, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f138d40, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c0ee1d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xec75, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="scan_.ico", cAlternateFileName="")) returned 0x2e8558 [0250.565] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f138d40, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f138d40, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c0ee1d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xec75, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="scan_.ico", cAlternateFileName="")) returned 0 [0250.565] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0250.565] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico")) returned 0 [0250.565] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico")) returned 0x20 [0250.565] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c0ee1d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x10654, dwReserved0=0x2dab38, dwReserved1=0x18edec, cFileName="scan_property.ico", cAlternateFileName="")) returned 1 [0250.565] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0250.565] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0250.566] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10654 [0250.566] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0250.566] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0250.659] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x10654, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x10654, lpOverlapped=0x0) returned 1 [0250.661] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x10660, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x10660, lpOverlapped=0x0) returned 1 [0250.663] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0250.687] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0250.698] CloseHandle (hObject=0xec) returned 1 [0250.698] CloseHandle (hObject=0xe0) returned 1 [0250.698] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico.dvodltmf")) returned 0 [0250.699] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico.dvodltmf")) returned 0x20 [0250.699] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c0ee1d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x10654, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="scan_property.ico", cAlternateFileName="")) returned 0x2e8558 [0250.699] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c0ee1d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x10654, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="scan_property.ico", cAlternateFileName="")) returned 0 [0250.699] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0250.699] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico")) returned 0 [0250.699] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico")) returned 0x20 [0250.699] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f138d40, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f138d40, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c34f7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xf8c2, dwReserved0=0x2dab38, dwReserved1=0x18edec, cFileName="scan_settings.ico", cAlternateFileName="")) returned 1 [0250.699] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0250.700] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0250.700] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf8c2 [0250.700] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0250.701] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0250.799] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xf8c2, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0xf8c2, lpOverlapped=0x0) returned 1 [0250.801] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xf8d0, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0xf8d0, lpOverlapped=0x0) returned 1 [0250.803] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0250.826] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0250.838] CloseHandle (hObject=0xe0) returned 1 [0250.838] CloseHandle (hObject=0xec) returned 1 [0250.838] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico.dvodltmf")) returned 0 [0250.838] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico.dvodltmf")) returned 0x20 [0250.838] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f138d40, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f138d40, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c34f7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xf8c2, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="scan_settings.ico", cAlternateFileName="")) returned 0x2e8558 [0250.839] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f138d40, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f138d40, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c34f7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xf8c2, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="scan_settings.ico", cAlternateFileName="")) returned 0 [0250.839] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0250.839] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico")) returned 0 [0250.839] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico")) returned 0x20 [0250.839] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f054512, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f054512, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7d3f90d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x2dab38, dwReserved1=0x18edec, cFileName="tasks.xml", cAlternateFileName="")) returned 1 [0250.839] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0250.839] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0250.840] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c64 [0250.840] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0250.840] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0250.932] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2c64, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x2c64, lpOverlapped=0x0) returned 1 [0250.934] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2c70, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x2c70, lpOverlapped=0x0) returned 1 [0250.935] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0250.958] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0250.969] CloseHandle (hObject=0xec) returned 1 [0250.969] CloseHandle (hObject=0xe0) returned 1 [0250.969] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml.dvodltmf")) returned 0 [0250.969] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml.dvodltmf")) returned 0x20 [0250.969] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f054512, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f054512, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7d3f90d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="tasks.xml", cAlternateFileName="")) returned 0x2e8558 [0250.970] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f054512, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f054512, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7d3f90d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="tasks.xml", cAlternateFileName="")) returned 0 [0250.970] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0250.970] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml")) returned 0 [0250.970] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml")) returned 0x20 [0250.970] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f054512, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f054512, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7d3f90d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x2dab38, dwReserved1=0x18edec, cFileName="tasks.xml", cAlternateFileName="")) returned 0 [0250.970] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0250.970] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64676f6f, dwReserved1=0x62643262, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 0 [0250.970] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0250.970] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d646161, dwReserved1=0x34373634, cFileName="Task", cAlternateFileName="")) returned 0 [0250.970] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0250.970] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d302e, dwReserved1=0x18f524, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1 [0250.970] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0250.978] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="..", cAlternateFileName="")) returned 1 [0250.978] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="..", cAlternateFileName="")) returned 0 [0250.978] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0250.978] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d302e, dwReserved1=0x18f524, cFileName="DRM", cAlternateFileName="")) returned 1 [0250.978] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0250.979] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="..", cAlternateFileName="")) returned 1 [0250.979] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="Server", cAlternateFileName="")) returned 1 [0250.979] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0250.979] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName="..", cAlternateFileName="")) returned 1 [0250.979] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName="..", cAlternateFileName="")) returned 0 [0250.979] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0250.979] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="Server", cAlternateFileName="")) returned 0 [0250.979] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0250.979] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d302e, dwReserved1=0x18f524, cFileName="eHome", cAlternateFileName="")) returned 1 [0250.979] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0250.980] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="..", cAlternateFileName="")) returned 1 [0250.980] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="logs", cAlternateFileName="")) returned 1 [0250.980] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0250.980] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName="..", cAlternateFileName="")) returned 1 [0250.980] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName="..", cAlternateFileName="")) returned 0 [0250.980] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0250.980] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="logs", cAlternateFileName="")) returned 0 [0250.980] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0250.980] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d302e, dwReserved1=0x18f524, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1 [0250.980] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0250.981] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="..", cAlternateFileName="")) returned 1 [0250.981] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="Views", cAlternateFileName="")) returned 1 [0250.981] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0250.981] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName="..", cAlternateFileName="")) returned 1 [0250.981] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName="ApplicationViewsRootNode", cAlternateFileName="APPLIC~1")) returned 1 [0250.981] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0250.981] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.981] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.981] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0250.981] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName="ApplicationViewsRootNode", cAlternateFileName="APPLIC~1")) returned 0 [0250.981] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0250.981] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="Views", cAlternateFileName="")) returned 0 [0250.981] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0250.982] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d302e, dwReserved1=0x18f524, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1 [0250.982] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0250.982] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="..", cAlternateFileName="")) returned 1 [0250.982] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd591378b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd591378b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac29de1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3d00, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="ppcrlconfig.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 1 [0250.982] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlconfig.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlconfig.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd0 [0250.982] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlconfig.dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlconfig.dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0250.985] GetFileSize (in: hFile=0xd0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d00 [0250.985] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0250.985] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0251.075] ReadFile (in: hFile=0xd0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3d00, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x3d00, lpOverlapped=0x0) returned 1 [0251.076] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3d10, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x3d10, lpOverlapped=0x0) returned 1 [0251.078] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0251.100] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0251.112] CloseHandle (hObject=0xd0) returned 1 [0251.112] CloseHandle (hObject=0xe8) returned 1 [0251.112] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlconfig.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlconfig.dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlconfig.dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlconfig.dll.dvodltmf")) returned 0 [0251.113] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlconfig.dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlconfig.dll.dvodltmf")) returned 0x20 [0251.113] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlconfig.dll", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd591378b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd591378b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac29de1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3d00, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="ppcrlconfig.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 0x2e84d8 [0251.113] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd591378b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd591378b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac29de1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3d00, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="ppcrlconfig.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 0 [0251.113] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0251.113] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlconfig.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlconfig.dll")) returned 1 [0251.114] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlconfig.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlconfig.dll")) returned 0xffffffff [0251.114] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd582ef5d, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd582ef5d, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac4ff3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3e108, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlui.dll", cAlternateFileName="")) returned 1 [0251.114] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlui.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0251.115] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlui.dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlui.dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd0 [0251.116] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e108 [0251.116] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0251.116] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0251.205] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3e108, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x3e108, lpOverlapped=0x0) returned 1 [0251.213] WriteFile (in: hFile=0xd0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3e110, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x3e110, lpOverlapped=0x0) returned 1 [0251.220] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0251.243] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0251.255] CloseHandle (hObject=0xe8) returned 1 [0251.255] CloseHandle (hObject=0xd0) returned 1 [0251.255] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlui.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlui.dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlui.dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlui.dll.dvodltmf")) returned 0 [0251.256] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlui.dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlui.dll.dvodltmf")) returned 0x20 [0251.256] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlui.dll", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd582ef5d, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd582ef5d, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac4ff3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3e108, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ppcrlui.dll", cAlternateFileName="")) returned 0x2e84d8 [0251.256] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd582ef5d, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd582ef5d, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac4ff3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3e108, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ppcrlui.dll", cAlternateFileName="")) returned 0 [0251.256] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0251.256] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlui.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlui.dll")) returned 1 [0251.259] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlui.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlui.dll")) returned 0xffffffff [0251.259] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd582ef5d, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd582ef5d, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac4ff3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3e108, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlui.dll", cAlternateFileName="")) returned 0 [0251.259] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0251.259] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3ee349fc, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3ee349fc, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c642e, dwReserved1=0x18f524, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1 [0251.259] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3ee349fc, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3ee349fc, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dab38, dwReserved1=0x18f2bc, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0251.259] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3ee349fc, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3ee349fc, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dab38, dwReserved1=0x18f2bc, cFileName="..", cAlternateFileName="")) returned 1 [0251.259] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3ee349fc, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3ee349fc, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dab38, dwReserved1=0x18f2bc, cFileName="..", cAlternateFileName="")) returned 0 [0251.259] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0251.259] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c642e, dwReserved1=0x18f524, cFileName="MF", cAlternateFileName="")) returned 1 [0251.259] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dab38, dwReserved1=0x18f2bc, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0251.260] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dab38, dwReserved1=0x18f2bc, cFileName="..", cAlternateFileName="")) returned 1 [0251.260] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x2dab38, dwReserved1=0x18f2bc, cFileName="Active.GRL", cAlternateFileName="")) returned 1 [0251.260] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL" (normalized: "c:\\users\\all users\\microsoft\\mf\\active.grl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd0 [0251.260] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\mf\\active.grl.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0251.261] GetFileSize (in: hFile=0xd0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a7c [0251.261] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0251.261] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0251.353] ReadFile (in: hFile=0xd0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3a7c, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x3a7c, lpOverlapped=0x0) returned 1 [0251.355] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3a80, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x3a80, lpOverlapped=0x0) returned 1 [0251.356] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0251.393] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0251.404] CloseHandle (hObject=0xd0) returned 1 [0251.404] CloseHandle (hObject=0xe8) returned 1 [0251.404] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL" (normalized: "c:\\users\\all users\\microsoft\\mf\\active.grl"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\mf\\active.grl.dvodltmf")) returned 0 [0251.405] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\mf\\active.grl.dvodltmf")) returned 0x2020 [0251.405] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Active.GRL", cAlternateFileName="")) returned 0x2e84d8 [0251.405] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="Active.GRL", cAlternateFileName="")) returned 0 [0251.405] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0251.406] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL" (normalized: "c:\\users\\all users\\microsoft\\mf\\active.grl")) returned 1 [0251.407] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL" (normalized: "c:\\users\\all users\\microsoft\\mf\\active.grl")) returned 0xffffffff [0251.407] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x2dab38, dwReserved1=0x18f2bc, cFileName="Pending.GRL", cAlternateFileName="")) returned 1 [0251.407] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL" (normalized: "c:\\users\\all users\\microsoft\\mf\\pending.grl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0251.407] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\mf\\pending.grl.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd0 [0251.407] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a7c [0251.407] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0251.408] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0251.498] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3a7c, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x3a7c, lpOverlapped=0x0) returned 1 [0251.500] WriteFile (in: hFile=0xd0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3a80, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x3a80, lpOverlapped=0x0) returned 1 [0251.501] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0251.524] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0251.535] CloseHandle (hObject=0xe8) returned 1 [0251.535] CloseHandle (hObject=0xd0) returned 1 [0251.535] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL" (normalized: "c:\\users\\all users\\microsoft\\mf\\pending.grl"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\mf\\pending.grl.dvodltmf")) returned 0 [0251.536] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\mf\\pending.grl.dvodltmf")) returned 0x2020 [0251.536] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Pending.GRL", cAlternateFileName="")) returned 0x2e84d8 [0251.536] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="Pending.GRL", cAlternateFileName="")) returned 0 [0251.537] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0251.537] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL" (normalized: "c:\\users\\all users\\microsoft\\mf\\pending.grl")) returned 1 [0251.538] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL" (normalized: "c:\\users\\all users\\microsoft\\mf\\pending.grl")) returned 0xffffffff [0251.538] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x2dab38, dwReserved1=0x18f2bc, cFileName="Pending.GRL", cAlternateFileName="")) returned 0 [0251.538] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0251.538] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c642e, dwReserved1=0x18f524, cFileName="MSDN", cAlternateFileName="")) returned 1 [0251.538] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dab38, dwReserved1=0x18f2bc, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0251.538] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dab38, dwReserved1=0x18f2bc, cFileName="..", cAlternateFileName="")) returned 1 [0251.538] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dab38, dwReserved1=0x18f2bc, cFileName="8.0", cAlternateFileName="")) returned 1 [0251.538] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x56, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0251.538] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x56, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.538] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x56, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.539] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0251.539] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dab38, dwReserved1=0x18f2bc, cFileName="8.0", cAlternateFileName="")) returned 0 [0251.539] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0251.539] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c642e, dwReserved1=0x18f524, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1 [0251.539] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dab38, dwReserved1=0x18f2bc, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0251.540] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dab38, dwReserved1=0x18f2bc, cFileName="..", cAlternateFileName="")) returned 1 [0251.540] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dab38, dwReserved1=0x18f2bc, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 1 [0251.540] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x56, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0251.540] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x56, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.540] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x56, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.540] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0251.540] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dab38, dwReserved1=0x18f2bc, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 0 [0251.540] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0251.540] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65726f74, dwReserved1=0x18f524, cFileName="Network", cAlternateFileName="")) returned 1 [0251.541] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dab38, dwReserved1=0x18f2bc, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0251.541] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dab38, dwReserved1=0x18f2bc, cFileName="..", cAlternateFileName="")) returned 1 [0251.541] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dab38, dwReserved1=0x18f2bc, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1 [0251.541] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x56, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0251.541] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x56, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.541] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x56, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.541] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0251.541] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dab38, dwReserved1=0x18f2bc, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 1 [0251.541] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x56, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0251.542] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x56, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.542] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xe0118910, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x56, dwReserved1=0x0, cFileName="qmgr0.dat", cAlternateFileName="")) returned 1 [0251.542] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr0.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0251.542] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr0.dat.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0251.543] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x400000 [0251.543] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0251.543] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0251.634] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x400000, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x400000, lpOverlapped=0x0) returned 1 [0251.723] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x400010, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x400010, lpOverlapped=0x0) returned 1 [0251.840] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0251.863] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0251.874] CloseHandle (hObject=0xe8) returned 1 [0251.874] CloseHandle (hObject=0xe0) returned 1 [0251.874] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr0.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr0.dat.dvodltmf")) returned 0 [0251.875] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr0.dat.dvodltmf")) returned 0x20 [0251.875] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xe0118910, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="qmgr0.dat", cAlternateFileName="")) returned 0x2e8518 [0251.875] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xe0118910, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="qmgr0.dat", cAlternateFileName="")) returned 0 [0251.875] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0251.875] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr0.dat")) returned 1 [0251.884] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr0.dat")) returned 0xffffffff [0251.884] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xdd404870, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x0, dwReserved1=0x0, cFileName="qmgr1.dat", cAlternateFileName="")) returned 1 [0251.884] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr1.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr1.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0251.884] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr1.dat.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr1.dat.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0251.887] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x400000 [0251.887] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0251.887] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0251.985] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x400000, lpNumberOfBytesRead=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f048*=0x400000, lpOverlapped=0x0) returned 1 [0252.084] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x400010, lpNumberOfBytesWritten=0x18f048, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f048*=0x400010, lpOverlapped=0x0) returned 1 [0252.169] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0252.191] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0252.203] CloseHandle (hObject=0xe0) returned 1 [0252.203] CloseHandle (hObject=0xe8) returned 1 [0252.203] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr1.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr1.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr1.dat.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr1.dat.dvodltmf")) returned 0 [0252.204] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr1.dat.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr1.dat.dvodltmf")) returned 0x20 [0252.204] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr1.dat", lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xdd404870, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="qmgr1.dat", cAlternateFileName="")) returned 0x2e8518 [0252.204] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18ef44 | out: lpFindFileData=0x18ef44*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xdd404870, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="qmgr1.dat", cAlternateFileName="")) returned 0 [0252.204] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0252.204] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr1.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr1.dat")) returned 1 [0252.213] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr1.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr1.dat")) returned 0xffffffff [0252.213] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xdd404870, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x0, dwReserved1=0x0, cFileName="qmgr1.dat", cAlternateFileName="")) returned 0 [0252.213] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0252.213] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dab38, dwReserved1=0x18f2bc, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 0 [0252.213] FindClose (in: hFindFile=0x2e8498 | out: hFindFile=0x2e8498) returned 1 [0252.213] FindNextFileA (in: hFindFile=0x2e8458, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65726f74, dwReserved1=0x18f524, cFileName="OFFICE", cAlternateFileName="")) returned 1 [0252.213] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dab38, dwReserved1=0x18f2bc, cFileName=".", cAlternateFileName="")) returned 0x2e8498 [0252.217] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dab38, dwReserved1=0x18f2bc, cFileName="..", cAlternateFileName="")) returned 1 [0252.217] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5011dd00, ftCreationTime.dwHighDateTime=0x1ca04ff, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5011dd00, ftLastWriteTime.dwHighDateTime=0x1ca04ff, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x2dab38, dwReserved1=0x18f2bc, cFileName="AssetLibrary.ico", cAlternateFileName="ASSETL~1.ICO")) returned 1 [0252.217] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\AssetLibrary.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\assetlibrary.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd0 [0252.218] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\AssetLibrary.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\assetlibrary.ico.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0252.218] GetFileSize (in: hFile=0xd0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1536 [0252.218] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0252.219] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0252.307] ReadFile (in: hFile=0xd0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1536, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x1536, lpOverlapped=0x0) returned 1 [0252.309] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1540, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x1540, lpOverlapped=0x0) returned 1 [0252.310] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0252.332] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0252.343] CloseHandle (hObject=0xd0) returned 1 [0252.343] CloseHandle (hObject=0xe8) returned 1 [0252.343] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\AssetLibrary.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\assetlibrary.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\AssetLibrary.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\assetlibrary.ico.dvodltmf")) returned 0 [0252.344] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\AssetLibrary.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\assetlibrary.ico.dvodltmf")) returned 0x2020 [0252.344] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\AssetLibrary.ico", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5011dd00, ftCreationTime.dwHighDateTime=0x1ca04ff, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5011dd00, ftLastWriteTime.dwHighDateTime=0x1ca04ff, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AssetLibrary.ico", cAlternateFileName="ASSETL~1.ICO")) returned 0x2e84d8 [0252.344] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5011dd00, ftCreationTime.dwHighDateTime=0x1ca04ff, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5011dd00, ftLastWriteTime.dwHighDateTime=0x1ca04ff, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="AssetLibrary.ico", cAlternateFileName="ASSETL~1.ICO")) returned 0 [0252.344] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0252.344] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\AssetLibrary.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\assetlibrary.ico")) returned 1 [0252.345] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\AssetLibrary.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\assetlibrary.ico")) returned 0xffffffff [0252.345] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabeeea00, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xabeeea00, ftLastWriteTime.dwHighDateTime=0x1c63848, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x2dab38, dwReserved1=0x18f2bc, cFileName="DocumentRepository.ico", cAlternateFileName="DOCUME~1.ICO")) returned 1 [0252.345] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\DocumentRepository.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\documentrepository.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0252.346] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\DocumentRepository.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\documentrepository.ico.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd0 [0252.347] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x627e [0252.347] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0252.347] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0252.451] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x627e, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x627e, lpOverlapped=0x0) returned 1 [0252.453] WriteFile (in: hFile=0xd0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x6280, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x6280, lpOverlapped=0x0) returned 1 [0252.454] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0252.476] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0252.487] CloseHandle (hObject=0xe8) returned 1 [0252.487] CloseHandle (hObject=0xd0) returned 1 [0252.487] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\DocumentRepository.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\documentrepository.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\DocumentRepository.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\documentrepository.ico.dvodltmf")) returned 0 [0252.488] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\DocumentRepository.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\documentrepository.ico.dvodltmf")) returned 0x2020 [0252.488] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\DocumentRepository.ico", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabeeea00, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xabeeea00, ftLastWriteTime.dwHighDateTime=0x1c63848, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="DocumentRepository.ico", cAlternateFileName="DOCUME~1.ICO")) returned 0x2e84d8 [0252.489] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabeeea00, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xabeeea00, ftLastWriteTime.dwHighDateTime=0x1c63848, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="DocumentRepository.ico", cAlternateFileName="DOCUME~1.ICO")) returned 0 [0252.489] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0252.489] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\DocumentRepository.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\documentrepository.ico")) returned 1 [0252.490] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\DocumentRepository.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\documentrepository.ico")) returned 0xffffffff [0252.490] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2bfbd800, ftCreationTime.dwHighDateTime=0x1c9facb, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bfbd800, ftLastWriteTime.dwHighDateTime=0x1c9facb, nFileSizeHigh=0x0, nFileSizeLow=0x5532e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MySharePoints.ico", cAlternateFileName="MYSHAR~1.ICO")) returned 1 [0252.490] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\MySharePoints.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\mysharepoints.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd0 [0252.491] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\MySharePoints.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\mysharepoints.ico.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0252.491] GetFileSize (in: hFile=0xd0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5532e [0252.491] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0252.492] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0252.581] ReadFile (in: hFile=0xd0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x5532e, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x5532e, lpOverlapped=0x0) returned 1 [0252.590] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x55330, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x55330, lpOverlapped=0x0) returned 1 [0252.597] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0252.619] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0252.631] CloseHandle (hObject=0xd0) returned 1 [0252.631] CloseHandle (hObject=0xe8) returned 1 [0252.631] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\MySharePoints.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\mysharepoints.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\MySharePoints.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\mysharepoints.ico.dvodltmf")) returned 0 [0252.632] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\MySharePoints.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\mysharepoints.ico.dvodltmf")) returned 0x2020 [0252.632] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\MySharePoints.ico", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2bfbd800, ftCreationTime.dwHighDateTime=0x1c9facb, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bfbd800, ftLastWriteTime.dwHighDateTime=0x1c9facb, nFileSizeHigh=0x0, nFileSizeLow=0x5532e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="MySharePoints.ico", cAlternateFileName="MYSHAR~1.ICO")) returned 0x2e84d8 [0252.633] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2bfbd800, ftCreationTime.dwHighDateTime=0x1c9facb, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bfbd800, ftLastWriteTime.dwHighDateTime=0x1c9facb, nFileSizeHigh=0x0, nFileSizeLow=0x5532e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="MySharePoints.ico", cAlternateFileName="MYSHAR~1.ICO")) returned 0 [0252.633] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0252.633] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\MySharePoints.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\mysharepoints.ico")) returned 1 [0252.636] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\MySharePoints.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\mysharepoints.ico")) returned 0xffffffff [0252.636] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc92d1d00, ftCreationTime.dwHighDateTime=0x1c627a2, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc92d1d00, ftLastWriteTime.dwHighDateTime=0x1c627a2, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x2dab38, dwReserved1=0x18f2bc, cFileName="MySite.ico", cAlternateFileName="")) returned 1 [0252.637] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\MySite.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\mysite.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0252.637] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\MySite.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\mysite.ico.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd0 [0252.638] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x627e [0252.638] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0252.638] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0252.730] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x627e, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x627e, lpOverlapped=0x0) returned 1 [0252.756] WriteFile (in: hFile=0xd0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x6280, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x6280, lpOverlapped=0x0) returned 1 [0252.757] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0252.781] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0252.791] CloseHandle (hObject=0xe8) returned 1 [0252.792] CloseHandle (hObject=0xd0) returned 1 [0252.792] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\MySite.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\mysite.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\MySite.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\mysite.ico.dvodltmf")) returned 0 [0252.793] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\MySite.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\mysite.ico.dvodltmf")) returned 0x2020 [0252.793] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\MySite.ico", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc92d1d00, ftCreationTime.dwHighDateTime=0x1c627a2, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc92d1d00, ftLastWriteTime.dwHighDateTime=0x1c627a2, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="MySite.ico", cAlternateFileName="")) returned 0x2e84d8 [0252.793] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc92d1d00, ftCreationTime.dwHighDateTime=0x1c627a2, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc92d1d00, ftLastWriteTime.dwHighDateTime=0x1c627a2, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="MySite.ico", cAlternateFileName="")) returned 0 [0252.793] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0252.793] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\MySite.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\mysite.ico")) returned 1 [0252.794] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\MySite.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\mysite.ico")) returned 0xffffffff [0252.794] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2444900, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2444900, ftLastWriteTime.dwHighDateTime=0x1c63848, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x2dab38, dwReserved1=0x18f2bc, cFileName="SharePointPortalSite.ico", cAlternateFileName="SHAREP~1.ICO")) returned 1 [0252.794] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointPortalSite.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\sharepointportalsite.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd0 [0252.795] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointPortalSite.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\sharepointportalsite.ico.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0252.796] GetFileSize (in: hFile=0xd0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x627e [0252.796] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0252.796] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0252.886] ReadFile (in: hFile=0xd0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x627e, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x627e, lpOverlapped=0x0) returned 1 [0252.888] WriteFile (in: hFile=0xe8, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x6280, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x6280, lpOverlapped=0x0) returned 1 [0252.889] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0252.913] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0252.924] CloseHandle (hObject=0xd0) returned 1 [0252.924] CloseHandle (hObject=0xe8) returned 1 [0252.924] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointPortalSite.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\sharepointportalsite.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointPortalSite.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\sharepointportalsite.ico.dvodltmf")) returned 0 [0252.925] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointPortalSite.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\sharepointportalsite.ico.dvodltmf")) returned 0x2020 [0252.925] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointPortalSite.ico", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2444900, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2444900, ftLastWriteTime.dwHighDateTime=0x1c63848, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="SharePointPortalSite.ico", cAlternateFileName="SHAREP~1.ICO")) returned 0x2e84d8 [0252.925] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2444900, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2444900, ftLastWriteTime.dwHighDateTime=0x1c63848, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="SharePointPortalSite.ico", cAlternateFileName="SHAREP~1.ICO")) returned 0 [0252.925] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0252.925] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointPortalSite.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\sharepointportalsite.ico")) returned 1 [0252.926] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointPortalSite.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\sharepointportalsite.ico")) returned 0xffffffff [0252.926] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad743900, ftCreationTime.dwHighDateTime=0x1c62706, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad743900, ftLastWriteTime.dwHighDateTime=0x1c62706, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x2dab38, dwReserved1=0x18f2bc, cFileName="SharePointTeamSite.ico", cAlternateFileName="SHAREP~2.ICO")) returned 1 [0252.927] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointTeamSite.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\sharepointteamsite.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0252.928] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointTeamSite.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\sharepointteamsite.ico.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd0 [0252.929] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x627e [0252.929] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0252.929] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0253.027] ReadFile (in: hFile=0xe8, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x627e, lpNumberOfBytesRead=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18f2b0*=0x627e, lpOverlapped=0x0) returned 1 [0253.029] WriteFile (in: hFile=0xd0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x6280, lpNumberOfBytesWritten=0x18f2b0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18f2b0*=0x6280, lpOverlapped=0x0) returned 1 [0253.030] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0253.053] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0253.064] CloseHandle (hObject=0xe8) returned 1 [0253.064] CloseHandle (hObject=0xd0) returned 1 [0253.064] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointTeamSite.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\sharepointteamsite.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointTeamSite.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\sharepointteamsite.ico.dvodltmf")) returned 0 [0253.065] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointTeamSite.ico.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\sharepointteamsite.ico.dvodltmf")) returned 0x2020 [0253.065] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointTeamSite.ico", lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad743900, ftCreationTime.dwHighDateTime=0x1c62706, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad743900, ftLastWriteTime.dwHighDateTime=0x1c62706, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="SharePointTeamSite.ico", cAlternateFileName="SHAREP~2.ICO")) returned 0x2e84d8 [0253.065] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f1ac | out: lpFindFileData=0x18f1ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad743900, ftCreationTime.dwHighDateTime=0x1c62706, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad743900, ftLastWriteTime.dwHighDateTime=0x1c62706, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="SharePointTeamSite.ico", cAlternateFileName="SHAREP~2.ICO")) returned 0 [0253.065] FindClose (in: hFindFile=0x2e84d8 | out: hFindFile=0x2e84d8) returned 1 [0253.065] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointTeamSite.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\sharepointteamsite.ico")) returned 1 [0253.066] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointTeamSite.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\sharepointteamsite.ico")) returned 0xffffffff [0253.067] FindNextFileA (in: hFindFile=0x2e8498, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UICaptions", cAlternateFileName="UICAPT~1")) returned 1 [0253.067] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e84d8 [0253.067] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.068] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0253.068] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53006d, dwReserved1=0x740069, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0253.069] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53006d, dwReserved1=0x740069, cFileName="..", cAlternateFileName="")) returned 1 [0253.070] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x53006d, dwReserved1=0x740069, cFileName="ENVELOPR.DLL.trx_dll", cAlternateFileName="ENVELO~1.TRX")) returned 1 [0253.070] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ENVELOPR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\envelopr.dll.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0253.070] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ENVELOPR.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\envelopr.dll.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0253.071] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3960 [0253.071] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0253.071] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0253.162] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3960, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x3960, lpOverlapped=0x0) returned 1 [0253.164] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x3970, lpOverlapped=0x0) returned 1 [0253.165] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0253.188] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0253.199] CloseHandle (hObject=0xe0) returned 1 [0253.199] CloseHandle (hObject=0xec) returned 1 [0253.199] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ENVELOPR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\envelopr.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ENVELOPR.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\envelopr.dll.trx_dll.dvodltmf")) returned 0 [0253.200] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ENVELOPR.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\envelopr.dll.trx_dll.dvodltmf")) returned 0x2020 [0253.200] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ENVELOPR.DLL.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="ENVELOPR.DLL.trx_dll", cAlternateFileName="ENVELO~1.TRX")) returned 0x2e8558 [0253.200] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="ENVELOPR.DLL.trx_dll", cAlternateFileName="ENVELO~1.TRX")) returned 0 [0253.200] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0253.200] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ENVELOPR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\envelopr.dll.trx_dll")) returned 1 [0253.201] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ENVELOPR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\envelopr.dll.trx_dll")) returned 0xffffffff [0253.201] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd48e100, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbd48e100, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0xbf60, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.DLL.trx_dll", cAlternateFileName="GRINTL~1.TRX")) returned 1 [0253.201] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\grintl32.dll.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0253.202] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\grintl32.dll.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0253.202] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbf60 [0253.203] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0253.203] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0253.297] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xbf60, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0xbf60, lpOverlapped=0x0) returned 1 [0253.302] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xbf70, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0xbf70, lpOverlapped=0x0) returned 1 [0253.303] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0253.327] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0253.337] CloseHandle (hObject=0xec) returned 1 [0253.337] CloseHandle (hObject=0xe0) returned 1 [0253.337] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\grintl32.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\grintl32.dll.trx_dll.dvodltmf")) returned 0 [0253.339] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\grintl32.dll.trx_dll.dvodltmf")) returned 0x2020 [0253.339] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.DLL.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd48e100, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbd48e100, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0xbf60, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="GRINTL32.DLL.trx_dll", cAlternateFileName="GRINTL~1.TRX")) returned 0x2e8558 [0253.340] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd48e100, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbd48e100, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0xbf60, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="GRINTL32.DLL.trx_dll", cAlternateFileName="GRINTL~1.TRX")) returned 0 [0253.340] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0253.340] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\grintl32.dll.trx_dll")) returned 1 [0253.341] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\grintl32.dll.trx_dll")) returned 0xffffffff [0253.341] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd48e100, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbd48e100, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0x3d960, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.REST.trx_dll", cAlternateFileName="GRINTL~2.TRX")) returned 1 [0253.341] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\grintl32.rest.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0253.342] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\grintl32.rest.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0253.342] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d960 [0253.342] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0253.343] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0253.445] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3d960, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x3d960, lpOverlapped=0x0) returned 1 [0253.491] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3d970, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x3d970, lpOverlapped=0x0) returned 1 [0253.496] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0253.519] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0253.531] CloseHandle (hObject=0xe0) returned 1 [0253.531] CloseHandle (hObject=0xec) returned 1 [0253.531] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\grintl32.rest.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\grintl32.rest.trx_dll.dvodltmf")) returned 0 [0253.532] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\grintl32.rest.trx_dll.dvodltmf")) returned 0x2020 [0253.532] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.REST.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd48e100, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbd48e100, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0x3d960, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="GRINTL32.REST.trx_dll", cAlternateFileName="GRINTL~2.TRX")) returned 0x2e8558 [0253.532] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd48e100, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbd48e100, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0x3d960, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="GRINTL32.REST.trx_dll", cAlternateFileName="GRINTL~2.TRX")) returned 0 [0253.532] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0253.532] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\grintl32.rest.trx_dll")) returned 1 [0253.535] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\grintl32.rest.trx_dll")) returned 0xffffffff [0253.535] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x49f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPIR.DLL.trx_dll", cAlternateFileName="MAPIRD~1.TRX")) returned 1 [0253.535] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MAPIR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\mapir.dll.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0253.536] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MAPIR.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\mapir.dll.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0253.536] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x49f60 [0253.536] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0253.536] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0253.628] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x49f60, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x49f60, lpOverlapped=0x0) returned 1 [0253.634] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x49f70, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x49f70, lpOverlapped=0x0) returned 1 [0253.640] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0253.663] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0253.675] CloseHandle (hObject=0xec) returned 1 [0253.675] CloseHandle (hObject=0xe0) returned 1 [0253.675] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MAPIR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\mapir.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MAPIR.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\mapir.dll.trx_dll.dvodltmf")) returned 0 [0253.676] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MAPIR.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\mapir.dll.trx_dll.dvodltmf")) returned 0x2020 [0253.676] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MAPIR.DLL.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x49f60, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="MAPIR.DLL.trx_dll", cAlternateFileName="MAPIRD~1.TRX")) returned 0x2e8558 [0253.676] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x49f60, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="MAPIR.DLL.trx_dll", cAlternateFileName="MAPIRD~1.TRX")) returned 0 [0253.676] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0253.676] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MAPIR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\mapir.dll.trx_dll")) returned 1 [0253.679] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MAPIR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\mapir.dll.trx_dll")) returned 0xffffffff [0253.679] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa27f6800, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa27f6800, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0xc160, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOR6INT.REST.trx_dll", cAlternateFileName="MOR6IN~1.TRX")) returned 1 [0253.679] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MOR6INT.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\mor6int.rest.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0253.680] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MOR6INT.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\mor6int.rest.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0253.681] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc160 [0253.681] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0253.681] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0253.773] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xc160, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0xc160, lpOverlapped=0x0) returned 1 [0253.784] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc170, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0xc170, lpOverlapped=0x0) returned 1 [0253.785] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0253.809] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0253.820] CloseHandle (hObject=0xe0) returned 1 [0253.820] CloseHandle (hObject=0xec) returned 1 [0253.820] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MOR6INT.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\mor6int.rest.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MOR6INT.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\mor6int.rest.trx_dll.dvodltmf")) returned 0 [0253.821] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MOR6INT.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\mor6int.rest.trx_dll.dvodltmf")) returned 0x2020 [0253.821] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MOR6INT.REST.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa27f6800, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa27f6800, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0xc160, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="MOR6INT.REST.trx_dll", cAlternateFileName="MOR6IN~1.TRX")) returned 0x2e8558 [0253.821] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa27f6800, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa27f6800, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0xc160, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="MOR6INT.REST.trx_dll", cAlternateFileName="MOR6IN~1.TRX")) returned 0 [0253.821] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0253.821] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MOR6INT.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\mor6int.rest.trx_dll")) returned 1 [0253.823] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MOR6INT.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\mor6int.rest.trx_dll")) returned 0xffffffff [0253.823] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9f53ca00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9f53ca00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x17960, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL.trx_dll", cAlternateFileName="MSOINT~1.TRX")) returned 1 [0253.823] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\msointl.dll.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0253.823] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\msointl.dll.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0253.823] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17960 [0253.823] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0253.824] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0253.914] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x17960, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x17960, lpOverlapped=0x0) returned 1 [0253.916] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x17970, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x17970, lpOverlapped=0x0) returned 1 [0253.919] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0253.942] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0253.953] CloseHandle (hObject=0xec) returned 1 [0253.953] CloseHandle (hObject=0xe0) returned 1 [0253.953] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\msointl.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\msointl.dll.trx_dll.dvodltmf")) returned 0 [0253.954] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\msointl.dll.trx_dll.dvodltmf")) returned 0x2020 [0253.954] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.DLL.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9f53ca00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9f53ca00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x17960, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="MSOINTL.DLL.trx_dll", cAlternateFileName="MSOINT~1.TRX")) returned 0x2e8558 [0253.955] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9f53ca00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9f53ca00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x17960, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="MSOINTL.DLL.trx_dll", cAlternateFileName="MSOINT~1.TRX")) returned 0 [0253.955] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0253.955] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\msointl.dll.trx_dll")) returned 1 [0253.956] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\msointl.dll.trx_dll")) returned 0xffffffff [0253.956] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9f53ca00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9f53ca00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x2ced60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.REST.trx_dll", cAlternateFileName="MSOINT~2.TRX")) returned 1 [0253.956] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\msointl.rest.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0253.957] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\msointl.rest.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0253.958] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ced60 [0253.958] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0253.958] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0254.055] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2ced60, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x2ced60, lpOverlapped=0x0) returned 1 [0254.116] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2ced70, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x2ced70, lpOverlapped=0x0) returned 1 [0254.183] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0254.205] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0254.216] CloseHandle (hObject=0xe0) returned 1 [0254.216] CloseHandle (hObject=0xec) returned 1 [0254.216] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\msointl.rest.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\msointl.rest.trx_dll.dvodltmf")) returned 0 [0254.217] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\msointl.rest.trx_dll.dvodltmf")) returned 0x2020 [0254.217] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9f53ca00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9f53ca00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x2ced60, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="MSOINTL.REST.trx_dll", cAlternateFileName="MSOINT~2.TRX")) returned 0x2e8558 [0254.217] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9f53ca00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9f53ca00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x2ced60, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="MSOINTL.REST.trx_dll", cAlternateFileName="MSOINT~2.TRX")) returned 0 [0254.217] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0254.217] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\msointl.rest.trx_dll")) returned 1 [0254.225] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\msointl.rest.trx_dll")) returned 0xffffffff [0254.225] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa381000, ftCreationTime.dwHighDateTime=0x1cac7fb, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xaa381000, ftLastWriteTime.dwHighDateTime=0x1cac7fb, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSINTL.DLL.trx_dll", cAlternateFileName="OMSINT~1.TRX")) returned 1 [0254.225] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OMSINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\omsintl.dll.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0254.226] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OMSINTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\omsintl.dll.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0254.226] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb360 [0254.226] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0254.227] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0254.315] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb360, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0xb360, lpOverlapped=0x0) returned 1 [0254.317] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb370, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0xb370, lpOverlapped=0x0) returned 1 [0254.319] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0254.341] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0254.399] CloseHandle (hObject=0xec) returned 1 [0254.400] CloseHandle (hObject=0xe0) returned 1 [0254.400] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OMSINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\omsintl.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OMSINTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\omsintl.dll.trx_dll.dvodltmf")) returned 0 [0254.400] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OMSINTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\omsintl.dll.trx_dll.dvodltmf")) returned 0x2020 [0254.400] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OMSINTL.DLL.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa381000, ftCreationTime.dwHighDateTime=0x1cac7fb, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xaa381000, ftLastWriteTime.dwHighDateTime=0x1cac7fb, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="OMSINTL.DLL.trx_dll", cAlternateFileName="OMSINT~1.TRX")) returned 0x2e8558 [0254.401] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa381000, ftCreationTime.dwHighDateTime=0x1cac7fb, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xaa381000, ftLastWriteTime.dwHighDateTime=0x1cac7fb, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="OMSINTL.DLL.trx_dll", cAlternateFileName="OMSINT~1.TRX")) returned 0 [0254.401] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0254.401] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OMSINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\omsintl.dll.trx_dll")) returned 1 [0254.402] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OMSINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\omsintl.dll.trx_dll")) returned 0xffffffff [0254.402] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7337cc00, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7337cc00, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x7b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.DLL.trx_dll", cAlternateFileName="ONINTL~1.TRX")) returned 1 [0254.402] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\onintl.dll.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0254.403] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\onintl.dll.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0254.404] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7b60 [0254.404] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0254.404] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0254.495] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x7b60, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x7b60, lpOverlapped=0x0) returned 1 [0254.498] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x7b70, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x7b70, lpOverlapped=0x0) returned 1 [0254.499] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0254.526] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0254.537] CloseHandle (hObject=0xe0) returned 1 [0254.537] CloseHandle (hObject=0xec) returned 1 [0254.537] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\onintl.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\onintl.dll.trx_dll.dvodltmf")) returned 0 [0254.538] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\onintl.dll.trx_dll.dvodltmf")) returned 0x2020 [0254.538] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.DLL.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7337cc00, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7337cc00, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x7b60, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="ONINTL.DLL.trx_dll", cAlternateFileName="ONINTL~1.TRX")) returned 0x2e8558 [0254.539] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7337cc00, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7337cc00, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x7b60, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="ONINTL.DLL.trx_dll", cAlternateFileName="ONINTL~1.TRX")) returned 0 [0254.539] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0254.539] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\onintl.dll.trx_dll")) returned 1 [0254.540] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\onintl.dll.trx_dll")) returned 0xffffffff [0254.540] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7337cc00, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7337cc00, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x3fb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.REST.trx_dll", cAlternateFileName="ONINTL~2.TRX")) returned 1 [0254.540] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\onintl.rest.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0254.541] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\onintl.rest.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0254.542] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3fb60 [0254.542] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0254.542] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0254.642] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3fb60, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x3fb60, lpOverlapped=0x0) returned 1 [0254.649] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3fb70, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x3fb70, lpOverlapped=0x0) returned 1 [0254.654] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0254.676] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0254.687] CloseHandle (hObject=0xec) returned 1 [0254.687] CloseHandle (hObject=0xe0) returned 1 [0254.688] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\onintl.rest.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\onintl.rest.trx_dll.dvodltmf")) returned 0 [0254.688] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\onintl.rest.trx_dll.dvodltmf")) returned 0x2020 [0254.689] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7337cc00, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7337cc00, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x3fb60, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ONINTL.REST.trx_dll", cAlternateFileName="ONINTL~2.TRX")) returned 0x2e8558 [0254.689] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7337cc00, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7337cc00, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x3fb60, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ONINTL.REST.trx_dll", cAlternateFileName="ONINTL~2.TRX")) returned 0 [0254.689] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0254.689] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\onintl.rest.trx_dll")) returned 1 [0254.691] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\onintl.rest.trx_dll")) returned 0xffffffff [0254.691] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ab87a00, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1ab87a00, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x37560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.DLL.trx_dll", cAlternateFileName="OUTLLI~1.TRX")) returned 1 [0254.691] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outllibr.dll.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0254.692] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outllibr.dll.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0254.693] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x37560 [0254.693] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0254.693] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0254.784] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x37560, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x37560, lpOverlapped=0x0) returned 1 [0254.789] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x37570, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x37570, lpOverlapped=0x0) returned 1 [0254.793] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0254.816] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0254.827] CloseHandle (hObject=0xe0) returned 1 [0254.827] CloseHandle (hObject=0xec) returned 1 [0254.827] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outllibr.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outllibr.dll.trx_dll.dvodltmf")) returned 0 [0254.828] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outllibr.dll.trx_dll.dvodltmf")) returned 0x2020 [0254.828] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.DLL.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ab87a00, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1ab87a00, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x37560, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="OUTLLIBR.DLL.trx_dll", cAlternateFileName="OUTLLI~1.TRX")) returned 0x2e8558 [0254.828] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ab87a00, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1ab87a00, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x37560, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="OUTLLIBR.DLL.trx_dll", cAlternateFileName="OUTLLI~1.TRX")) returned 0 [0254.828] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0254.828] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outllibr.dll.trx_dll")) returned 1 [0254.830] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outllibr.dll.trx_dll")) returned 0xffffffff [0254.830] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ab87a00, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1ab87a00, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0xa6560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.REST.trx_dll", cAlternateFileName="OUTLLI~2.TRX")) returned 1 [0254.830] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outllibr.rest.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0254.831] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outllibr.rest.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0254.832] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa6560 [0254.832] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0254.832] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0254.921] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xa6560, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0xa6560, lpOverlapped=0x0) returned 1 [0254.933] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xa6570, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0xa6570, lpOverlapped=0x0) returned 1 [0254.946] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0254.969] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0254.980] CloseHandle (hObject=0xec) returned 1 [0254.980] CloseHandle (hObject=0xe0) returned 1 [0254.980] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outllibr.rest.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outllibr.rest.trx_dll.dvodltmf")) returned 0 [0254.981] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outllibr.rest.trx_dll.dvodltmf")) returned 0x2020 [0254.981] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ab87a00, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1ab87a00, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0xa6560, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="OUTLLIBR.REST.trx_dll", cAlternateFileName="OUTLLI~2.TRX")) returned 0x2e8558 [0254.981] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ab87a00, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1ab87a00, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0xa6560, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="OUTLLIBR.REST.trx_dll", cAlternateFileName="OUTLLI~2.TRX")) returned 0 [0254.981] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0254.981] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outllibr.rest.trx_dll")) returned 1 [0254.987] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outllibr.rest.trx_dll")) returned 0xffffffff [0254.987] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x2b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLWVW.DLL.trx_dll", cAlternateFileName="OUTLWV~1.TRX")) returned 1 [0254.987] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outlwvw.dll.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0254.988] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outlwvw.dll.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0254.988] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b60 [0254.988] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0254.988] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0255.086] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2b60, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x2b60, lpOverlapped=0x0) returned 1 [0255.088] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2b70, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x2b70, lpOverlapped=0x0) returned 1 [0255.089] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0255.111] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0255.122] CloseHandle (hObject=0xe0) returned 1 [0255.122] CloseHandle (hObject=0xec) returned 1 [0255.122] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outlwvw.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outlwvw.dll.trx_dll.dvodltmf")) returned 0 [0255.123] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outlwvw.dll.trx_dll.dvodltmf")) returned 0x2020 [0255.123] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x2b60, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="OUTLWVW.DLL.trx_dll", cAlternateFileName="OUTLWV~1.TRX")) returned 0x2e8558 [0255.123] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x2b60, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="OUTLWVW.DLL.trx_dll", cAlternateFileName="OUTLWV~1.TRX")) returned 0 [0255.123] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0255.123] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outlwvw.dll.trx_dll")) returned 1 [0255.124] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outlwvw.dll.trx_dll")) returned 0xffffffff [0255.124] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cef6000, ftCreationTime.dwHighDateTime=0x1cac803, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7cef6000, ftLastWriteTime.dwHighDateTime=0x1cac803, nFileSizeHigh=0x0, nFileSizeLow=0xcd60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.DLL.trx_dll", cAlternateFileName="PPINTL~1.TRX")) returned 1 [0255.124] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\ppintl.dll.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0255.125] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\ppintl.dll.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0255.126] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcd60 [0255.126] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0255.126] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0255.215] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xcd60, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0xcd60, lpOverlapped=0x0) returned 1 [0255.217] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xcd70, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0xcd70, lpOverlapped=0x0) returned 1 [0255.218] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0255.240] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0255.252] CloseHandle (hObject=0xec) returned 1 [0255.252] CloseHandle (hObject=0xe0) returned 1 [0255.252] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\ppintl.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\ppintl.dll.trx_dll.dvodltmf")) returned 0 [0255.252] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\ppintl.dll.trx_dll.dvodltmf")) returned 0x2020 [0255.253] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cef6000, ftCreationTime.dwHighDateTime=0x1cac803, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7cef6000, ftLastWriteTime.dwHighDateTime=0x1cac803, nFileSizeHigh=0x0, nFileSizeLow=0xcd60, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="PPINTL.DLL.trx_dll", cAlternateFileName="PPINTL~1.TRX")) returned 0x2e8558 [0255.253] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cef6000, ftCreationTime.dwHighDateTime=0x1cac803, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7cef6000, ftLastWriteTime.dwHighDateTime=0x1cac803, nFileSizeHigh=0x0, nFileSizeLow=0xcd60, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="PPINTL.DLL.trx_dll", cAlternateFileName="PPINTL~1.TRX")) returned 0 [0255.253] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0255.253] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\ppintl.dll.trx_dll")) returned 1 [0255.254] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\ppintl.dll.trx_dll")) returned 0xffffffff [0255.254] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cef6000, ftCreationTime.dwHighDateTime=0x1cac803, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7cef6000, ftLastWriteTime.dwHighDateTime=0x1cac803, nFileSizeHigh=0x0, nFileSizeLow=0x45f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.REST.trx_dll", cAlternateFileName="PPINTL~2.TRX")) returned 1 [0255.254] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\ppintl.rest.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0255.255] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\ppintl.rest.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0255.256] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x45f60 [0255.256] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0255.256] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0255.345] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x45f60, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x45f60, lpOverlapped=0x0) returned 1 [0255.351] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x45f70, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x45f70, lpOverlapped=0x0) returned 1 [0255.357] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0255.410] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0255.421] CloseHandle (hObject=0xe0) returned 1 [0255.421] CloseHandle (hObject=0xec) returned 1 [0255.422] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\ppintl.rest.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\ppintl.rest.trx_dll.dvodltmf")) returned 0 [0255.422] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\ppintl.rest.trx_dll.dvodltmf")) returned 0x2020 [0255.423] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cef6000, ftCreationTime.dwHighDateTime=0x1cac803, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7cef6000, ftLastWriteTime.dwHighDateTime=0x1cac803, nFileSizeHigh=0x0, nFileSizeLow=0x45f60, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="PPINTL.REST.trx_dll", cAlternateFileName="PPINTL~2.TRX")) returned 0x2e8558 [0255.423] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cef6000, ftCreationTime.dwHighDateTime=0x1cac803, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7cef6000, ftLastWriteTime.dwHighDateTime=0x1cac803, nFileSizeHigh=0x0, nFileSizeLow=0x45f60, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="PPINTL.REST.trx_dll", cAlternateFileName="PPINTL~2.TRX")) returned 0 [0255.423] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0255.423] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\ppintl.rest.trx_dll")) returned 1 [0255.426] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\ppintl.rest.trx_dll")) returned 0xffffffff [0255.426] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3b09500, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa3b09500, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x1a360, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.DLL.trx_dll", cAlternateFileName="PUB6IN~1.TRX")) returned 1 [0255.426] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pub6intl.dll.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0255.427] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pub6intl.dll.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0255.427] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a360 [0255.428] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0255.428] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0255.517] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1a360, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x1a360, lpOverlapped=0x0) returned 1 [0255.520] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1a370, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x1a370, lpOverlapped=0x0) returned 1 [0255.523] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0255.545] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0255.556] CloseHandle (hObject=0xec) returned 1 [0255.556] CloseHandle (hObject=0xe0) returned 1 [0255.556] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pub6intl.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pub6intl.dll.trx_dll.dvodltmf")) returned 0 [0255.557] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pub6intl.dll.trx_dll.dvodltmf")) returned 0x2020 [0255.557] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3b09500, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa3b09500, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x1a360, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="PUB6INTL.DLL.trx_dll", cAlternateFileName="PUB6IN~1.TRX")) returned 0x2e8558 [0255.557] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3b09500, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa3b09500, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x1a360, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="PUB6INTL.DLL.trx_dll", cAlternateFileName="PUB6IN~1.TRX")) returned 0 [0255.557] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0255.557] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pub6intl.dll.trx_dll")) returned 1 [0255.558] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pub6intl.dll.trx_dll")) returned 0xffffffff [0255.559] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa27f6800, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa27f6800, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x8e160, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.REST.trx_dll", cAlternateFileName="PUB6IN~2.TRX")) returned 1 [0255.559] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pub6intl.rest.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0255.559] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pub6intl.rest.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0255.559] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8e160 [0255.559] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0255.560] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0255.647] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x8e160, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x8e160, lpOverlapped=0x0) returned 1 [0255.668] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x8e170, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x8e170, lpOverlapped=0x0) returned 1 [0255.679] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0255.701] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0255.712] CloseHandle (hObject=0xe0) returned 1 [0255.712] CloseHandle (hObject=0xec) returned 1 [0255.716] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pub6intl.rest.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pub6intl.rest.trx_dll.dvodltmf")) returned 0 [0255.717] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pub6intl.rest.trx_dll.dvodltmf")) returned 0x2020 [0255.717] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa27f6800, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa27f6800, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x8e160, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="PUB6INTL.REST.trx_dll", cAlternateFileName="PUB6IN~2.TRX")) returned 0x2e8558 [0255.717] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa27f6800, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa27f6800, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x8e160, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="PUB6INTL.REST.trx_dll", cAlternateFileName="PUB6IN~2.TRX")) returned 0 [0255.717] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0255.717] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pub6intl.rest.trx_dll")) returned 1 [0255.723] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pub6intl.rest.trx_dll")) returned 0xffffffff [0255.723] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749d2200, ftCreationTime.dwHighDateTime=0x1cac80f, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x749d2200, ftLastWriteTime.dwHighDateTime=0x1cac80f, nFileSizeHigh=0x0, nFileSizeLow=0x5ab60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBWZINT.REST.trx_dll", cAlternateFileName="PUBWZI~1.TRX")) returned 1 [0255.723] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUBWZINT.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pubwzint.rest.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0255.724] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUBWZINT.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pubwzint.rest.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0255.724] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5ab60 [0255.724] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0255.726] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0255.823] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x5ab60, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x5ab60, lpOverlapped=0x0) returned 1 [0255.830] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x5ab70, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x5ab70, lpOverlapped=0x0) returned 1 [0255.837] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0255.859] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0255.870] CloseHandle (hObject=0xec) returned 1 [0255.870] CloseHandle (hObject=0xe0) returned 1 [0255.871] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUBWZINT.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pubwzint.rest.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUBWZINT.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pubwzint.rest.trx_dll.dvodltmf")) returned 0 [0255.871] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUBWZINT.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pubwzint.rest.trx_dll.dvodltmf")) returned 0x2020 [0255.871] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUBWZINT.REST.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749d2200, ftCreationTime.dwHighDateTime=0x1cac80f, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x749d2200, ftLastWriteTime.dwHighDateTime=0x1cac80f, nFileSizeHigh=0x0, nFileSizeLow=0x5ab60, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="PUBWZINT.REST.trx_dll", cAlternateFileName="PUBWZI~1.TRX")) returned 0x2e8558 [0255.872] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749d2200, ftCreationTime.dwHighDateTime=0x1cac80f, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x749d2200, ftLastWriteTime.dwHighDateTime=0x1cac80f, nFileSizeHigh=0x0, nFileSizeLow=0x5ab60, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="PUBWZINT.REST.trx_dll", cAlternateFileName="PUBWZI~1.TRX")) returned 0 [0255.872] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0255.872] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUBWZINT.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pubwzint.rest.trx_dll")) returned 1 [0255.875] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUBWZINT.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pubwzint.rest.trx_dll")) returned 0xffffffff [0255.875] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d7a1200, ftCreationTime.dwHighDateTime=0x1cac817, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6d7a1200, ftLastWriteTime.dwHighDateTime=0x1cac817, nFileSizeHigh=0x0, nFileSizeLow=0x3360, dwReserved0=0x0, dwReserved1=0x0, cFileName="SGRES.DLL.trx_dll", cAlternateFileName="SGRESD~1.TRX")) returned 1 [0255.876] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\SGRES.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\sgres.dll.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0255.876] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\SGRES.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\sgres.dll.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0255.877] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3360 [0255.877] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0255.877] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0255.968] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3360, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x3360, lpOverlapped=0x0) returned 1 [0255.970] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3370, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x3370, lpOverlapped=0x0) returned 1 [0255.971] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0255.993] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0256.004] CloseHandle (hObject=0xe0) returned 1 [0256.004] CloseHandle (hObject=0xec) returned 1 [0256.004] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\SGRES.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\sgres.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\SGRES.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\sgres.dll.trx_dll.dvodltmf")) returned 0 [0256.005] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\SGRES.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\sgres.dll.trx_dll.dvodltmf")) returned 0x2020 [0256.005] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\SGRES.DLL.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d7a1200, ftCreationTime.dwHighDateTime=0x1cac817, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6d7a1200, ftLastWriteTime.dwHighDateTime=0x1cac817, nFileSizeHigh=0x0, nFileSizeLow=0x3360, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="SGRES.DLL.trx_dll", cAlternateFileName="SGRESD~1.TRX")) returned 0x2e8558 [0256.005] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d7a1200, ftCreationTime.dwHighDateTime=0x1cac817, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6d7a1200, ftLastWriteTime.dwHighDateTime=0x1cac817, nFileSizeHigh=0x0, nFileSizeLow=0x3360, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="SGRES.DLL.trx_dll", cAlternateFileName="SGRESD~1.TRX")) returned 0 [0256.005] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0256.005] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\SGRES.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\sgres.dll.trx_dll")) returned 1 [0256.006] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\SGRES.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\sgres.dll.trx_dll")) returned 0xffffffff [0256.006] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8e7d800, ftCreationTime.dwHighDateTime=0x1cac7f6, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8e7d800, ftLastWriteTime.dwHighDateTime=0x1cac7f6, nFileSizeHigh=0x0, nFileSizeLow=0x4160, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.trx_dll", cAlternateFileName="STINTL~1.TRX")) returned 1 [0256.006] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\STINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\stintl.dll.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0256.007] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\STINTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\stintl.dll.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0256.008] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4160 [0256.008] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0256.008] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0256.118] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x4160, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x4160, lpOverlapped=0x0) returned 1 [0256.119] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x4170, lpOverlapped=0x0) returned 1 [0256.120] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0256.143] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0256.154] CloseHandle (hObject=0xec) returned 1 [0256.154] CloseHandle (hObject=0xe0) returned 1 [0256.154] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\STINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\stintl.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\STINTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\stintl.dll.trx_dll.dvodltmf")) returned 0 [0256.155] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\STINTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\stintl.dll.trx_dll.dvodltmf")) returned 0x2020 [0256.155] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\STINTL.DLL.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8e7d800, ftCreationTime.dwHighDateTime=0x1cac7f6, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8e7d800, ftLastWriteTime.dwHighDateTime=0x1cac7f6, nFileSizeHigh=0x0, nFileSizeLow=0x4160, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="STINTL.DLL.trx_dll", cAlternateFileName="STINTL~1.TRX")) returned 0x2e8558 [0256.155] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8e7d800, ftCreationTime.dwHighDateTime=0x1cac7f6, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8e7d800, ftLastWriteTime.dwHighDateTime=0x1cac7f6, nFileSizeHigh=0x0, nFileSizeLow=0x4160, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="STINTL.DLL.trx_dll", cAlternateFileName="STINTL~1.TRX")) returned 0 [0256.155] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0256.155] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\STINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\stintl.dll.trx_dll")) returned 1 [0256.156] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\STINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\stintl.dll.trx_dll")) returned 0xffffffff [0256.156] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf706700, ftCreationTime.dwHighDateTime=0x1cac81a, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbf706700, ftLastWriteTime.dwHighDateTime=0x1cac81a, nFileSizeHigh=0x0, nFileSizeLow=0x6960, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISBRRES.DLL.trx_dll", cAlternateFileName="VISBRR~1.TRX")) returned 1 [0256.156] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISBRRES.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\visbrres.dll.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0256.157] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISBRRES.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\visbrres.dll.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0256.158] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6960 [0256.158] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0256.158] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0256.245] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x6960, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x6960, lpOverlapped=0x0) returned 1 [0256.247] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x6970, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x6970, lpOverlapped=0x0) returned 1 [0256.248] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0256.270] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0256.281] CloseHandle (hObject=0xe0) returned 1 [0256.281] CloseHandle (hObject=0xec) returned 1 [0256.281] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISBRRES.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\visbrres.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISBRRES.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\visbrres.dll.trx_dll.dvodltmf")) returned 0 [0256.282] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISBRRES.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\visbrres.dll.trx_dll.dvodltmf")) returned 0x2020 [0256.282] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISBRRES.DLL.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf706700, ftCreationTime.dwHighDateTime=0x1cac81a, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbf706700, ftLastWriteTime.dwHighDateTime=0x1cac81a, nFileSizeHigh=0x0, nFileSizeLow=0x6960, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="VISBRRES.DLL.trx_dll", cAlternateFileName="VISBRR~1.TRX")) returned 0x2e8558 [0256.282] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf706700, ftCreationTime.dwHighDateTime=0x1cac81a, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbf706700, ftLastWriteTime.dwHighDateTime=0x1cac81a, nFileSizeHigh=0x0, nFileSizeLow=0x6960, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="VISBRRES.DLL.trx_dll", cAlternateFileName="VISBRR~1.TRX")) returned 0 [0256.282] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0256.282] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISBRRES.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\visbrres.dll.trx_dll")) returned 1 [0256.283] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISBRRES.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\visbrres.dll.trx_dll")) returned 0xffffffff [0256.283] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a315700, ftCreationTime.dwHighDateTime=0x1cac814, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a315700, ftLastWriteTime.dwHighDateTime=0x1cac814, nFileSizeHigh=0x0, nFileSizeLow=0x77560, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISINTL.DLL.trx_dll", cAlternateFileName="VISINT~1.TRX")) returned 1 [0256.283] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\visintl.dll.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0256.284] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\visintl.dll.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0256.284] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x77560 [0256.284] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0256.284] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0256.378] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x77560, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x77560, lpOverlapped=0x0) returned 1 [0256.389] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x77570, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x77570, lpOverlapped=0x0) returned 1 [0256.398] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0256.419] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0256.430] CloseHandle (hObject=0xec) returned 1 [0256.430] CloseHandle (hObject=0xe0) returned 1 [0256.431] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\visintl.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\visintl.dll.trx_dll.dvodltmf")) returned 0 [0256.431] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\visintl.dll.trx_dll.dvodltmf")) returned 0x2020 [0256.431] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a315700, ftCreationTime.dwHighDateTime=0x1cac814, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a315700, ftLastWriteTime.dwHighDateTime=0x1cac814, nFileSizeHigh=0x0, nFileSizeLow=0x77560, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="VISINTL.DLL.trx_dll", cAlternateFileName="VISINT~1.TRX")) returned 0x2e8558 [0256.432] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a315700, ftCreationTime.dwHighDateTime=0x1cac814, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a315700, ftLastWriteTime.dwHighDateTime=0x1cac814, nFileSizeHigh=0x0, nFileSizeLow=0x77560, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="VISINTL.DLL.trx_dll", cAlternateFileName="VISINT~1.TRX")) returned 0 [0256.432] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0256.432] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\visintl.dll.trx_dll")) returned 1 [0256.436] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\visintl.dll.trx_dll")) returned 0xffffffff [0256.436] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb31c100, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0ca650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb31c100, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x25b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.DLL.trx_dll", cAlternateFileName="WWINTL~1.TRX")) returned 1 [0256.436] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\wwintl.dll.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0256.436] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\wwintl.dll.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0256.437] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x25b60 [0256.437] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0256.437] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0256.528] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x25b60, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x25b60, lpOverlapped=0x0) returned 1 [0256.532] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x25b70, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x25b70, lpOverlapped=0x0) returned 1 [0256.535] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0256.557] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0256.568] CloseHandle (hObject=0xe0) returned 1 [0256.568] CloseHandle (hObject=0xec) returned 1 [0256.568] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\wwintl.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\wwintl.dll.trx_dll.dvodltmf")) returned 0 [0256.569] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\wwintl.dll.trx_dll.dvodltmf")) returned 0x2020 [0256.569] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb31c100, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0ca650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb31c100, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x25b60, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="WWINTL.DLL.trx_dll", cAlternateFileName="WWINTL~1.TRX")) returned 0x2e8558 [0256.569] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb31c100, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0ca650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb31c100, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x25b60, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="WWINTL.DLL.trx_dll", cAlternateFileName="WWINTL~1.TRX")) returned 0 [0256.569] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0256.569] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\wwintl.dll.trx_dll")) returned 1 [0256.571] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\wwintl.dll.trx_dll")) returned 0xffffffff [0256.571] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb31c100, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb31c100, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x115b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.REST.trx_dll", cAlternateFileName="WWINTL~2.TRX")) returned 1 [0256.571] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\wwintl.rest.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0256.571] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\wwintl.rest.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0256.572] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x115b60 [0256.572] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0256.572] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0256.663] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x115b60, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x115b60, lpOverlapped=0x0) returned 1 [0256.690] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x115b70, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x115b70, lpOverlapped=0x0) returned 1 [0256.712] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0256.736] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0256.746] CloseHandle (hObject=0xec) returned 1 [0256.747] CloseHandle (hObject=0xe0) returned 1 [0256.747] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\wwintl.rest.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\wwintl.rest.trx_dll.dvodltmf")) returned 0 [0256.748] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\wwintl.rest.trx_dll.dvodltmf")) returned 0x2020 [0256.748] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb31c100, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb31c100, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x115b60, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="WWINTL.REST.trx_dll", cAlternateFileName="WWINTL~2.TRX")) returned 0x2e8558 [0256.748] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb31c100, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb31c100, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x115b60, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="WWINTL.REST.trx_dll", cAlternateFileName="WWINTL~2.TRX")) returned 0 [0256.748] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0256.748] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\wwintl.rest.trx_dll")) returned 1 [0256.750] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\wwintl.rest.trx_dll")) returned 0xffffffff [0256.750] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6b688100, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6b688100, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x25360, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.DLL.trx_dll", cAlternateFileName="XLINTL~1.TRX")) returned 1 [0256.750] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\xlintl32.dll.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0256.751] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\xlintl32.dll.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0256.751] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x25360 [0256.751] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0256.752] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0256.840] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x25360, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x25360, lpOverlapped=0x0) returned 1 [0256.844] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x25370, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x25370, lpOverlapped=0x0) returned 1 [0256.847] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0256.870] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0256.880] CloseHandle (hObject=0xe0) returned 1 [0256.880] CloseHandle (hObject=0xec) returned 1 [0256.881] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\xlintl32.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\xlintl32.dll.trx_dll.dvodltmf")) returned 0 [0256.881] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\xlintl32.dll.trx_dll.dvodltmf")) returned 0x2020 [0256.881] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6b688100, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6b688100, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x25360, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="XLINTL32.DLL.trx_dll", cAlternateFileName="XLINTL~1.TRX")) returned 0x2e8558 [0256.882] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6b688100, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6b688100, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x25360, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="XLINTL32.DLL.trx_dll", cAlternateFileName="XLINTL~1.TRX")) returned 0 [0256.882] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0256.882] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\xlintl32.dll.trx_dll")) returned 1 [0256.884] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\xlintl32.dll.trx_dll")) returned 0xffffffff [0256.884] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a375400, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a375400, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x137960, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.REST.trx_dll", cAlternateFileName="XLINTL~2.TRX")) returned 1 [0256.884] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\xlintl32.rest.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0256.884] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\xlintl32.rest.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0256.884] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x137960 [0256.884] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0256.885] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0256.972] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x137960, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x137960, lpOverlapped=0x0) returned 1 [0257.000] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x137970, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x137970, lpOverlapped=0x0) returned 1 [0257.035] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0257.058] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0257.077] CloseHandle (hObject=0xec) returned 1 [0257.077] CloseHandle (hObject=0xe0) returned 1 [0257.077] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\xlintl32.rest.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\xlintl32.rest.trx_dll.dvodltmf")) returned 0 [0257.078] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\xlintl32.rest.trx_dll.dvodltmf")) returned 0x2020 [0257.078] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a375400, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a375400, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x137960, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="XLINTL32.REST.trx_dll", cAlternateFileName="XLINTL~2.TRX")) returned 0x2e8558 [0257.079] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a375400, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a375400, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x137960, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="XLINTL32.REST.trx_dll", cAlternateFileName="XLINTL~2.TRX")) returned 0 [0257.079] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0257.079] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\xlintl32.rest.trx_dll")) returned 1 [0257.081] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\xlintl32.rest.trx_dll")) returned 0xffffffff [0257.081] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe092000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe092000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 1 [0257.081] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLSLICER.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\xlslicer.dll.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0257.081] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLSLICER.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\xlslicer.dll.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0257.083] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d60 [0257.083] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0257.083] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0257.175] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3d60, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x3d60, lpOverlapped=0x0) returned 1 [0257.177] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3d70, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x3d70, lpOverlapped=0x0) returned 1 [0257.178] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0257.201] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0257.212] CloseHandle (hObject=0xe0) returned 1 [0257.212] CloseHandle (hObject=0xec) returned 1 [0257.212] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLSLICER.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\xlslicer.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLSLICER.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\xlslicer.dll.trx_dll.dvodltmf")) returned 0 [0257.213] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLSLICER.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\xlslicer.dll.trx_dll.dvodltmf")) returned 0x2020 [0257.213] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLSLICER.DLL.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe092000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe092000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 0x2e8558 [0257.213] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe092000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe092000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 0 [0257.213] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0257.213] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLSLICER.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\xlslicer.dll.trx_dll")) returned 1 [0257.214] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLSLICER.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\xlslicer.dll.trx_dll")) returned 0xffffffff [0257.214] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe092000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe092000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 0 [0257.214] FindClose (in: hFindFile=0x2e8518 | out: hFindFile=0x2e8518) returned 1 [0257.215] FindNextFileA (in: hFindFile=0x2e84d8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName="3082", cAlternateFileName="")) returned 1 [0257.215] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e8518 [0257.216] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.217] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPR.DLL.trx_dll", cAlternateFileName="ENVELO~1.TRX")) returned 1 [0257.217] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ENVELOPR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\envelopr.dll.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0257.218] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ENVELOPR.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\envelopr.dll.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0257.219] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3760 [0257.219] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0257.219] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0257.308] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3760, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x3760, lpOverlapped=0x0) returned 1 [0257.310] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3770, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x3770, lpOverlapped=0x0) returned 1 [0257.311] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0257.334] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0257.344] CloseHandle (hObject=0xec) returned 1 [0257.344] CloseHandle (hObject=0xe0) returned 1 [0257.345] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ENVELOPR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\envelopr.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ENVELOPR.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\envelopr.dll.trx_dll.dvodltmf")) returned 0 [0257.345] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ENVELOPR.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\envelopr.dll.trx_dll.dvodltmf")) returned 0x2020 [0257.345] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ENVELOPR.DLL.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ENVELOPR.DLL.trx_dll", cAlternateFileName="ENVELO~1.TRX")) returned 0x2e8558 [0257.346] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ENVELOPR.DLL.trx_dll", cAlternateFileName="ENVELO~1.TRX")) returned 0 [0257.346] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0257.346] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ENVELOPR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\envelopr.dll.trx_dll")) returned 1 [0257.347] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ENVELOPR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\envelopr.dll.trx_dll")) returned 0xffffffff [0257.347] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74912800, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x74912800, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0xb960, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.DLL.trx_dll", cAlternateFileName="GRINTL~1.TRX")) returned 1 [0257.347] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\grintl32.dll.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0257.347] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\grintl32.dll.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0257.348] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb960 [0257.348] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0257.348] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0257.442] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb960, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0xb960, lpOverlapped=0x0) returned 1 [0257.445] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb970, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0xb970, lpOverlapped=0x0) returned 1 [0257.446] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0257.468] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0257.479] CloseHandle (hObject=0xe0) returned 1 [0257.479] CloseHandle (hObject=0xec) returned 1 [0257.479] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\grintl32.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\grintl32.dll.trx_dll.dvodltmf")) returned 0 [0257.480] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\grintl32.dll.trx_dll.dvodltmf")) returned 0x2020 [0257.480] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.DLL.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74912800, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x74912800, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0xb960, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="GRINTL32.DLL.trx_dll", cAlternateFileName="GRINTL~1.TRX")) returned 0x2e8558 [0257.480] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74912800, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x74912800, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0xb960, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="GRINTL32.DLL.trx_dll", cAlternateFileName="GRINTL~1.TRX")) returned 0 [0257.480] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0257.480] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\grintl32.dll.trx_dll")) returned 1 [0257.481] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\grintl32.dll.trx_dll")) returned 0xffffffff [0257.481] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74912800, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x74912800, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0x39960, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.REST.trx_dll", cAlternateFileName="GRINTL~2.TRX")) returned 1 [0257.481] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\grintl32.rest.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0257.482] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\grintl32.rest.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0257.482] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x39960 [0257.482] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0257.482] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0257.569] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x39960, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x39960, lpOverlapped=0x0) returned 1 [0257.574] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x39970, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x39970, lpOverlapped=0x0) returned 1 [0257.578] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0257.601] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0257.611] CloseHandle (hObject=0xec) returned 1 [0257.611] CloseHandle (hObject=0xe0) returned 1 [0257.611] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\grintl32.rest.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\grintl32.rest.trx_dll.dvodltmf")) returned 0 [0257.612] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\grintl32.rest.trx_dll.dvodltmf")) returned 0x2020 [0257.612] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.REST.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74912800, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x74912800, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0x39960, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="GRINTL32.REST.trx_dll", cAlternateFileName="GRINTL~2.TRX")) returned 0x2e8558 [0257.612] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74912800, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x74912800, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0x39960, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="GRINTL32.REST.trx_dll", cAlternateFileName="GRINTL~2.TRX")) returned 0 [0257.613] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0257.613] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\grintl32.rest.trx_dll")) returned 1 [0257.615] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\grintl32.rest.trx_dll")) returned 0xffffffff [0257.615] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x47d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPIR.DLL.trx_dll", cAlternateFileName="MAPIRD~1.TRX")) returned 1 [0257.615] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MAPIR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\mapir.dll.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0257.615] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MAPIR.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\mapir.dll.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0257.616] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x47d60 [0257.616] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0257.616] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0257.715] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x47d60, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x47d60, lpOverlapped=0x0) returned 1 [0257.724] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x47d70, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x47d70, lpOverlapped=0x0) returned 1 [0257.730] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0257.771] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0257.782] CloseHandle (hObject=0xe0) returned 1 [0257.782] CloseHandle (hObject=0xec) returned 1 [0257.782] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MAPIR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\mapir.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MAPIR.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\mapir.dll.trx_dll.dvodltmf")) returned 0 [0257.783] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MAPIR.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\mapir.dll.trx_dll.dvodltmf")) returned 0x2020 [0257.784] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MAPIR.DLL.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x47d60, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="MAPIR.DLL.trx_dll", cAlternateFileName="MAPIRD~1.TRX")) returned 0x2e8558 [0257.784] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x47d60, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="MAPIR.DLL.trx_dll", cAlternateFileName="MAPIRD~1.TRX")) returned 0 [0257.784] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0257.784] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MAPIR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\mapir.dll.trx_dll")) returned 1 [0257.787] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MAPIR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\mapir.dll.trx_dll")) returned 0xffffffff [0257.787] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58968200, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x58968200, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0xc160, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOR6INT.REST.trx_dll", cAlternateFileName="MOR6IN~1.TRX")) returned 1 [0257.787] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MOR6INT.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\mor6int.rest.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0257.788] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MOR6INT.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\mor6int.rest.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0257.789] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc160 [0257.789] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0257.789] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0257.879] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xc160, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0xc160, lpOverlapped=0x0) returned 1 [0257.881] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xc170, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0xc170, lpOverlapped=0x0) returned 1 [0257.883] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0257.905] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0257.916] CloseHandle (hObject=0xec) returned 1 [0257.916] CloseHandle (hObject=0xe0) returned 1 [0257.916] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MOR6INT.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\mor6int.rest.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MOR6INT.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\mor6int.rest.trx_dll.dvodltmf")) returned 0 [0257.917] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MOR6INT.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\mor6int.rest.trx_dll.dvodltmf")) returned 0x2020 [0257.917] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MOR6INT.REST.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58968200, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x58968200, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0xc160, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="MOR6INT.REST.trx_dll", cAlternateFileName="MOR6IN~1.TRX")) returned 0x2e8558 [0257.917] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58968200, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x58968200, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0xc160, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="MOR6INT.REST.trx_dll", cAlternateFileName="MOR6IN~1.TRX")) returned 0 [0257.917] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0257.918] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MOR6INT.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\mor6int.rest.trx_dll")) returned 1 [0257.919] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MOR6INT.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\mor6int.rest.trx_dll")) returned 0xffffffff [0257.919] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x248aaf00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x248aaf00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x16f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL.trx_dll", cAlternateFileName="MSOINT~1.TRX")) returned 1 [0257.919] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\msointl.dll.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0257.919] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\msointl.dll.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0257.920] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16f60 [0257.920] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0257.920] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0258.008] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x16f60, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x16f60, lpOverlapped=0x0) returned 1 [0258.012] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x16f70, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x16f70, lpOverlapped=0x0) returned 1 [0258.014] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0258.036] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0258.047] CloseHandle (hObject=0xe0) returned 1 [0258.047] CloseHandle (hObject=0xec) returned 1 [0258.047] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\msointl.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\msointl.dll.trx_dll.dvodltmf")) returned 0 [0258.048] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\msointl.dll.trx_dll.dvodltmf")) returned 0x2020 [0258.048] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.DLL.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x248aaf00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x248aaf00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x16f60, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="MSOINTL.DLL.trx_dll", cAlternateFileName="MSOINT~1.TRX")) returned 0x2e8558 [0258.048] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x248aaf00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x248aaf00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x16f60, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="MSOINTL.DLL.trx_dll", cAlternateFileName="MSOINT~1.TRX")) returned 0 [0258.048] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0258.048] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\msointl.dll.trx_dll")) returned 1 [0258.050] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\msointl.dll.trx_dll")) returned 0xffffffff [0258.050] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x25bbdc00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x25bbdc00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x2b2560, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.REST.trx_dll", cAlternateFileName="MSOINT~2.TRX")) returned 1 [0258.050] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\msointl.rest.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0258.050] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\msointl.rest.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0258.051] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b2560 [0258.051] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0258.051] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0258.146] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2b2560, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x2b2560, lpOverlapped=0x0) returned 1 [0258.206] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2b2570, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x2b2570, lpOverlapped=0x0) returned 1 [0258.273] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0258.295] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0258.306] CloseHandle (hObject=0xec) returned 1 [0258.306] CloseHandle (hObject=0xe0) returned 1 [0258.306] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\msointl.rest.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\msointl.rest.trx_dll.dvodltmf")) returned 0 [0258.307] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\msointl.rest.trx_dll.dvodltmf")) returned 0x2020 [0258.307] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.REST.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x25bbdc00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x25bbdc00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x2b2560, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="MSOINTL.REST.trx_dll", cAlternateFileName="MSOINT~2.TRX")) returned 0x2e8558 [0258.307] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x25bbdc00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x25bbdc00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x2b2560, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="MSOINTL.REST.trx_dll", cAlternateFileName="MSOINT~2.TRX")) returned 0 [0258.307] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0258.307] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\msointl.rest.trx_dll")) returned 1 [0258.314] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\msointl.rest.trx_dll")) returned 0xffffffff [0258.314] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3564d600, ftCreationTime.dwHighDateTime=0x1cac7fb, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3564d600, ftLastWriteTime.dwHighDateTime=0x1cac7fb, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSINTL.DLL.trx_dll", cAlternateFileName="OMSINT~1.TRX")) returned 1 [0258.314] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OMSINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\omsintl.dll.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0258.314] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OMSINTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\omsintl.dll.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0258.315] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb360 [0258.315] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0258.315] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0258.405] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xb360, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0xb360, lpOverlapped=0x0) returned 1 [0258.407] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xb370, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0xb370, lpOverlapped=0x0) returned 1 [0258.409] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0258.431] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0258.443] CloseHandle (hObject=0xe0) returned 1 [0258.443] CloseHandle (hObject=0xec) returned 1 [0258.443] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OMSINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\omsintl.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OMSINTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\omsintl.dll.trx_dll.dvodltmf")) returned 0 [0258.444] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OMSINTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\omsintl.dll.trx_dll.dvodltmf")) returned 0x2020 [0258.444] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OMSINTL.DLL.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3564d600, ftCreationTime.dwHighDateTime=0x1cac7fb, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3564d600, ftLastWriteTime.dwHighDateTime=0x1cac7fb, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="OMSINTL.DLL.trx_dll", cAlternateFileName="OMSINT~1.TRX")) returned 0x2e8558 [0258.444] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3564d600, ftCreationTime.dwHighDateTime=0x1cac7fb, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3564d600, ftLastWriteTime.dwHighDateTime=0x1cac7fb, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="OMSINTL.DLL.trx_dll", cAlternateFileName="OMSINT~1.TRX")) returned 0 [0258.444] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0258.444] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OMSINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\omsintl.dll.trx_dll")) returned 1 [0258.445] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OMSINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\omsintl.dll.trx_dll")) returned 0xffffffff [0258.445] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x63b88300, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x63b88300, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x7b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.DLL.trx_dll", cAlternateFileName="ONINTL~1.TRX")) returned 1 [0258.445] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\onintl.dll.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0258.446] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\onintl.dll.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0258.446] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7b60 [0258.446] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0258.446] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0258.535] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x7b60, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x7b60, lpOverlapped=0x0) returned 1 [0258.909] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x7b70, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x7b70, lpOverlapped=0x0) returned 1 [0258.910] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0258.933] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0258.944] CloseHandle (hObject=0xec) returned 1 [0258.944] CloseHandle (hObject=0xe0) returned 1 [0258.944] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\onintl.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\onintl.dll.trx_dll.dvodltmf")) returned 0 [0258.945] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\onintl.dll.trx_dll.dvodltmf")) returned 0x2020 [0258.945] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.DLL.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x63b88300, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x63b88300, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x7b60, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ONINTL.DLL.trx_dll", cAlternateFileName="ONINTL~1.TRX")) returned 0x2e8558 [0258.945] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x63b88300, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x63b88300, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x7b60, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="ONINTL.DLL.trx_dll", cAlternateFileName="ONINTL~1.TRX")) returned 0 [0258.945] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0258.945] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\onintl.dll.trx_dll")) returned 1 [0258.946] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\onintl.dll.trx_dll")) returned 0xffffffff [0258.946] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62875600, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x62875600, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x3d960, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.REST.trx_dll", cAlternateFileName="ONINTL~2.TRX")) returned 1 [0258.946] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\onintl.rest.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0258.947] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\onintl.rest.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0258.947] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d960 [0258.947] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0258.947] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0259.038] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x3d960, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x3d960, lpOverlapped=0x0) returned 1 [0259.927] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x3d970, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x3d970, lpOverlapped=0x0) returned 1 [0259.931] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0259.954] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0259.965] CloseHandle (hObject=0xe0) returned 1 [0259.965] CloseHandle (hObject=0xec) returned 1 [0259.965] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\onintl.rest.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\onintl.rest.trx_dll.dvodltmf")) returned 0 [0259.966] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\onintl.rest.trx_dll.dvodltmf")) returned 0x2020 [0259.966] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.REST.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62875600, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x62875600, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x3d960, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="ONINTL.REST.trx_dll", cAlternateFileName="ONINTL~2.TRX")) returned 0x2e8558 [0259.966] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62875600, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x62875600, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x3d960, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="ONINTL.REST.trx_dll", cAlternateFileName="ONINTL~2.TRX")) returned 0 [0259.966] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0259.966] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\onintl.rest.trx_dll")) returned 1 [0259.969] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\onintl.rest.trx_dll")) returned 0xffffffff [0259.969] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x35960, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.DLL.trx_dll", cAlternateFileName="OUTLLI~1.TRX")) returned 1 [0259.969] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\outllibr.dll.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0259.969] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\outllibr.dll.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0259.969] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x35960 [0259.970] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0259.970] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0260.059] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x35960, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x35960, lpOverlapped=0x0) returned 1 [0260.063] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x35970, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x35970, lpOverlapped=0x0) returned 1 [0260.067] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0260.090] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.104] CloseHandle (hObject=0xec) returned 1 [0260.104] CloseHandle (hObject=0xe0) returned 1 [0260.104] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\outllibr.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\outllibr.dll.trx_dll.dvodltmf")) returned 0 [0260.105] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\outllibr.dll.trx_dll.dvodltmf")) returned 0x2020 [0260.105] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.DLL.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x35960, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="OUTLLIBR.DLL.trx_dll", cAlternateFileName="OUTLLI~1.TRX")) returned 0x2e8558 [0260.106] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x35960, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="OUTLLIBR.DLL.trx_dll", cAlternateFileName="OUTLLI~1.TRX")) returned 0 [0260.106] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0260.106] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\outllibr.dll.trx_dll")) returned 1 [0260.109] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\outllibr.dll.trx_dll")) returned 0xffffffff [0260.109] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x9f560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.REST.trx_dll", cAlternateFileName="OUTLLI~2.TRX")) returned 1 [0260.109] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\outllibr.rest.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0260.109] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\outllibr.rest.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0260.110] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9f560 [0260.110] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0260.111] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0260.230] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x9f560, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x9f560, lpOverlapped=0x0) returned 1 [0260.242] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x9f570, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x9f570, lpOverlapped=0x0) returned 1 [0260.253] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0260.276] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.288] CloseHandle (hObject=0xe0) returned 1 [0260.288] CloseHandle (hObject=0xec) returned 1 [0260.288] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\outllibr.rest.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\outllibr.rest.trx_dll.dvodltmf")) returned 0 [0260.289] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\outllibr.rest.trx_dll.dvodltmf")) returned 0x2020 [0260.289] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.REST.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x9f560, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="OUTLLIBR.REST.trx_dll", cAlternateFileName="OUTLLI~2.TRX")) returned 0x2e8558 [0260.289] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x9f560, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="OUTLLIBR.REST.trx_dll", cAlternateFileName="OUTLLI~2.TRX")) returned 0 [0260.289] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0260.289] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\outllibr.rest.trx_dll")) returned 1 [0260.295] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\outllibr.rest.trx_dll")) returned 0xffffffff [0260.295] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x315ed100, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x315ed100, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLWVW.DLL.trx_dll", cAlternateFileName="OUTLWV~1.TRX")) returned 1 [0260.295] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLWVW.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\outlwvw.dll.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0260.295] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLWVW.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\outlwvw.dll.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0260.296] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d60 [0260.296] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0260.296] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0260.393] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x2d60, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x2d60, lpOverlapped=0x0) returned 1 [0260.395] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x2d70, lpOverlapped=0x0) returned 1 [0260.396] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0260.422] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.433] CloseHandle (hObject=0xec) returned 1 [0260.433] CloseHandle (hObject=0xe0) returned 1 [0260.433] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLWVW.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\outlwvw.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLWVW.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\outlwvw.dll.trx_dll.dvodltmf")) returned 0 [0260.434] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLWVW.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\outlwvw.dll.trx_dll.dvodltmf")) returned 0x2020 [0260.434] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLWVW.DLL.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x315ed100, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x315ed100, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="OUTLWVW.DLL.trx_dll", cAlternateFileName="OUTLWV~1.TRX")) returned 0x2e8558 [0260.434] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x315ed100, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x315ed100, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="OUTLWVW.DLL.trx_dll", cAlternateFileName="OUTLWV~1.TRX")) returned 0 [0260.434] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0260.434] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLWVW.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\outlwvw.dll.trx_dll")) returned 1 [0260.435] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLWVW.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\outlwvw.dll.trx_dll")) returned 0xffffffff [0260.436] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1a4a9400, ftCreationTime.dwHighDateTime=0x1cac804, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1a4a9400, ftLastWriteTime.dwHighDateTime=0x1cac804, nFileSizeHigh=0x0, nFileSizeLow=0xd160, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.DLL.trx_dll", cAlternateFileName="PPINTL~1.TRX")) returned 1 [0260.436] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\ppintl.dll.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0260.436] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\ppintl.dll.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0260.437] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd160 [0260.437] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0260.437] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0260.530] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0xd160, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0xd160, lpOverlapped=0x0) returned 1 [0260.532] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0xd170, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0xd170, lpOverlapped=0x0) returned 1 [0260.534] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0260.557] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.568] CloseHandle (hObject=0xe0) returned 1 [0260.568] CloseHandle (hObject=0xec) returned 1 [0260.568] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\ppintl.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\ppintl.dll.trx_dll.dvodltmf")) returned 0 [0260.569] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\ppintl.dll.trx_dll.dvodltmf")) returned 0x2020 [0260.569] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.DLL.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1a4a9400, ftCreationTime.dwHighDateTime=0x1cac804, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1a4a9400, ftLastWriteTime.dwHighDateTime=0x1cac804, nFileSizeHigh=0x0, nFileSizeLow=0xd160, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="PPINTL.DLL.trx_dll", cAlternateFileName="PPINTL~1.TRX")) returned 0x2e8558 [0260.569] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1a4a9400, ftCreationTime.dwHighDateTime=0x1cac804, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1a4a9400, ftLastWriteTime.dwHighDateTime=0x1cac804, nFileSizeHigh=0x0, nFileSizeLow=0xd160, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="PPINTL.DLL.trx_dll", cAlternateFileName="PPINTL~1.TRX")) returned 0 [0260.569] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0260.569] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\ppintl.dll.trx_dll")) returned 1 [0260.570] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\ppintl.dll.trx_dll")) returned 0xffffffff [0260.570] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x19196700, ftCreationTime.dwHighDateTime=0x1cac804, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x19196700, ftLastWriteTime.dwHighDateTime=0x1cac804, nFileSizeHigh=0x0, nFileSizeLow=0x43560, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.REST.trx_dll", cAlternateFileName="PPINTL~2.TRX")) returned 1 [0260.570] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\ppintl.rest.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0260.571] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\ppintl.rest.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0260.571] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43560 [0260.571] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0260.571] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0260.661] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x43560, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x43560, lpOverlapped=0x0) returned 1 [0260.712] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x43570, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x43570, lpOverlapped=0x0) returned 1 [0260.718] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0260.742] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.753] CloseHandle (hObject=0xec) returned 1 [0260.753] CloseHandle (hObject=0xe0) returned 1 [0260.754] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\ppintl.rest.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\ppintl.rest.trx_dll.dvodltmf")) returned 0 [0260.754] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\ppintl.rest.trx_dll.dvodltmf")) returned 0x2020 [0260.754] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.REST.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x19196700, ftCreationTime.dwHighDateTime=0x1cac804, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x19196700, ftLastWriteTime.dwHighDateTime=0x1cac804, nFileSizeHigh=0x0, nFileSizeLow=0x43560, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="PPINTL.REST.trx_dll", cAlternateFileName="PPINTL~2.TRX")) returned 0x2e8558 [0260.755] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x19196700, ftCreationTime.dwHighDateTime=0x1cac804, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x19196700, ftLastWriteTime.dwHighDateTime=0x1cac804, nFileSizeHigh=0x0, nFileSizeLow=0x43560, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="PPINTL.REST.trx_dll", cAlternateFileName="PPINTL~2.TRX")) returned 0 [0260.755] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0260.755] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\ppintl.rest.trx_dll")) returned 1 [0260.758] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\ppintl.rest.trx_dll")) returned 0xffffffff [0260.758] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58968200, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x58968200, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x1a560, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.DLL.trx_dll", cAlternateFileName="PUB6IN~1.TRX")) returned 1 [0260.758] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\pub6intl.dll.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0260.758] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\pub6intl.dll.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0260.758] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a560 [0260.759] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0260.759] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0260.850] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x1a560, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x1a560, lpOverlapped=0x0) returned 1 [0260.853] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x1a570, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x1a570, lpOverlapped=0x0) returned 1 [0260.855] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0260.878] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.889] CloseHandle (hObject=0xe0) returned 1 [0260.890] CloseHandle (hObject=0xec) returned 1 [0260.890] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\pub6intl.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\pub6intl.dll.trx_dll.dvodltmf")) returned 0 [0260.890] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.DLL.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\pub6intl.dll.trx_dll.dvodltmf")) returned 0x2020 [0260.891] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.DLL.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58968200, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x58968200, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x1a560, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="PUB6INTL.DLL.trx_dll", cAlternateFileName="PUB6IN~1.TRX")) returned 0x2e8558 [0260.891] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58968200, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x58968200, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x1a560, dwReserved0=0x2e9418, dwReserved1=0x2c8a68, cFileName="PUB6INTL.DLL.trx_dll", cAlternateFileName="PUB6IN~1.TRX")) returned 0 [0260.891] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0260.891] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\pub6intl.dll.trx_dll")) returned 1 [0260.893] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\pub6intl.dll.trx_dll")) returned 0xffffffff [0260.893] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x57655500, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x57655500, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x87f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.REST.trx_dll", cAlternateFileName="PUB6IN~2.TRX")) returned 1 [0260.893] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\pub6intl.rest.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0260.893] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\pub6intl.rest.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0260.893] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x87f60 [0260.893] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0260.894] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0260.985] ReadFile (in: hFile=0xec, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x87f60, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x87f60, lpOverlapped=0x0) returned 1 [0261.087] WriteFile (in: hFile=0xe0, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x87f70, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x87f70, lpOverlapped=0x0) returned 1 [0261.097] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0261.120] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0261.131] CloseHandle (hObject=0xec) returned 1 [0261.131] CloseHandle (hObject=0xe0) returned 1 [0261.131] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\pub6intl.rest.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\pub6intl.rest.trx_dll.dvodltmf")) returned 0 [0261.132] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\pub6intl.rest.trx_dll.dvodltmf")) returned 0x2020 [0261.132] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.REST.trx_dll", lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x57655500, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x57655500, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x87f60, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="PUB6INTL.REST.trx_dll", cAlternateFileName="PUB6IN~2.TRX")) returned 0x2e8558 [0261.132] FindNextFileA (in: hFindFile=0x2e8558, lpFindFileData=0x18ecdc | out: lpFindFileData=0x18ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x57655500, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x57655500, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x87f60, dwReserved0=0x2e9640, dwReserved1=0x2c8a68, cFileName="PUB6INTL.REST.trx_dll", cAlternateFileName="PUB6IN~2.TRX")) returned 0 [0261.133] FindClose (in: hFindFile=0x2e8558 | out: hFindFile=0x2e8558) returned 1 [0261.133] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\pub6intl.rest.trx_dll")) returned 1 [0261.138] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\pub6intl.rest.trx_dll")) returned 0xffffffff [0261.138] FindNextFileA (in: hFindFile=0x2e8518, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2720b500, ftCreationTime.dwHighDateTime=0x1cac80f, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2720b500, ftLastWriteTime.dwHighDateTime=0x1cac80f, nFileSizeHigh=0x0, nFileSizeLow=0x57f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBWZINT.REST.trx_dll", cAlternateFileName="PUBWZI~1.TRX")) returned 1 [0261.138] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUBWZINT.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\pubwzint.rest.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0261.146] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUBWZINT.REST.trx_dll.dvodltmf" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\pubwzint.rest.trx_dll.dvodltmf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0261.147] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x57f60 [0261.147] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2da0000 [0261.147] VirtualAlloc (lpAddress=0x2da0000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000 [0261.237] ReadFile (in: hFile=0xe0, lpBuffer=0x2da000c, nNumberOfBytesToRead=0x57f60, lpNumberOfBytesRead=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesRead=0x18ede0*=0x57f60, lpOverlapped=0x0) returned 1 [0261.296] WriteFile (in: hFile=0xec, lpBuffer=0x2da000c*, nNumberOfBytesToWrite=0x57f70, lpNumberOfBytesWritten=0x18ede0, lpOverlapped=0x0 | out: lpBuffer=0x2da000c*, lpNumberOfBytesWritten=0x18ede0*=0x57f70, lpOverlapped=0x0) returned 1 [0261.302] VirtualFree (lpAddress=0x2da0000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0261.324] VirtualFree (lpAddress=0x2da0000, dwSize=0x0, dwFreeType=0x8000) Thread: id = 2 os_tid = 0x938